“Automatic update” = scam ?

[Houten Kop]

During the last weeks, when starting up my notebook, I have got three times this screen on top of the desktop.

It cannot be closed by clicking on it (“Click here to cancel the scheduled update”.)

It has to be closed by right clicking the button on the taskbar and then clicking “Close window” or by opening the Task Manager (Ctrl-Alt-Del), clicking the process and then clicking “End task”.

What I also find suspicious is that it looks as if Yahoo is promoting Google’s Chromium browser.

[Kahoy]

Looks like a virus or malware to me. Are you using AV software? Install Malwarebytes and run a scan.

[kansuwan]

Google Chromium Browser Malware

[Burkie1203]

Also would run full AV/malware. 

 

Has your default search engine changed?

[Houten Kop]

On ‎20‎/‎07‎/‎2017 at 2:05 AM, kahoy said:

Looks like a virus or malware to me. Are you using AV software? Install Malwarebytes and run a scan.

 

On ‎20‎/‎07‎/‎2017 at 9:55 AM, kansuwan said:

Google Chromium Browser Malware

Thanks.

[Houten Kop]

On ‎20‎/‎07‎/‎2017 at 9:06 PM, Burkie1203 said:

Also would run full AV/malware. 

 

Has your default search engine changed?

Thanks.

No, my default browser/search engine did not change when I closed that screen.

[Houten Kop]

I followed the steps described in How to remove Chromium malware from Windows 10 and could not find anything suspicious.

[Houten Kop]

In the meantime I have run Malwarebytes AdwCleaner.

It did not find any malicious Firefox or Chromium entries, but it did delete some unasked-for objects such as Amazon1Button, App Explorer and WeatherTool.

[Houten Kop]

On ‎20‎/‎07‎/‎2017 at 00:30, Houten Kop said:

During the last weeks, when starting up my notebook, I have got three times this screen on top of the desktop.

It cannot be closed by clicking on it (“Click here to cancel the scheduled update”.)

It has to be closed by right clicking the button on the taskbar and then clicking “Close window” or by opening the Task Manager (Ctrl-Alt-Del), clicking the process and then clicking “End task”.

What I also find suspicious is that it looks as if Yahoo is promoting Google’s Chromium browser.

The picture disappeared, here it is again:

[Houten Kop]

In the meantime I got rid of this malware or whatever it is by removing the following map:

 

C:\Users\<user with administrator rights>\AppData\Roaming\Komurut

 

which contained the following files:

 

info.dat

STTL.DAT

synctask.exe

Telateti.dat

TTL.DAT