Cox Says I Have a Virus, 2nd Thread

Question

Cox Says I Have a Virus, 2nd Thread

On June 7th, 2016, I received a pop-up on my Mac telling me I may have a virus. The message was sent by Cox, with whom I have my cable internet service, and later in the day I received an email from Cox, to whit:

"Compromised Computer Notification from Cox Communications

Dear Subscriber,

Cox has identified that one or more computers/ devices behind your cable modem may be infected with the FakeSecSen or "Spy Sheriff" Virus. A device behind your cable modem appears to have connected to a command and control server affiliated with this malware.

Viruses can take control of your PC and gather your personal information such as passwords and credit card numbers, putting your data at risk..."

I scanned my computer with Malwarebytes Anti-Malware and found nothing. I called Cox, and they confirmed they sent the email. Since the 7th, I have received four additional pop-up warnings but no email . . . Cox only has a record of the email sent on June 7th. I do not have Wi-Fi, this Mac is the only computer hooked to the modem, and that is through a cable. I have had no computer issues beyond the pop-ups, which occur about once a day whenever I am browsing the internet.

I clear my history after each browsing. I clear cookies after each browsing. I reset Safari, and I still got a pop-up.

What should I do next? The pop-ups are annoying.

Posted on Jun 12, 2016 10:35 AM

Reply

Answer 1

Kurt Lang

Level 9

68,700 points

Jun 12, 2016 11:09 AM in response to questioner2016june

I remember your previous topic. You cannot possibly have a virus since there are no viruses in OS X. Also, to be blunt, your ISP is apparently being run by the dumbest security people on the planet.

Here's a similar topic - from over 9 months ago - with the same warning to a Cox user. Pretty much the same wording. For you, impossible is the correct word since FakeSecSen is Windows only malware. It cannot in any way run on a Mac. If you've already told them you have a Mac and they still insist you have FakeSecSen, then they are truly hopeless.

As far as SpySheriff, the server that malware communicated with has been dead since 2008, when it was shut down. All notices after that date are by scammers trying to make you believe you have something that will show up in a web search by that name, but no longer actually exists.

Get a different ISP.

Reply

Answer 2

Esquared

Level 6

12,415 points

Jun 12, 2016 11:08 AM in response to questioner2016june

Have your read through this? Phony "tech support" / "ransomware" popups and web pages

Reply

Answer 3

Jun 12, 2016 12:56 PM in response to Kurt Lang

Thank you for the reply and the confirmation. This is actually my first time posting to this forum - I had read the previous "Cox Says I Have a Virus" thread a year ago, and I used the same title, as my problem, it would appear, is identical. The Cox technician I spoke to, as you said, was less than helpful, even testy when I questioned him about the ongoing pop-ups without confirming emails and what they would do to stop them.

I will begin looking at different ISPs, though I honestly regret having to do so . . . I have been an internet customer of Cox for close to twenty years, and their service, aside from this extremely irritating issue, has been satisfactory.

Reply

Answer 4

Kurt Lang

Level 9

68,700 points

Jun 12, 2016 2:18 PM in response to questioner2016june

Ah. This sounded so familiar, and with your note of "2nd thread", I assumed (without checking) you were the same person.

If you're seeing a lot of pop up windows while using your web browser, then what you may have is adware. For that, use the free automated tool, Malwarebytes Anti-Malware for Mac. Despite its name, it is not typical AV software. Its main purpose is to find and remove adware. Apple does have their own page of manual removal instructions, but it is greatly out of date, and covers only a small portion of what's out there.

Even if adware is on your system, it would still have nothing to do with Cox's warnings.

Reply