How to recognize pop-up scams like Your McAfee Subscription Has Expired?

What is Your McAfee Subscription Has Expired scam?

It is a deceptive pop-up message stating that the anti-virus suite subscription is no longer valid. It is delivered by various deceptive websites. Research shows that many users visit these sites inadvertently - they are redirected by intrusive ads (displayed by other rogue sites) or PUAs (potentially unwanted apps).

Your McAfee Subscription Has Expired scam in detail

The message essentially states that the McAfee anti-virus suite subscription has expired and encourages users to immediately renew it to prevent ransomware and other infections. This is a scam. After clicking "Renew Now", users are asked to enter personal information.

Entered data is saved on a remote server controlled by cyber criminals. Furthermore, these people misuse private information to generate revenue. Therefore, entering private details can lead to serious privacy issues or even identity theft. We strongly recommend that you ignore this fraudulent message and leave the site immediately.

More details about pop-up scams

Note that some rogue sites use scripts that prevent users from closing browsing tabs/windows. In these cases, close the browser using Task Manager or reboot the system. In addition, do not restore the previous session the next time you run your browser, otherwise you will end up opening the malicious site/s again.

More details about potentially unwanted applications

Potentially unwanted programs deliver coupons, banners, pop-ups, and other similar advertisements. These are delivered using various tools (e.g., "virtual layer") that enable placement of third party graphical content on any site. Therefore, intrusive ads often conceal underlying website content, thereby diminishing the browsing experience.

Furthermore, these advertisements might redirect to malicious websites and execute scripts that stealthily download/install malware. Clicking them risks various computer infections. Another important issue is information tracking. Research shows that many PUAs record information relating to web browsing habits.

Internet Protocol (IP) addresses, geographic locations, website URLs visited, pages viewed, search queries, keystrokes, and other collected information often includes personal details that developers sell to third parties. These people (potentially, cyber criminals) misuse private information to generate revenue.

Thus, the presence of data-tracking app(s) can lead to serious privacy issues or even identity theft. You are strongly advised to eliminate all PUAs immediately.

Threat Summary:

Name	Your McAfee subscription has expired pop-up
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	Delivered error message claims that user's McAfee subscription has expired and encourages to renew it.
Related Domains	reviewsgizmo[.]com, techsys[.]site, mreaynew[.]xyz, m-afee[.]com, mobi-com-com[.]com, securepcshields[.]live, begirnist[.]xyz, avpcshield[.]live, leniserd[.]xyz, skizze[.]click, blackfridaydeal[.]online, aherod[.]life, securitycheckguide[.]com, virusblocked[.]store, whe4ablist[.]click, ni453na-low241ery3[.]com, system-defending[.]com, setleomc1[.]click, setleomc2[.]click, customus[.]live, usstore[.]digital, b-cdn[.]net, rapidlinkmc1[.]club, eushop[.]digital, rapidlinkmc2[.]club, globalprotectionspc[.]com, greenpeaceofgarbage[.]store, jud476icious-ar436use4[.]xyz, turbolinkmc1[.]club, turbolinkmc2[.]club, longbrown[.]live, speedlinkmc1[.]club, online-offer[.]club, quicklinkmc2[.]club, quicklinkmc1[.]club, speedlinkmc2[.]club, pc-my-protection[.]xyz, systemupdatecontrol[.]com, www-safety[.]com, darkclick[.]site, live-protect[.]xyz, slowlist[.]site, webprotectionsurveys[.]com, black-control-wmc1[.]click, black-control-wmc2[.]click, updt-updt-wmc1[.]click, updt-updt-wmc2[.]click, checkscreen[.]icu, tidenous[.]com, protectionnotice[.]com, security-check360[.]com, xylodos[.]com, virus-protection[.]services, cansile[.]com, saureus[.]xyz, antivirus[.]secure-12[.]com, onlineprotection[.]site, securitydeals[.]club, securitytoday[.]org, apps-notification[.]com, subscriptions[.]click, your-privacy-guardians[.]com, renew-subscriptions[.]com, cleandata[.]store, securesystemstatus[.]com, anti-virus-renewals[.]com, antivirus[.]secure-11[.]com, activation[.]one, renewals[.]click, onlinescan[.]report, safetykey[.]click, safetylocked[.]click, safesoftware[.]click, safeprotection[.]click, av-renewal[.]com, privacylocked[.]click, octobermall[.]com, computer-protection[.]co, safenetwork[.]services, ogbtrck[.]com, safe-gw15[.]com, dailyprotection[.]site, antivirus-protection[.]me, device-protection[.]services, capropcscan[.]xyz, biliontrk[.]com, vipguard[.]site, papershield[.]store, webpackets[.]store, nftcomputerprotector[.]store, mbyprotection[.]xyz, celectintlbhmcone[.]click, celectintlbhmctwo[.]click, techtimesweekly[.]com, mainacceptance[.]quest, backetintlbhmcone[.]click, backetintlbhmctwo[.]click, appsecurity[.]site, shineintlbhmctwo[.]click, verifuintlbhmcone[.]click, verifuintlbhmctwo[.]click, officeintlwhmc2[.]click, workintlbhmc1[.]click, workintlbhmc2[.]click, deskintlbhmc1[.]click, deskintlbhmc2[.]click, rewardspromotional[.]com, antivirus[.]svrs-us[.]com, bestprotection[.]site, antivirus-software[.]co, febdomscan[.]xyz, cloudintlbhmc1[.]click, cloudintlbhmc2[.]click, onlinesurvey[.]cloud, workdeskbmc2[.]click, workdeskbmc1[.]click, burningmotion[.]com, digitaldefender[.]store, makegreenbmc1[.]click, makegreenbmc2[.]click, bettersafety[.]store, avprotected[.]site, greeksaladbowl[.]com, rainbowcitrusbmc1[.]click, rainbowcitrusbmc2[.]click, fastblock[.]site, freshfruitwmc1[.]click, freshfruitwmc2[.]click, weeklypromotional[.]com, longpink[.]shop, longlog[.]live, slowchain[.]site, a-pigeon-wmca1[.]click, fastdrivewmc1[.]click, fastdrivewmc2[.]click, fixingweb[.]site, repairpage[.]site, highspeedlinkmc1[.]club, highspeedlinkmc2[.]club, loyality-program[.]com, protectionsurveys[.]com, aprtchscan[.]xyz, protectpc[.]club, coolshadowwmc1[.]click, coolshadowwmc2[.]click, speedblock[.]site, screensapp[.]icu, audiochain[.]site, screenlabs[.]icu, dragndropbmc1[.]click, dragndropbmc2[.]click, redcoin[.]site, dragndropwmc1[.]click, dragndropwmc2[.]click, shownowbmc1[.]click, shownowbmc2[.]click, writenowbmc1[.]click, mcafee-system-scanner[.]com, slowred[.]club, laksacockles[.]com, moonnightbmc1[.]click, moonnightbmc2[.]click, easypcsecurity[.]com, deshaici[.]net, orangemangowmc1[.]click, orangemangowmc2[.]click, coinforcoin[.]site, techevolution[.]work, ultimate-detection[.]com, redbytes[.]site, defendersurveys[.]com, processingnowwmc1[.]click, secureantivirus[.]info, processingnowwmc2[.]click, createdtoprotect[.]com, renewappwmca1[.]store, renewappwmca2[.]store, thousoucm[.]com, comsys[.]site, blackblog[.]site, redbyte[.]click, a-mastodon-wmca1[.]click, shortblue[.]site, longblue[.]site, a-mastodon-wmca2[.]click, mydesktopdefender[.]com, web-protocols[.]org, virusvanguard[.]store, esoftwareservices[.]live, bradeu[.]info, totalwebguardian[.]store, security-notification[.]digital, susiticof[.]com, vigorouspocket[.]com, bitblog[.]click, blightsteel[.]com, renewalcentralwmca2[.]store, landerhd[.]com, greencirclewmca2[.]store, protectionyoupc[.]com, uk-antivirus[.]com, karlus[.]info, defender-scanner[.]com, protectlab[.]xyz, hardyharhar[.]store, pitasinspectors[.]store, newformulamc1[.]live, newformulamc2[.]live, karleu[.]info, brownteakmc1[.]click, lowbench[.]info, brownteakmc2[.]click, securephone24[.]host, systemsoftware[.]shop, darkteakmc1[.]click, antiviruscheck[.]info, darkteakmc2[.]click, handovertimemc1[.]club, handovertimemc2[.]club, excellentyardcare[.]store, fredus[.]live, vyredis[.]bio, toppromo24[.]click, alliedgoober[.]store, augustpromob2[.]click, purrunification[.]store, landerhq[.]com, coatimundiguardian[.]shop, browserdownloadz[.]com, getsecures[.]com, interestingwarden[.]store, secureinternetcheck[.]com, setupmostprogressiveinfo-file[.]info, mypremium[.]info
Symptoms	Fake error messages, fake system warnings, pop-up errors, hoax computer scan.
Distribution methods	Compromised websites, rogue online pop-up ads, potentially unwanted applications.
Damage	Loss of sensitive private information, monetary loss, identity theft, possible malware infections.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Pop-up scams in general (with examples)

This scam shares many similarities with dozens of other misleading pop-ups, such as, for example, You Are Our Winner Today!, ERROR 268d3x8938, Microsoft Alert Your Data Is At High Risk, and Computer Detected To Be Corrupted.

Unlike Your McAfee Subscription Has Expired scam, most of these messages claim that the system is already damaged (e.g., infected, missing files, etc.) and encourages users to download fake anti-virus/system repair tools or contact fake 'tech support'.

Cyber criminals generate revenue by promoting in-app purchases or tricking users into paying for unnecessary tech support. Potentially unwanted programs also share many similarities. These programs often offer a range of useful functions, but these claims are merely attempts to give the impression of legitimacy.

The only purpose of PUAs is to generate revenue for the developers. Rather than giving any real value, they pose a direct threat to your privacy and Internet browsing safety.

How did potentially unwanted programs install on my computer?

Some PUAs have official download websites, however, most infiltrate systems without permission, since developers promote them using intrusive advertising and "bundling" methods. "Bundling" is essentially stealth installation of third party applications together with regular software.

Developers hide "bundled" PUAs within "Custom/Advanced" settings (or other sections) of the download/installation processes. Furthermore, many users are very likely to rush these procedures and skip steps.

In addition, they click various ads. This behavior often leads to inadvertent installation of PUAs - users expose their systems to risk of various infections and compromise their privacy.

How to avoid installation of potentially unwanted applications?

Lack of knowledge and careless behavior are the main reasons for computer infections. The key to safety is caution. Therefore, pay close attention during download/installation processes, and when browsing the Internet in general. Select "Custom/Advanced" settings and carefully analyze each window of the download/installation dialogs.

Opt-out of additionally-included programs and decline offers to download them. You are advised to never use third party download/installation tools, since developers monetize them by promoting ("bundling") rogue apps. Software should be downloaded from official sources, via direct download links.

Note that developers invest many resources into intrusive ad design, thereby making them seem legitimate, however, most lead to pornography, adult dating, survey, gambling, and other untrustworthy sites. If you encounter these ads, uninstall all suspicious applications and browser extensions.

If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate them.

Text presented in "Your McAfee Subscription Has Expired" pop-up:

Windows Security Center: Your McAfee subscription has expired today. Renew now to protect your computer from the latest Ransomware viruses.
Your McAfee subscription has expired on 8 July 2018
Do not leave your PC unprotected against the latest threats. Renew your subscription now to stay protected.
What Should I Do?
Step 1: Click the button below to download the latest version of McAfee 2018
Step 2: Run McAfee Antivirus to scan and remove all potential threats

The appearance of "Your McAfee Subscription Has Expired" pop-up (GIF):

Another dubious website (protect-now[.]online) promoting McAfee:

Text presented within this site:

Antivirus Protection Notice
Purchase now to stay protected for your PC.

If your PC is Unprotected, protect it now.

$70.00 Off Available Now

Protect Now

Another variant of "Your McAfee Subscription Has Expired" pop-up scam promoted via Amazon AWS service:

Text presented within:

Your McAfee Anti-Virus Protection!
Due to recent reports of Malware and Viruses, McAfee has released an Antivirus update.

Computers without the Antivirus, could be exposed to viruses and slower performance.

Clean and improve the performance of your Computer now. No computer restart is required.

Please Enable Now:

Xylodos.com website promoting McAfee via "Your Windows 10 is infected with 5 viruses!" pop-up scam:

Another variant of "Your McAfee Subscription Has Expired" pop-up scam (displayed by antivirus.secure-12.com website):

A variant of "Your McAfee Subscription Has Expired" pop-up scam displayed by onlineprotection.site website:

A variant of "Your McAfee Subscription Has Expired" pop-up scam displayed by securitytoday.org website:

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by apps-notification.com website:

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by subscriptions.click website:

Example of a questionable McAfee ad pushed via browser notifications:

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by your-privacy-guardians.com website:

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by renew-subscriptions.com website:

Another example of McAfee subscription-themed scam website:

Text presented within:

Mcafee Security subscription upgrade

Scan your computer with Mcafee and it will protect you from many different kind of threats.

Protect your PC now, it may be exposed to viruses and other malware without the right protection.

Software: Latest version: August 2022
Personal discount: ACTIVATED

Activate your protection now

Yet another example of "Your McAfee Subscription Has Expired" pop-up scam:

Text presented within:

YOUR MCAFEE SUBSCRIPTION HAS EXPIRED!

Your McAfee® Total Protection subscription has expired on September 1, 2022.

After this date your computer will become susceptible to viruses and malware.

You are eligible for discount: up to 70% 1yr. renewal discount

Offer will expire in: 4 mins 05 secs

[RENEW SUBSCRIPTION]

IMPORTANT NOTE! Pop-ups that promote scams like "Your McAfee Subscription Has Expired" are often delivered by websites that ask to enable web browser notifications:

Example 1:

Example 2:

Therefore, before commencing, perform these steps:

Google Chrome (PC):

• Click the Menu button (three dots) on the right upper corner of the screen and select "Settings"
• Scroll down to the "Privacy and security" section, select "Site settings" and then "Notifications"
• Click three dots on the right hand side of each suspicious URL and select "Block" or "Remove" (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Google Chrome (Android):

• Click on the Menu button (three dots) on the right upper corner of the screen and tap "Settings"
• Scroll down, tap on "Site settings" and then "Notifications"
• In the opened window, locate all suspicious URLs and tap on them one-by-one
• Once the pop-up shows up, select either "Block" or "Remove" (if you tap "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Mozilla Firefox:

• Click the Menu button (three bars) on the right upper corner of the screen
• Select "Settings" and click on "Privacy & Security" in the toolbar on the left hand side of the screen
• Scroll down to the "Permissions" section and click the "Settings" button next to "Notifications"
• In the opened window, locate all suspicious URLs and block them using the drop-down menu or either remove them by clicking "Remove Website" at the bottom of the window (if you click "Remove Website" and visit the malicious site once more, it will ask to enable notifications again)

Microsoft Edge:

• Click the menu button (three dots) on the right upper corner of the Edge window and select "Settings"
• Click on "Cookies and site permissions" in the toolbar on the left hand side of the screen and select "Notifications"
• Click three dots on the right hand side of each suspicious URL under "Allow" section and click "Block" or "Remove" (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Safari (Mac):

• Click "Safari" button on the left upper corner of the screen and select "Preferences..."
• Select the "Websites" tab and then select "Notifications" section on the left pane
• Check for suspicious URLs and apply the "Deny" option using the drop-down menu or either remove them by clicking "Remove" at the bottom of the window (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Your McAfee subscription has expired pop-up?
• How to identify a pop-up scam?
• How do pop-up scams work?
• How to remove fake pop-ups?
• How to prevent fake pop-ups?
• What to do if you fell for a pop-up scam?

How to identify a pop-up scam?

Pop-up windows with various fake messages are a common type of lures cybercriminals use. They collect sensitive personal data, trick Internet users into calling fake tech support numbers, subscribe to useless online services, invest in shady cryptocurrency schemes, etc.

While in the majority of cases these pop-ups don't infect users' devices with malware, they can cause direct monetary loss or could result in identity theft.

Cybercriminals strive to create their rogue pop-up windows to look trustworthy, however, scams typically have the following characteristics:

• Spelling mistakes and non-professional images - Closely inspect the information displayed in a pop-up. Spelling mistakes and unprofessional images could be a sign of a scam.
• Sense of urgency - Countdown timer with a couple of minutes on it, asking you to enter your personal information or subscribe to some online service.
• Statements that you won something - If you haven't participated in a lottery, online competition, etc., and you see a pop-up window stating that you won.
• Computer or mobile device scan - A pop-up window that scans your device and informs of detected issues - is undoubtedly a scam; webpages cannot perform such actions.
• Exclusivity - Pop-up windows stating that only you are given secret access to a financial scheme that can quickly make you rich.

Example of a pop-up scam:

How do pop-up scams work?

Cybercriminals and deceptive marketers usually use various advertising networks, search engine poisoning techniques, and shady websites to generate traffic to their pop-ups. Users land on their online lures after clicking on fake download buttons, using a torrent website, or simply clicking on an Internet search engine result.

Based on users' location and device information, they are presented with a scam pop-up. Lures presented in such pop-ups range from get-rich-quick schemes to fake virus scans.

How to remove fake pop-ups?

In most cases, pop-up scams do not infect users' devices with malware. If you encountered a scam pop-up, simply closing it should be enough. In some cases scam, pop-ups may be hard to close; in such cases - close your Internet browser and restart it.

In extremely rare cases, you might need to reset your Internet browser. For this, use our instructions explaining how to reset Internet browser settings.

How to prevent fake pop-ups?

To prevent seeing pop-up scams, you should visit only reputable websites. Torrent, Crack, free online movie streaming, YouTube video download, and other websites of similar reputation commonly redirect Internet users to pop-up scams.

To minimize the risk of encountering pop-up scams, you should keep your Internet browsers up-to-date and use reputable anti-malware application. For this purpose, we recommend Combo Cleaner Antivirus for Windows.

What to do if you fell for a pop-up scam?

This depends on the type of scam that you fell for. Most commonly, pop-up scams try to trick users into sending money, giving away personal information, or giving access to one's device.

• If you sent money to scammers: You should contact your financial institution and explain that you were scammed. If informed promptly, there's a chance to get your money back.
• If you gave away your personal information: You should change your passwords and enable two-factor authentication in all online services that you use. Visit Federal Trade Commission to report identity theft and get personalized recovery steps.
• If you let scammers connect to your device: You should scan your computer with reputable anti-malware (we recommend Combo Cleaner Antivirus for Windows) - cyber criminals could have planted trojans, keyloggers, and other malware, don't use your computer until removing possible threats.
• Help other Internet users: report Internet scams to Federal Trade Commission.

Frequently Asked Questions (FAQ)

What is a pop-up scam?

A pop-up scam is a fraudulent message designed to trick unsuspecting users into providing personal information, downloading files, installing potentially software, transferring money, purchasing unnecessary services, products.

Why do I encounter fake pop-ups?

Most of the pop-up scams are displayed by untrustworthy websites. Users do not open these pages intentionally. They end up on these pages through sites that use questionable advertising networks. It is also common for these pages to be promoted via potentially unwanted applications.

Will Combo Cleaner protect me from pop-up scams?

Combo Cleaner is designed to scan websites and detect malicious ones. Including the ones designed to deliver pop-up scams. This app will notify about untrustworthy pages and restrict access to them.

▼ Show Discussion