Scary popup screens -- wants you to call Microsoft

[JNozum]

As a local computer technician in the Moundsville, WV area, I am getting complaints of customers getting scary flash-up screens with dire warnings, wanting you to call "Microsoft"--RIGHT AWAY (EMERGENCY!). They may threaten to withdraw from your bank account. They often try to disable the 'X', trying to keep you from exiting your browser. I had one variation, which had a LOUD emergency alarm, specifically to induce PANIC. From talking to another computer guru, it appears that today's browsers are so much more secure that creeps can't penetrate them like they could 5-10 years ago, so now they're resorting to "scareware", trying to scare the crap out of users. Fortunately, CTRL-ALT-DEL will allow you to "kill" the browser that is currently having this scary message. Upon rebooting, people have done multiple security scans, and "nothing" is found. However, they are very troubling, especially for older people and those already prone to anxiety and/or otherwise stressed out. I've educated people about unwanted toolbars, adware, and even tainted versions of Google Chrome. However, 2-3 of my customers seem to be VERY TARGETED for such flash-up screens--on an unusually frequent basis.

Another curve ball to this whole mess is the fact that most newer computers are set so when you hit the power button, it goes to SLEEP (or hibernate). THIS IS VERY DANGEROUS!!! When I fix computers or prep new ones, I go to the Power Options and change "What the power buttons do" to "shut down". Even the emergency shutdown (holding in on the power button 4-5 consecutive seconds) is much more limited in its usefulness when the power button is programmed to go to sleep or hibernate. Upon firing back up, it can TAKE YOU RIGHT BACK TO THAT DANGEROUS STATE AGAIN!!! However, when the computer does a full shut-down (not go to sleep or hibernate), then it has a much better chance of breaking the tie with the "boogeyman" on the other end.

I'm concerned that many of these are getting in through infected ad servers, in which we can't do a whole lot about. If that isn't bad enough, more and more sites are DEMANDING that we turn off our ad blocker--and will DENY us content until we do! Since most of these are not quote "viruses", a regular AV program will NOT catch it. Some of these may actually be graphical screens, probably a Flash thing, which would make it much more impossible for an AV program to catch. I try to explain that usually no damage is done as long as you don't call that number. Since they can't penetrate systems like they could 5-10 years ago, they resort to SCARY stuff, HOPING that you would CALL that number--RIGHT NOW. It is at that point and when a remote connection is made that the REAL damage starts. However, this is happening rather FREQUENTLY with some people--and is VERY DISTRESSING and UNNERVING. Aside from doing multiple scans for viruses and other malware and checking for unwanted toolbars and more, is there anything else I can do to ease the fears and such of my customers--and keep such from happening again and again, particularly on a frequent basis? It is as if some people are SPECIFICALLY TARGETED for such scareware. I'm also having difficulty counseling some of these people, and are so paranoid, panicky, and such. I usually recommend my customers to use Firefox and definitely try to stay clear of IE when feasible. As for Google Chrome, I really get into people's minds, QUESTIONING WHERE they got it from. I am VERY PARTICULAR about this. If a person says "I don't know how it got there" or "It just got there", THAT SCARES ME me as a technician! These are the ones that are often TAINTED (POISONED versions of Chrome). I've seen 1-2 "versions" of "Chrome" that AVG flagged as a virus and/or other serious malware!

Any ideas or better explanations of things here?

From John Nozum

 

[samuria]

In most cases it's just a message on a website and nothing is downloaded. Setting DNS to 208.67.220.220 & 208.67.222.222 will help it's opendns which blocks bad sites it's also very fast

 

[ThrashZone]

Hi,
Most of the time the issue spawns from people opening or following links in email services usually not much anyone can do to help them

 

[mrjimphelps]

most newer computers are set so when you hit the power button, it goes to SLEEP (or hibernate).

I can't figure out why anyone would make the default behavior for the ON/OFF button to be to put the computer in sleep mode. A person naturally thinks of shutting something down when he presses the ON/OFF button.

I'm concerned that many of these are getting in through infected ad servers, in which we can't do a whole lot about. If that isn't bad enough, more and more sites are DEMANDING that we turn off our ad blocker--and will DENY us content until we do!

I browse with Firefox, with NoScript Security Suite added in. I have it set to block all scripts except those I have whitelisted. It is really fun to see all of the junk that NoScript blocks. And most sites will run adequately with only their own scripts enabled. For those must-have sites which don't work well (or at all) with FF/NoScript, I use Opera with ad-blocking turned on.