I was using Ancestry.com on Chrome and clicking links within that site to access various features. The pages are pop-ups. Last week I clicked a link and a full page pop up appeared which stated I was a century link customer (my internet provider) and that there was an error with pop-ups and I needed to call an 888 number. It made sense at the time and I called the number thinking it was maybe Ancestry support. The man answering the phone asked the age of my PC and OS. He had me type in a web address (I'm sorry but I don't remember it) and then enter a code on that page which was about 8 or 9 digits with automatic dashes in between. I thought that maybe I was renewing an IP address. Once I did that he asked me to enter something else and at that point, I asked what was being accomplished with what I was doing. Whatever his explanation I realized this had nothing to do with Ancestry.com or Centurylink. I hung up. I restarted my laptop and updated and ran Kaspersky Pure 3.0, Malwarebytes, rkill 64 and a few other malware detectors. Nothing detected, but every subsequent page, Ancestry or another site, I clicked on a link and the pop up came up with essentially the same information but a different number each time. Trying to exit out was a nightmare with one pop up page opening after another.

Because I'd already been having problems with double line ad pop ups in the weeks before I decided to do a system restore. I should have gotten the address of the website where I typed in the code from the browsing history but I didn't think about it at the time. Before running system restore, I saved my files and folders on discs. Yes I know it's old school, it's all I had available with enough storage space at midnight.

Long story short, the system restore had its own set of problems and I decided to replace the aging laptop. Once I started the new laptop, I set to reloading the folders and files into the new laptop. One of the folders had copies of my tax returns. When I opened that folder it was empty except for a text document. The text document, which I don't remember being there before, read:

[0409/133412:INFO:(0)] WebCore is now online. 
[0409/133412:INFO:(0)] Running Awesomium 

I know this is a log file of some kind. The date on the document was 4/9, the day of my call to "tech support". There's no reason I can think of that folder should have been empty. I used files in that folder about a month ago. All the other folders and files I've checked so far have been intact. I'm the only one who uses this laptop and it doesn't leave home. When I signed into Chrome with my email address, I got the same pop-up but I reset my browser and it hasn't happened again.

I'm kind of freaked out that it's this particular file that's empty. Can anyone give me an idea of whether I should be? I regret that I can't be more specific but is there anything in what I've stated that makes it seem that I allowed remote access? I'm sorry I can't tell you exactly what words the pop-up page used exactly or give more explicit details. I googled the number I called and a "who called me" kind of website had posts that described a similar scenario but they only commented on the fact that it sounded like someone from India and the person was trying to sell the on spending money to rid their system of malware. They didn't mention opening another web page or entering a code. I didn't think much of the whole incident as anything but deep-rooted malware until I looked for these tax return files.

  • re: the log file: ttlc.intuit.com/questions/… – schroeder Apr 14 '15 at 23:54
  • 2
    Unfortunately, this is a tech support question, and there is not much we can do for you. You gave control over your computer to a hacker, and it is unknown what they did to your machine. As for the empty folder, you said you restored it from backup - it seems that it was emptied from the backup, or the backup never included the files you expected. – schroeder Apr 14 '15 at 23:57
  • Hopefully too you will learn some lessons from this. 1) You should have already had a history of backups, and you should have already verified that your backups worked. 2) NEVER respond to anything you did not explicitly ask for. 3) Always and only call or email any customer support from your monthly bill or from a web lookup that YOU initiated. 4) Making last-minute copies of local files from an already possibly infected laptop could well re-infect a restored laptop (or your new laptop). – cybermike Apr 15 '15 at 0:41