What is the Fake Virus Scam?
Imagine this alert on your screen. Scary thought, right? This message is intended to scare users into calling the toll-free number. The problem is, these alerts are fake. There is nothing wrong with the computer.The goal of the scam is to trick users into paying unnecessary and costly support services. The scam associates itself with well known brands such as Microsoft.
Once the fake virus “infects” the computer, the browser appears to be locked. A robotic voice blares alarming messages such as pornography, credit card theft, and personal information loss, and the authorities will be contacted. Just imagine you're in a work environment and that comes over your computer. The scam succeeds when the user allows remote control of the “infected” computer.
Experience the Fake Virus Scam
Ominous RoboVoice
The Fake Virus often plays a repeat loop of a robovoice warning of credit card theft, pirated software and other ominous warnings.
Are you really Microsoft?
The scammers work hard to associate with the Microsoft brand without crossing the line. But sometimes they cross the line.
Control my computer?
We recorded the scammers to learn their tactics to get victims to grant control of their computer and ultimately their credit card.
Having some fun
PC Matic's CEO (Rob Cheng) had some fun playing with the scammers on the phone and ultimately gets his problem solved..
Fake Virus Scam Numbers
| Hoax Phone #s | First Seen | Last Seen | Days |
|---|---|---|---|
| 1-800-521-6038 | 9/16/2022 | 9/16/2022 | 1 |
| 1-800-772-1213 | 12/6/2021 | 12/6/2021 | 1 |
| 1-909-883-8611 | 5/14/2021 | 10/12/2021 | 152 |
| 1-855-274-9507 | 9/9/2021 | 9/9/2021 | 1 |
| 1-762-888-8180 | 2/1/2021 | 2/1/2021 | 1 |
| 1-712-432-0075 | 12/3/2020 | 12/3/2020 | 1 |
| 1-888-777-4870 | 11/25/2020 | 11/27/2020 | 3 |
| 1-855-368-4200 | 11/18/2020 | 11/18/2020 | 1 |
| 1-855-740-0616 | 10/16/2020 | 10/16/2020 | 1 |
| 1-844-386-6601 | 10/12/2020 | 10/13/2020 | 2 |
| 1-844-485-0536 | 9/30/2020 | 9/30/2020 | 1 |
| 1-844-995-3877 | 9/29/2020 | 9/29/2020 | 1 |
| 1-855-560-1440 | 9/24/2020 | 9/25/2020 | 2 |
The Fake Virus implores the victim to call a number for support. The scam cycles through phone numbers in order to avoid detection. We have compiled the most recent telephone numbers used by the scammers. Tip: Use *67 when calling fake virus numbers.
Fake Virus Tips and Pointers
Although the Fake Virus reputes to be from Microsoft, it can hit any platform including Windows, Linux, Mac, Android, and OSX. The fake virus enters the computer through a compromised web page and freezes the browser and exhorts to call a toll free number. The toll free number operator then attempts to gain control of the computer in order to "remove" the virus and charge fees ranging from $200 - $600. Two quick lessons. Only let people you trust to have control of your computer. Don't call the fake virus phone numbers unless you are bored.
On Windows and Mac computers, one must kill the browser which has become frozen. On Windows computers, hit CTRL+ALT+DEL, choose task manager, find the frozen browser, and hit "kill task". On Mac computers, hit CMD+Option+ESC, find the frozen browser, and hit "Force Quit". Reinitiate the browser. If there is an option to restore tabs, respond negatively.
Another option to restore options is to reboot the computer. On Android and OSX devices, reboot is the only option.
As frustrating as this fake virus scam can be, rest assured there is a light at the end of the tunnel.
How the Fake Virus Works
The Fake Virus exploits a Javascript bug in browsers such as Chrome, Firefox, Internet Explorer, Opera, and Edge. The compromised web site delivers a Javascript alert which is a dialog box that is placed over the screen. The alert is then placed in an infinite loop. No matter what the user clicks, the dialog box returns. When placed in this state, the tab and browser are unresponsive and appears to be locked. The screen and the dialog box both reinforce the message that there is a virus and they must call the toll free number.
How PC Matic Blocks the Fake Virus
PC Matic is best known for its TV advertising touting its white list approach to antivirus which only allows trusted applications to run. PC Matic has created a white list of phone numbers that can appear in Javascript alerts. If a phone number is not on the list, the alert is blocked and the browser is brought to a safe page. This feature is included with PC Matic at no extra charge.
Fake Virus Scam URLs
| Hoax URLs | Last Seen | Days |
|---|---|---|
| https://www.forneyind.com/Default.aspx?ID=102 | 9/16/2022 | 1 |
| https://chat.mymedicare.gov/chatclient/ChatPanel.aspx | 12/6/2021 | 1 |
| https://emr1.sbmed.com/csp/user/Patient/PorApt.csp?AppType=Return | 10/12/2021 | 152 |
| https://calendar.google.com/calendar/u/0/r/week?tab=mc | 9/9/2021 | 1 |
| https://emr1.sbmed.com/csp/user/Patient/PorApt.csp?AppDate=65992 | 9/5/2021 | 1 |
| https://calendar.google.com/calendar/u/0/r/month?tab=rc | 2/1/2021 | 1 |
| https://calendar.google.com/calendar/u/0/r?tab=rc | 12/3/2020 | 1 |
| https://tana22tan.ml/bbnmtvbhnnrxrtcyt/?i=14449066 | 11/27/2020 | 1 |
| https://tana22tan.ml/bbnmtvbhnnrxrtcyt/?i=75033 | 11/27/2020 | 1 |
| https://speakersonlineoffline.ga/kgkiilaaee_473vva/?i=15361696 | 11/25/2020 | 1 |
| https://www.transportation.gov/transportation-health-tool/indicators | 11/18/2020 | 1 |
| https://chillyfifties.ml/crombonia_xwiremnovn/?i=15601782 | 10/16/2020 | 1 |
| https://tobaccokillsyou.cf/chr00_xwiremnovn/?i=15623397 | 10/13/2020 | 1 |
| https://dorotheumrolex.ga/chr00_xwiremnovn/?i=15389327 | 10/13/2020 | 1 |
| https://buyarrangement.ml/chr00_xwiremnovn/?i=15382636 | 10/13/2020 | 1 |
URLs for Fake Virus Scams pop up almost as fast as they can be counted. Each one may only be used for a few hours at a time, and then Cyber Criminals will create another unique site to lock down their victims. We are updating this table with all of the URLs that PC Matic protects our customers from during normal web browsing.
These URLs may no longer be active after a short period of time, but you should exercise caution clicking them. In most cases these are live scam links that will attempt to lock down your browser. If you’re not familiar with these scams or how to kill your browser and escape them, do not visit these links.
Why is PC Matic Doing This?
Perhaps the largest security hole in our nation's digital infrastructure is that many of the companies in the security industry care more about profits than security. In fact, many companies' profits increase due to the lack of security in our world. We believe that security software should solve security problems first, and generate profits second.
Recently, the FTC settled with two groups that were behind fraudulent tech support alerts. These two groups were required to never participate in computer technical services again. However, this litigation and settlement has hardly put a dent in the malicious pop-up activity. Litigation and fines are not the answers. It’s time for a solution. It's time for PC Matic.
To our great and loyal customers - we could not accomplish these things without your continued support. In addition to not getting infected with viruses or ransomware, you will not be exposed to this hoax. Thank you.
Protect Your PC Now
PC Matic blocks this Fake Virus Scam from hijacking your browser experience as well as protects your PC from ransomware, polymorphic viruses and more...