Subj : Browser Scareware
To   : All
From : Daryl Stout
Date : Fri Nov 01 2019 00:01:28

  Recently, I had some "scareware" get into Google Chrome, which locked
up the browser. 

  Suspecting that it was a ruse (it was), I did NOT call the number noted. 

  I have had 2 fellow ham radio operators confirm that it was "scare-ware";
one of them notes "he sees that twice a week" (he had worked in IT for 
years)...and that the best course of action is to run the OS Task Manager, 
and close the browser (end task). Then, open it and clear the cache/history 
(I have Google Chrome set to empty the cache when I exit it anyway), and to 
be safe, run a full virus scan with your software (it will take several 
hours).

  When I restarted it, when Google Chrome said "it did not shut down
properly", and asked "if I wanted to restore it, or open a new tab", I
chose the latter. Then, I went in, and cleared the cache.

  I also run the IObit Malware Fighter, which has "quadruple protection"
in a real time monitoring mode, its own anti-malware/anti-spyware engine,
the BitDefender anti-malware engine, and an anti-ransomware engine, with
doing automatic daily updates. I also have AdBlock Plus, and the IOBit
Ad Blocker utilities installed in Google Chrome.

  How I got it could've been with a link somewhere, or someone tried to
get that into my system through my BBS, even though only select ports are
open.

***

FYI for all,

  What you describe is highly likely the scam that only locks up your
browser. You can search for the quick fix, I think you clear the browser
history for the day and cookies, and restart your computer, but you can
verify that fix online.

  The scam is to get you to call the phone number which is NOT Microsoft.

  You will then be pressured on the call to let then install software to
gain remote access to your computer. While continuing to talk with you
about all the bad viruses they are finding, what they are really doing
is searching your computer for info they can use. They will then insist
in frightened vocal expressions how serous it is, and you need to pay
them immediately to fix it, or all hope is lost.

  This is about 60 day old info. Things could have changed since then, but
that scam has been around for some time. When it happened to my wife
visiting a web site set up to lock up the browser with that message, and
keep reopening it or preventing it from closing, I searched Google on
another machine for just the phone number. That brought up the name of
the scam and info about it, including info about it.

  Thought I'd share this info in case it happens to someone else here. I
also did what you did, ran a full malware scan after I cleared the browser.

  To protect against Ransomware on my computers, I use software recommended
by US DHS, AppGuard(R). It prevents files you have not already downloaded
and installed, from executing. When you are installing and updating
software, you manually select, move a slider bar from PROTECTED to ALLOW
INSTALLS. There is also an unprotected option. When done, you can move
the bar to PROTECT, or it will do so itself after a default 20 minutes.
You have a lot of options to customize its operation.
--- SBBSecho 3.10-Win32
 * Origin: The Thunderbolt BBS - tbolt.synchro.net (454:1/33)

.