# Scam on the new computer **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [September 8, 2019, 6:33pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891 "2019-09-08T18:33:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 8, 2019, 6:33pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/1 "2019-09-08T18:33:01Z")
I bought a new MacBook Pro a couple of months ago. Since the old one has been working well enough, I’ve barely used the new one. (The old one is not in the shop for a full diagnostic, and – I’ll bet – a new hard drive.). Something weird has been happening with the new computer. I’ll have a webpage open, and suddenly it replaces the page I’m on (or navigates to) a virus warning page: > [@](#): > > [AppleCare logo] > **Your system is infected with 3 viruses! Sunday, 8 September 2019 10:29** > > Your Mac is infected with 3 viruses. Our security check found traces of 2 malware and 1 phishing/spyware. System damage: 28.1% - Immediate removal required! > > The immediate removal of the viruses is required to prevent further system damage, loss of Apps, Photos or other files. Traces of 1 phishing/spyware were found on your Mac with OSX. > > **Personal and banking information are at risk.** > > To avoid more damage click on ‘Scan Now’ immediately. Our deep scan will provide help immediately! > **1 minute and 29 seconds remaining before damage is permanent.** First, I’ve barely used this computer. Second, I am not one to visit ‘unsafe sites’. But somehow I’ve been targeted. The warning looks _very_ convincing, except for one thing: the ‘ticking clock’ at the bottom. Either there’s ‘damage’, or there isn’t. No legitimate company would put the countdown clock there. I initiated a chat session with Apple Support, and they confirmed that it’s not from Apple. They also gave me a link to Malwarebytes, which I have installed. (Malwarebytes says my system is clean.) I just wanted to share this because I’ve never had a phishing/trojan attempt that redirected a webpage. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [September 8, 2019, 6:43pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/2 "2019-09-08T18:43:39Z")
Most malware these days puts an extension on your web browser. In addition to a Malwarebytes scan, also scan with Adwcleaner. Hacker can also put scripts on legitimate sites. Usually, they buy ad space. After it’s approved, they put a small script in the graphic that warns you that you computer is infected. The site doesn’t know anything about it. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [September 8, 2019, 6:47pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/3 "2019-09-08T18:47:02Z")
It is probably an ad on the website you are browsing. It doesn’t have to be an “unsafe site” for it to show bad ads. In general, websites don’t hand pick their ads, but subscribe to an ad network that places them. Some of the ad networks are not too discriminating, some can be tricked, and others can be hacked. All of that results in those deceptive ads being displayed. I recommend using an ad blocker. Why didn’t you get this on your old computer? I don’t know. Maybe it’s a new problem with the website that is coincidental, maybe it is specific to the updated version of Safari you’re using, or something like that. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [September 8, 2019, 7:17pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/4 "2019-09-08T19:17:57Z")
> [@echoreply](#): > > It is probably an ad on the website you are browsing. It doesn’t have to be an “unsafe site” for it to show bad ads. Yeah, this. There’s at least one company, MacKeeper, that has invested humongous sums of money into misleading advertisements designed to look like your browser or OS is alerting you to a problem. ---
**Author:** ![cochrane](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cochrane/32/10441_2.png) [@cochrane](https://boards.straightdope.com/u/cochrane)\ **Post date:** [September 8, 2019, 7:20pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/5 "2019-09-08T19:20:32Z")
Yeah, the website is probably serving up the malware. I get these redirects on my phone all of the time. I just close out the tab and stay away from that site in the future. My phone hasn’t been infected so far, and I do run Malwarebytes regularly. ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [September 8, 2019, 7:35pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/6 "2019-09-08T19:35:14Z")
FWIW I’ve seen the same “you have X viruses” ad (or one very similar) on the SDMB itself. Have you seen this happen on more than one website, or is it always on the same site? If the latter, the site probably is just using an ad service that has let a nasty ad get through. Even if it appears on more than one site, it’s possible the sites are using the same ad service. Another thing you can (and almost certainly should) do is install an ad blocker. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 8, 2019, 7:37pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/7 "2019-09-08T19:37:00Z")
> [@cochrane](#): > > Yeah, the website is probably serving up the malware. Seems to happen on SDMB. But I pay, so I don’t get ads. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [September 8, 2019, 9:20pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/8 "2019-09-08T21:20:03Z")
Try using [9.9.9.9](https://www.quad9.net) as your DNS. It eliminates a lot of these annoyances. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 8, 2019, 10:50pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/9 "2019-09-08T22:50:27Z")
> [@RealityChuck](#): > > also scan with Adwcleaner. **Software requirements** Windows 10 (32/64-bit) Windows 8 (32/64-bit) Windows 7 (32/64-bit) I’m not using Windows. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 8, 2019, 10:52pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/10 "2019-09-08T22:52:20Z")
> [@beowulff](#): > > Try using [9.9.9.9](https://www.quad9.net) as your DNS. > It eliminates a lot of these annoyances. DNS is set to 8.8.8.8. I don’t remember why, but some tech support person said I needed to change it to that so that something would work. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [September 8, 2019, 10:53pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/11 "2019-09-08T22:53:40Z")
In my experience, these crap isn’t even malware. It’s just browser-hijacker ads. Make sure you have “Block pop-up windows” turned on. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 8, 2019, 10:59pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/12 "2019-09-08T22:59:00Z")
> [@markn\_1](#): > > Another thing you can (and almost certainly should) do is install an ad blocker. I assumed AdBlock Plus was copied when I had the stuff from the old computer transferred to this one. I’ve downloaded and installed. I don’t remember… The icon is supposed to be grey, right? ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [September 8, 2019, 11:05pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/13 "2019-09-08T23:05:18Z")
> [@Johnny\_L.A](#): > > DNS is set to 8.8.8.8. I don’t remember why, but some tech support person said I needed to change it to that so that something would work. 8.8.8.8 is Google DNS. It’s pretty good, but Quad-9 specifically blocks dodgy URLs. ---
**Author:** ![TheCuse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thecuse/32/2854_2.png) [@TheCuse](https://boards.straightdope.com/u/TheCuse)\ **Post date:** [September 8, 2019, 11:08pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/14 "2019-09-08T23:08:51Z")
Download and use Malware Bytes for the Mac. The majority of time, those warnings are bogus. If you quit the browser they go away. They only want you to install crap like MacKeeper. EDIT: I see you have already installed Malware Bytes, so you should be fine. I still think that warning was bogus and just an attempt to install nasty stuff. I’ve seen similar warnings like that on my Mac several times and just quitting the browser was fine. ---
**Author:** ![lingyi](https://avatars.discourse-cdn.com/v4/letter/l/d2c977/32.png) [@lingyi](https://boards.straightdope.com/u/lingyi)\ **Post date:** [September 8, 2019, 11:27pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/15 "2019-09-08T23:27:39Z")
Off-topic, but feel a need to share. I don’t have a Mac, but fefore you go ahead with any repairs that your Mac shop may recommend, I highly recommend contacting Louis Rossman [https://rossmanngroup.com/macbook-logic-board-repair/](https://rossmanngroup.com/macbook-logic-board-repair/) or at least watch a few of his Mac Ripoff videos on his channel: [https://www.youtube.com/user/rossmanngroup](https://www.youtube.com/user/rossmanngroup) But lingyi, you don’t have a Mac, so why recommend Rossman? I came across his site because of Linus Tech Tips where they had an “unfixable” Mac Pro that would cost more to repair than to buy a new one. At least according to Rossman (as well as other YouTubers), Mac techs are instructed to recommend buying a new machine than repair. Take it with as large a grain of salt as you like. ---
**Author:** ![simster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/simster/32/1047_2.png) [@simster](https://boards.straightdope.com/u/simster)\ **Post date:** [September 9, 2019, 2:17am UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/16 "2019-09-09T02:17:14Z")
> [@Johnny\_L.A](#): > > I assumed AdBlock Plus was copied when I had the stuff from the old computer transferred to this one. I’ve downloaded and installed. I don’t remember… The icon is supposed to be grey, right? If Adblock is working - then it should be ‘red’ - grey means that ads are allowed on the site you’re currently visiting , either because you have specifically whitelisted the site or because adblock is malfunctioning. ---
**Author:** ![Sunspace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunspace/32/1250_2.png) [@Sunspace](https://boards.straightdope.com/u/Sunspace)\ **Post date:** [September 9, 2019, 4:41am UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/17 "2019-09-09T04:41:15Z")
> [@AHunter3](#): > > Yeah, this. There’s at least one company, MacKeeper, that has invested humongous sums of money into misleading advertisements designed to look like your browser or OS is alerting you to a problem. One of the things I remember from my mercifully-brief time on the phones providing official Mac tech support is that Apple considered MacKeeper to be malware. I helped more than one person remove it. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 9, 2019, 1:23pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/18 "2019-09-09T13:23:43Z")
> [@simster](#): > > If Adblock is working - then it should be ‘red’ - grey means that ads are allowed on the site you’re currently visiting , either because you have specifically whitelisted the site or because adblock is malfunctioning. So… I should reinstall it? Or should I wait to see if any place complains I’m using an ad blocker? ---
**Author:** ![DCnDC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dcndc/32/2842_2.png) [@DCnDC](https://boards.straightdope.com/u/DCnDC)\ **Post date:** [September 9, 2019, 1:23pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/19 "2019-09-09T13:23:47Z")
> [@beowulff](#): > > In my experience, these crap isn’t even malware. It’s just browser-hijacker ads. > Make sure you have “Block pop-up windows” turned on. Agree with this. If you are using Opera, Chrome, or Firefox, you should install these extensions: Privacy Badger, HTTPS Everywhere, and uBlock Origin. They are all from open-access devs and the combination eliminates nearly 100% of all ads online. Since switching back to Firefox and using these extensions I don’t even remember the last time I saw ads online. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [September 12, 2019, 3:21pm UTC](https://boards.straightdope.com/t/scam-on-the-new-computer/839891/20 "2019-09-12T15:21:36Z")
> [@simster](#): > > If Adblock is working - then it should be ‘red’ - grey means that ads are allowed on the site you’re currently visiting , either because you have specifically whitelisted the site or because adblock is malfunctioning. This morning I received this response from ABP [excerpted]: > [@](#): > > The ABP icon on Safari remains grey even when the extension is active. [Next page](https://boards.straightdope.com/t/scam-on-the-new-computer/839891.md?page=2)