new twist on malware popups

Factual Questions
1

The crooks are getting smarter. A few minutes ago, I was browsing with Chrome, and my screen looked like this.

Enlarge the text error message if you have to. It’s obvious that this is a scam message, not from Microsoft, and a call to the phone number will get you someone in India who will try to get your credit card number to “fix” the problem. I see crap like this all the time. The perpetrators can go fuck themselves.

But the new twist was I couldn’t click on any tab or Chrome function to get out of it. Everything was disabled.

Alt/Tab worked fine, to get to another browser or program. Searching for “can’t close tab in Chrome” gave several suggestions, none of which worked, because all the Chrome tabs and functions were disabled, including keyboard shortcuts and dropdown menus.

The final solution was to open the Task Manager (cntl/alt/del), select the offending program in the processes list, right-click and say “end task.” The only problem here was there were 15 “Chrome” processes in the list, all alike. Each one I ended only closed one Chrome tab, but I was able to find the offending one on the second guess.

Anyone have this happen? Is there a better way to fix it? To avoid it? I ran Malwarebytes after, and it found nothing on my system, which is not surprising. The problem seems to be a browser hijack by a rogue program, and not a resident EXE file.

2

Have seen them for a while. I always use task manager to kill the browser because I don’t trust clicking on anything, even if it were enabled.

3

My father actually got something like that yesterday (using Chrome). I was able to close it by clicking the X button and then closing Chrome, but I had to get Chrome closed less than a second after closing the pop-up because it just opens it self back up right away.

I showed my dad how to do it with Task Manager.

4

Java (and possibly Javascript?) can disable the mouse cursor. Javascript and flash can also capture keyboard clicks.

The relevent code seems to be this:



	function startNow(){
		if (navigator.userAgent.indexOf("MSIE") > 0 || navigator.userAgent.indexOf("Firefox") > 0){spc='';}
		//if (navigator.userAgent.indexOf("Chrome") > 0){
		if (navigator.userAgent.indexOf("Firefox") > 0){
			alert(msg); location.reload();
		}else{
			setInterval(function(){alert(msg); if(spc!=''){msg=msg+spc; spc='';}},10);
		}
	}

	if (navigator.userAgent.indexOf("Firefox") < 0){	
		window.onbeforeunload = function(){return msg;};
	}
5

I have noticed, perhaps a year ago, that Chrome intercepted error messages sent by web pages and re-displayed them in a “safe,” plain-jane graphic box. “The program asks…” That way, if you close the box or agree with something in it, Chrome just sends your response back to the web page. It’s like a 2-click rule of sorts, and isolates you from the worst consequences.

That’s my theory, but before that coding change, you might see graphics from the web site; after, you only saw Chrome’s generic error box.

But the crooks seem to have found a way around that, since the error box in my example could not be closed. Even the window closing “X” was disabled.

6

Short version: It was just a JavaScript popup that you click the “X” in the upper right to get out of. Because you’re using Windows XP and some sort of display/font scaling, the bottom of the dialog box was cut off. Normally, Chrome would give you an option to “Do not display any more dialogs from this page”, like this screenshot: Dropbox - Error - Simplify your life

Anyway, you can change your display scaling options to see that full dialog box or get some sort of JavaScript blocker like uMatrix - Chrome Web Store

You can also just disable JavaScript globally in Chrome, but you’ll break most websites out there.

Longer explanation:
When somebody does a JavaScript alert, it creates a “modal” dialog box. In Windows programming, this means no other user actions can be processed until that modal dialog is dealt with – Chrome won’t let you do anything else until you click OK or the “X” FOR THE DIALOG BOX, not just the X for a tab. The problem with this particular one was that it was an infinite loop, so every time you closed it, it would re-open itself. Chrome has detection and protection for this built in with the “Don’t allow this page to create any more dialogs” functionality, as above, but you couldn’t see that checkbox because of a Windows XP display scaling bug.

7

Yeah, I’ve seen situations like that, and you can close a window if you are fast enough or repeat the action enough. I tried that method here, and it didn’t work. And the “X” button was disabled along with everything else.

I have no doubt that the computer was registering all my clicks and key presses, because the error window reacted each time by popping up a little, but nothing else happened.

8

Actually, it looks like the scaling bug isn’t limited to XP. It happens at higher font size settings in Windows 8.1 too.

The workaround is pretty simple: Just drag the dialog box up (drag its top portion, where the titlebar normally is) until you can see the checkbox at the bottom.

You can also push alt-space on your keyboard, choose Move, and then use the arrow keys to move it up, and then push enter to let go.

9

I scrolled the box down, but don’t recall seeing that option at the bottom, and I’d prefer not to recreate the situation to check it out. If it happens again, I’ll try looking for that checkbox. I was pretty sure the long box was intentional, to hide something. Thanks for the tip.

ETA: The reason I may not have seen the message at the bottom of the scrolled error box may have been due to the taskbar I usually keep at the bottom of the screen, always on top. It may have covered the last line.

10

Huh, that’s a pretty clever trick. It doesn’t install malware or anything, so its pretty harmless, but I can see how someone would be tempted to call the number just to get rid of it.

11

Did you see the screenshot I took above? The checkbox lives outside the scrollable text area. You just have to drag the window up.

They fixed the hack, by the way, and you can actually see the couch now if that’s what you want.

If you want to play it with on a safe page, I put up a test:
http://asdfv.com

12

I think we’re both right. When I move the taskbar out of the way and scroll the dialogue box, your message can be seen. sample.

As far as wanting to see what was on the “furniture” page, it’s of no interest. By the time I got into diagnosing the problem, I’d forgotten how I got there, but it wasn’t what I was looking for.

Thanks for the bogus (?) malware page!

13

Sure, but for future reference, it’s not the message that matters. It’s the checkbox outside of the scroll area that you want to find:

That lets you stop these annoying loops on any website that uses it, regardless of the message length.