2
Today I start getting in Chrome a message saying:
"I SEE YOU ARE A XXXXX CUSTOMER are you concerned that your Linux computer may have a potential security risk.... Please call toll free for IMMEDIATE assistance ... IP: XXXX Browser: XXXX ...."
And give me a telephone number. The XXXX are some information about my institution (I guess they get this because my public IP) and my internet connection.
This message appears in a pop-up always when I open a new tab on Chrome. Ad-block didn't help. Cleaning the cache, cookies and temporary files neither. I uninstalled Chrome and got Firefox were I don't have the issue any more.
I wish to know if it could be considered a very annoying phishing technique or could be a malware installed in my Linux workstation. How can I distinguish if is an important security issue or not?
EDIT:
A couple of hours navigating after a fresh installation of Linux is enough to get a lot of publicity and undesired message in my browser. Because it is so fast, I tough it was common and I start to think they are minor annoying malwares but nothing danger for my safety. I just put Ad-block to avoid see them and then I can forget they exist. Now with this new powerfull phishing message I start to worry.
So, my concern here is to know if I was right about this common publicity and undesired message are minor safety issues and how to know when they become important to being the only solution to nuke the computer as schroeder says in the comments. On the other hand, if this are not minor problems... oh Lord... what can I do?
alexis
Posted 2015-04-17T17:44:40.893
Reputation: 151
2Your question is a little confused: it is both a phishing technique and an indication of malware installed (likely in a Chrome extension if it went away when you switch to Firefox). Aside from that, you should have a professional look at your machine to determine if the infection was greater than just the browser. Or just nuke your computer and rebuild (you DO keep backups, right?) – schroeder – 2015-04-17T17:56:44.877
Agree, sounds like malware. Try Chrome Incognito mode and/or also try disabling all extensions -- if it's still happening, it's a deeper problem and you will have some trouble. – gregmac – 2015-04-17T19:16:06.143
These scammers seem to be extremely desperate... Did they really think a Linux user would fall for this and then buy their support/antivirus/other scam? – None – 2015-04-17T21:57:42.810
1Thanks for the comments. You are right, is a quite confusing. I edit the question trying to be a little more specific. @André: Well, my mom has now Linux... and I hope soon any mom and grandmom start to use it. May be good to start thinking that a user linux will need protection too. – alexis – 2015-04-17T22:28:44.197
Could be your local ISP being infected. ISP's can push out messages instead of the content you request and if someone is exploiting them, then you should contact them, but after you rule out it's your machine. ALSO... "A couple of hours navigating after a fresh installation of Linux" on Firefox?... as you've said "I uninstalled Chrome and got Firefox", still not clear if it's only on Chrome. – JasonXA – 2015-04-18T17:34:30.417
Also, Linux or Windows, should make no difference to the poweruser, he should be able to use both to their potential. – JasonXA – 2015-04-18T17:35:22.047
It was only on Chrome where I got the pop-up message reported here. However, in both Chrome and Firefox I always have to use Ad-block to avoid plenty of other advertising. – alexis – 2015-04-18T21:39:13.100