888-286-8708

Got a popup on my computer from this site :

http:// computerhelpdesk dot pw /lp5/index.php?cid=1-w98VOR1O3MTU6NUKGLB0UA94

Main Security Error.

The site ahead contains malware.

Attackers currently on malware.testing.google.test might attempt to install dangerous programs on your computer that steal or delete your information (for example, photos, passwords, messages, and credit cards).

To fix, please contact customer care at (888) 286-8708 immediately.

=====

"The site ahead contains malware" - I am sure the site owner is giggling at how self-referential that statement is.

Now for information about that site :

http://www.urlvoid.com/scan/computerhelpdesk.pw/
No reports yet

=====

http://www.urlvoid.com/ip/52.11.219.150/
IP ADDRESS: 52.11.219.150
We have found in our database of already analyzed websites that there are 4 websites hosted in the same web server with IP address 52.11.219.150 and IP hostname ec2-52-11-219-150.us-west-2.compute.amazonaws.com. Remember that it is not good to have too many websites located in the same web server because if a website gets infected by malware, it can easily affect the online reputation of the IP address and also of all the other websites.

Browse a list of websites hosted in 52.11.219.150 IP address:
#                 Website
1     Alert     malwaresupportline.co
2     Alert     pornovirus.co
3     Valid    computerhelpdesk.pw
4     Alert     veyerus-scanner-alert.is

===== ^ three untrustworthy websites on the same IP address and server ? hmmm

http://whois.domaintools.com/computerhelpdesk.pw

Registrant Org     WhoisGuard, Inc. was found in ~2,585,670 other domains

Dates     Created on 2015-05-13 - Expires on 2016-05-13 - Updated on 2015-05-18

IP Address      52.11.219.150 - 17 other sites hosted on this server
IP Location      United States - Oregon - Portland - Amazon Technologies Inc.
Whois History     5 records have been archived since 2015-05-20

Whois Record ( last updated on 2015-06-14 )
Domain Name:   COMPUTERHELPDESK.PW
Domain ID:         D8047888-CNIC
WHOIS Server:  whois.namecheap.com
Referral URL:    http://www.namecheap.com
Updated Date:   2015-05-18T05:12:10.0Z
Creation Date:  2015-05-13T00:00:00.0Z
Registry Expiry Date: 2016-05-13T23:59:59.0Z
Sponsoring Registrar: Namecheap
Registrant ID: AUGHAWNCYWDYTWNO
Registrant Name:               WhoisGuard Protected
Registrant Organization:    WhoisGuard, Inc.
Registrant Street:               P.O. Box 0823-03411
Registrant City:                  Panama
Registrant State/Province: Panama
Registrant Postal Code:     00000
Registrant Country:            PA
Registrant Phone:              +507.8365503
Registrant Fax:                  +51.17057182
Registrant Email:               60b46ca4effc4bf8ab8ff5b167e1b01c.protect@whoisguard.com

Admin ID:         5CVFHYGQRT1FTY5R
Admin Name:   { rest of information same as Registrant }
Tech ID:           Q4GXH10EF1DFDCLT
Tech Name:    { rest of information same as Registrant }
Billing ID:         2LV1HHQCX2S2HR54
Billing Name:  { rest of information same as Registrant }

scumbags.

The typical tech support scam presents itself to the user while browsing the web, in the form of a pop-up message saying that a virus or “suspicious activity” has been detected. A phone number is provided, of course, which the user can call to get “support” with this problem.

These pop-ups are usually the result of visiting a page that is either malicious itself, or that has been hacked, or that contains advertising from an ad feed that has been hacked. In any case, the page contains malicious code that either displays a pop-up, or redirects to a malicious page that then displays the pop-up.

It is also important to understand that these messages are not caused by a virus, or any other kind of malware. Many people’s first reaction to a pop-up like this is to go download anti-virus software. This is the wrong response, as there is no malware involved, and thus the anti-virus software will not solve the problem.  Also, do not call the "tech support number" that pops up on your screen.

In many cases, these messages will seem to lock up your web browser. They will reappear if they are dismissed, and they reappear even after quitting the browser and then re-opening it. This will not necessarily always happen, and may not happen for all versions of all browsers. However, if you see this behavior, the first task is getting rid of these messages so you can use your browser again.

Getting rid of this crap when using Safari:

- Quit Safari. If you are unable to do that, press command-option-esc to display the Force Quit Applications window. In that window, select Safari and click the Force Quit button.

- To prevent the malicious page from reloading automatically, and thus the pop-up from reappearing, hold down the shift key while launching Safari.

If that doesn’t work, quit Safari again, then navigate to the following folder:

~/Library/Saved Application State/
(If you are not sure how to find this folder, see Locating files from paths.)

Inside that folder, find the folder named com.apple.Safari.savedState. Drag that to the trash.

Next, go to the following folder:

~/Library/Safari/
In that folder, drag the LastSession.plist file to the trash. Now open Safari, and the message should be gone.

Not using Safari?   Check out this site, which I copied all the above info from:

http://www.thesafemac.com/tech-support-scam-pop-ups/