Recurring Microsoft Defender Subscription Fraud Popup Continues to Appear

Title: Dealing with a Persistent Microsoft Defender Subscription Scam Popup: A User’s Guide

If you’ve recently encountered a troublesome popup claiming that your Windows Defender antivirus has been upgraded to a $299 Pro plan, you’re not alone. Many users have reported similar experiences with what seems to be a deceptive scam designed to alarm and confuse. This particular popup not only persists across various browsers but also activates PowerShell, raising concerns about potential system compromise.

The popup typically states: “Your Windows Defender antivirus is upgraded to a Pro plan of $299.00. The payment will be charged from your credit card on August 26, 2024.” Recognizing this as a scam is the first step toward resolving the issue. However, the persistent nature of the popup can make it difficult to ensure your computer remains uncompromised.

Steps to Address the Issue

Initiate Antivirus Scans:
It’s wise to run multiple security scans using Microsoft Defender. While you’ve already performed a quick scan, full scan, and offline scan, it’s important to ensure your antivirus software is up to date before conducting these scans again. Sometimes, outdated definitions may miss newly emerged threats.
Investigate Running Processes:
You mentioned seeing conhost.exe in your System32 folder. Generally, this process is legitimate and part of the Windows operating system. However, if it’s consistently associated with PowerShell when the popup appears, it may warrant closer scrutiny. Use your task manager to monitor this process and see if it shows unusual CPU or memory usage.
Clear Browser Data:
Deleting browsers alone may not be sufficient. Make sure to clear all cookies, cache, and saved data from your web browsers. This can help eliminate any lingering traces of malicious scripts that might be triggering the popup.
Consider Malware Removal Tools:
If the problem persists, consider using a dedicated malware removal tool. Programs like Malwarebytes or AdwCleaner can provide additional layers of protection and might identify threats that Windows Defender overlooks.
Review Installed Programs:
Go through your installed programs in the Control Panel. Look for any unfamiliar applications, especially those installed around the same time you began experiencing the popup issue. If you find anything suspicious, uninstall it immediately.
Seek Expert Help:
If the above steps do not resolve the issue and you’re still experiencing the popup alongside suspicious activity, it may be time to consult a professional. Cybersecurity experts