Summary:

A client encountered a fake security alert pop-up while browsing the internet, which falsely claimed that her computer was infected with a virus. The pop-up attempted to coerce her into calling a phone number for supposed "Windows Support" and threatened that her access had been blocked for security reasons. This type of pop-up is known as a tech support scam, a common tactic used by scammers to trick users into sharing personal information or paying for fake support services.

Below is a screenshot of the fraudulent pop-up she encountered:

Characteristics of the Fake Security Alert:

• False virus detection: The pop-up claims that the computer is infected with malware or viruses, displaying random technical jargon like “Stuxnet” and fake error codes (e.g., "Error code: 0x06D9").
• Phone number for fake support: It prominently displays a phone number, urging users to call “Windows Support.” In this case, the number was +1-805-330-7344, which is not associated with Microsoft.
• Scare tactics: It uses alarming language such as “Your computer has been blocked for security reasons” and suggests compromised data, like email IDs and bank passwords.

Steps to Resolve and Prevent Recurrence:

1. Close the browser immediately:

   • First, avoid interacting with the pop-up. Do not click "Allow" or "Deny."
   • Use Task Manager (Ctrl + Shift + Esc) to force close the browser:
     1. Open Task Manager.
     2. Locate the browser application (e.g., Chrome, Edge, Firefox).
     3. Select it and click End Task.

2. Clear the browser’s cache:

   • After reopening the browser, instruct the user to clear their browsing history and cache:
     • Navigate to Settings > Privacy & Security > Clear browsing data.
     • Ensure that Cached images and files and Browsing history are selected, then click Clear Data.

3. Run a malware scan:

   • Perform a full system scan using a trusted antivirus tool such as:
     • Windows Defender (built-in on Windows devices).
     • Malwarebytes (recommended for detecting adware or other unwanted programs).

4. Check and remove suspicious browser extensions:

   • Navigate to the browser’s extension or add-on manager:
     • In Chrome: Menu > Extensions > Manage Extensions.
     • Remove any unfamiliar or suspicious extensions that may have been installed without the user's consent.

5. Update the system:

   • Ensure that the Windows OS is fully updated to avoid vulnerabilities:
     • Settings > Windows Update > Check for updates.
   • Similarly, update the browser to the latest version.

6. Enable pop-up and ad blockers:

   • Advise users to enable the browser's built-in pop-up blocker and install ad-blocking extensions such as uBlock Origin or Adblock Plus to reduce the chances of encountering such scams in the future.

What to Avoid:

• Never call the provided number: These scammers typically impersonate well-known companies like Microsoft, trying to extract payments or sensitive personal information.
• Avoid interacting with the pop-up: Clicking any buttons (such as "Allow" or "Deny") can lead to more intrusive malware or unwanted installations.

Further Action:

If the issue persists or malware is detected, deeper troubleshooting may be required. This could include:

• Checking startup programs: Use Task Manager > Startup tab to review programs that run at startup and disable anything unfamiliar.
• Restoring the system: Utilize a restore point to revert the system to a state prior to the infection.

Final Notes:

This incident is a reminder to stay vigilant against phishing and scam pop-ups. Users should be aware that Microsoft or other legitimate companies will never display unsolicited pop-ups asking users to call a support number or take immediate action.

By following the steps outlined above, users can safely close scam alerts and avoid falling victim to tech support scams.

Related Knowledgebase Articles:

• How to Spot a Tech Support Scam
• Securing Your Browser Against Pop-ups and Ads
• Performing a Malware Scan with Windows Defender