Addendum to last week

Last week was a reprint of a scareware article I wrote. It’s a common tactic, often using a popup. I got a call from my friends who were having the problem and I went over to their home to see it in action. It was great, and repeatable. The reason it was repeatable was because it wasn’t a popup at all. The scareware was an actual website.
 
What happened was the victim does a search, in this case on Netflix. The search results present in a dropdown box which was trying to complete what you were searching for. So you start by typing Netflix, and it comes up with choices like Netflix Account, Netflix Login, Netflix Specials, blah blah blah. Netflix Account was selected in the dropdown box and BOOM, the screen shows all kinds of computer stuff in the background and a popup that says Microsoft has Detected horrible stuff and you MUST call the number on your screen.
 
That wasn’t actually a popup, it was a website made to look like it had a popup, and it was not able to be closed. It was possible to go into Task Manager, select Chrome, and End Task. It was just a website designed to fool the viewer, nothing was actually on the computer per se. On further checking, it was actually a PAID AD on Google, which I find highly annoying. Paid Ads can come up on a legitimate search and they say Ad, in a box underneath it. Look for them. Most are likely legitimate, but this one was not. If nothing were selected from the dropdown box and you just hit enter, then a standard selection of search results on Netflix is presented, with the offending Ad on top. Sneaky, but you can see it was not actually a Netflix URL there.
 
So, by doing a “proper” search, instead of the dropdown box, it brings up all the websites and URL’s, and we were able to see the “Netflix Account” search was actually this phoney Ad with the dire warnings and the lie that it was Microsoft.
 
It was really clever. Horrible. And clever. And the person on the other end of the phone was also very clever, and very believable. He was also a gravy sucking scumbag rat b*st*rd.
 
Below shows the dropdown box. In the case of my computer, the “evil” Netflix Account page doesn’t even show. I don’t know why. In any case, you can see by selecting any of those choices below, you don’t really know what you will get, as they do not show any URL’s associated with them.  

Below, you will see the results of just hitting Enter after typing Netflix, and you get a normal page to choose from.

​What’s good about this is that the URL is listed, and the first choice is https://netflix.com.
That’s clearly Netflix. What came up for my friends was something completely different, and did not show Netflix in the URL.
If a “popup” comes up like that for you, DO NOT panic. It’s not Microsoft, you probably don’t have a bunch of malware (yet), and absolutely DO NOT CALL the phone number or give anyone remote access to your computer. If you just aren’t sure, turn off your computer and call me or Carol. It won’t get worse if your computer is off, so why do anything right away?