FacebookTwitterLinkedIn

How to recognize pop-up scams like Your McAfee Subscription Has Expired?

Also Known As: Your McAfee subscription has expired pop-up
Damage level: Medium

What is Your McAfee Subscription Has Expired scam?

It is a deceptive pop-up message stating that the anti-virus suite subscription is no longer valid. It is delivered by various deceptive websites. Research shows that many users visit these sites inadvertently - they are redirected by intrusive ads (displayed by other rogue sites) or PUAs (potentially unwanted apps).

Your McAfee Subscription Has Expired scam

Your McAfee Subscription Has Expired scam in detail

The message essentially states that the McAfee anti-virus suite subscription has expired and encourages users to immediately renew it to prevent ransomware and other infections. This is a scam. After clicking "Renew Now", users are asked to enter personal information.

Entered data is saved on a remote server controlled by cyber criminals. Furthermore, these people misuse private information to generate revenue. Therefore, entering private details can lead to serious privacy issues or even identity theft. We strongly recommend that you ignore this fraudulent message and leave the site immediately.

More details about pop-up scams

Note that some rogue sites use scripts that prevent users from closing browsing tabs/windows. In these cases, close the browser using Task Manager or reboot the system. In addition, do not restore the previous session the next time you run your browser, otherwise you will end up opening the malicious site/s again.

More details about potentially unwanted applications

Potentially unwanted programs deliver coupons, banners, pop-ups, and other similar advertisements. These are delivered using various tools (e.g., "virtual layer") that enable placement of third party graphical content on any site. Therefore, intrusive ads often conceal underlying website content, thereby diminishing the browsing experience.

Furthermore, these advertisements might redirect to malicious websites and execute scripts that stealthily download/install malware. Clicking them risks various computer infections. Another important issue is information tracking. Research shows that many PUAs record information relating to web browsing habits.

Internet Protocol (IP) addresses, geographic locations, website URLs visited, pages viewed, search queries, keystrokes, and other collected information often includes personal details that developers sell to third parties. These people (potentially, cyber criminals) misuse private information to generate revenue.

Thus, the presence of data-tracking app(s) can lead to serious privacy issues or even identity theft. You are strongly advised to eliminate all PUAs immediately.

Threat Summary:
Name Your McAfee subscription has expired pop-up
Threat Type Phishing, Scam, Social Engineering, Fraud
Fake Claim Delivered error message claims that user's McAfee subscription has expired and encourages to renew it.
Related Domains reviewsgizmo[.]com, techsys[.]site, mreaynew[.]xyz, m-afee[.]com, mobi-com-com[.]com, virusblocked[.]store, ni453na-low241ery3[.]com, system-defending[.]com, setleomc1[.]click, setleomc2[.]click, customus[.]live, usstore[.]digital, b-cdn[.]net, rapidlinkmc1[.]club, eushop[.]digital, rapidlinkmc2[.]club, globalprotectionspc[.]com, greenpeaceofgarbage[.]store, jud476icious-ar436use4[.]xyz, turbolinkmc1[.]club, turbolinkmc2[.]club, longbrown[.]live, speedlinkmc1[.]club, online-offer[.]club, quicklinkmc2[.]club, quicklinkmc1[.]club, speedlinkmc2[.]club, pc-my-protection[.]xyz, systemupdatecontrol[.]com, www-safety[.]com, darkclick[.]site, live-protect[.]xyz, slowlist[.]site, webprotectionsurveys[.]com, black-control-wmc1[.]click, black-control-wmc2[.]click, updt-updt-wmc1[.]click, updt-updt-wmc2[.]click, checkscreen[.]icu, tidenous[.]com, protectionnotice[.]com, security-check360[.]com, xylodos[.]com, virus-protection[.]services, cansile[.]com, saureus[.]xyz, antivirus[.]secure-12[.]com, onlineprotection[.]site, securitydeals[.]club, securitytoday[.]org, apps-notification[.]com, subscriptions[.]click, your-privacy-guardians[.]com, renew-subscriptions[.]com, cleandata[.]store, securesystemstatus[.]com, anti-virus-renewals[.]com, antivirus[.]secure-11[.]com, activation[.]one, renewals[.]click, onlinescan[.]report, safetykey[.]click, safetylocked[.]click, safesoftware[.]click, safeprotection[.]click, av-renewal[.]com, privacylocked[.]click, octobermall[.]com, computer-protection[.]co, safenetwork[.]services, ogbtrck[.]com, safe-gw15[.]com, dailyprotection[.]site, antivirus-protection[.]me, device-protection[.]services, capropcscan[.]xyz, biliontrk[.]com, vipguard[.]site, papershield[.]store, webpackets[.]store, nftcomputerprotector[.]store, mbyprotection[.]xyz, celectintlbhmcone[.]click, celectintlbhmctwo[.]click, techtimesweekly[.]com, mainacceptance[.]quest, backetintlbhmcone[.]click, backetintlbhmctwo[.]click, appsecurity[.]site, shineintlbhmctwo[.]click, verifuintlbhmcone[.]click, verifuintlbhmctwo[.]click, officeintlwhmc2[.]click, workintlbhmc1[.]click, workintlbhmc2[.]click, deskintlbhmc1[.]click, deskintlbhmc2[.]click, rewardspromotional[.]com, antivirus[.]svrs-us[.]com, bestprotection[.]site, antivirus-software[.]co, febdomscan[.]xyz, cloudintlbhmc1[.]click, cloudintlbhmc2[.]click, onlinesurvey[.]cloud, workdeskbmc2[.]click, workdeskbmc1[.]click, burningmotion[.]com, digitaldefender[.]store, makegreenbmc1[.]click, makegreenbmc2[.]click, bettersafety[.]store, avprotected[.]site, greeksaladbowl[.]com, rainbowcitrusbmc1[.]click, rainbowcitrusbmc2[.]click, fastblock[.]site, freshfruitwmc1[.]click, freshfruitwmc2[.]click, weeklypromotional[.]com, longpink[.]shop, longlog[.]live, slowchain[.]site, a-pigeon-wmca1[.]click, fastdrivewmc1[.]click, fastdrivewmc2[.]click, fixingweb[.]site, repairpage[.]site, highspeedlinkmc1[.]club, highspeedlinkmc2[.]club, loyality-program[.]com, protectionsurveys[.]com, aprtchscan[.]xyz, protectpc[.]club, coolshadowwmc1[.]click, coolshadowwmc2[.]click, speedblock[.]site, screensapp[.]icu, audiochain[.]site, screenlabs[.]icu, dragndropbmc1[.]click, dragndropbmc2[.]click, redcoin[.]site, dragndropwmc1[.]click, dragndropwmc2[.]click, shownowbmc1[.]click, shownowbmc2[.]click, writenowbmc1[.]click, mcafee-system-scanner[.]com, slowred[.]club, laksacockles[.]com, moonnightbmc1[.]click, moonnightbmc2[.]click, easypcsecurity[.]com, deshaici[.]net, orangemangowmc1[.]click, orangemangowmc2[.]click, coinforcoin[.]site, techevolution[.]work, ultimate-detection[.]com, redbytes[.]site, defendersurveys[.]com, processingnowwmc1[.]click, secureantivirus[.]info, processingnowwmc2[.]click, createdtoprotect[.]com, renewappwmca1[.]store, renewappwmca2[.]store, thousoucm[.]com, comsys[.]site, blackblog[.]site, redbyte[.]click, a-mastodon-wmca1[.]click, shortblue[.]site, longblue[.]site, a-mastodon-wmca2[.]click, mydesktopdefender[.]com, web-protocols[.]org, virusvanguard[.]store, esoftwareservices[.]live, bradeu[.]info, totalwebguardian[.]store, security-notification[.]digital, susiticof[.]com, vigorouspocket[.]com, bitblog[.]click, blightsteel[.]com, renewalcentralwmca2[.]store, landerhd[.]com, greencirclewmca2[.]store, protectionyoupc[.]com, uk-antivirus[.]com, karlus[.]info, defender-scanner[.]com, protectlab[.]xyz, hardyharhar[.]store, pitasinspectors[.]store, newformulamc1[.]live, newformulamc2[.]live, karleu[.]info, brownteakmc1[.]click, lowbench[.]info, brownteakmc2[.]click, securephone24[.]host, systemsoftware[.]shop, darkteakmc1[.]click, antiviruscheck[.]info, darkteakmc2[.]click, handovertimemc1[.]club, handovertimemc2[.]club
Symptoms Fake error messages, fake system warnings, pop-up errors, hoax computer scan.
Distribution methods Compromised websites, rogue online pop-up ads, potentially unwanted applications.
Damage Loss of sensitive private information, monetary loss, identity theft, possible malware infections.
Removal

To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.
▼ Download Combo Cleaner
To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Pop-up scams in general (with examples)

This scam shares many similarities with dozens of other misleading pop-ups, such as, for example, You Are Our Winner Today!, ERROR 268d3x8938, Microsoft Alert Your Data Is At High Risk, and Computer Detected To Be Corrupted.

Unlike Your McAfee Subscription Has Expired scam, most of these messages claim that the system is already damaged (e.g., infected, missing files, etc.) and encourages users to download fake anti-virus/system repair tools or contact fake 'tech support'.

Cyber criminals generate revenue by promoting in-app purchases or tricking users into paying for unnecessary tech support. Potentially unwanted programs also share many similarities. These programs often offer a range of useful functions, but these claims are merely attempts to give the impression of legitimacy.

The only purpose of PUAs is to generate revenue for the developers. Rather than giving any real value, they pose a direct threat to your privacy and Internet browsing safety.

How did potentially unwanted programs install on my computer?

Some PUAs have official download websites, however, most infiltrate systems without permission, since developers promote them using intrusive advertising and "bundling" methods. "Bundling" is essentially stealth installation of third party applications together with regular software.

Developers hide "bundled" PUAs within "Custom/Advanced" settings (or other sections) of the download/installation processes. Furthermore, many users are very likely to rush these procedures and skip steps.

In addition, they click various ads. This behavior often leads to inadvertent installation of PUAs - users expose their systems to risk of various infections and compromise their privacy.

How to avoid installation of potentially unwanted applications?

Lack of knowledge and careless behavior are the main reasons for computer infections. The key to safety is caution. Therefore, pay close attention during download/installation processes, and when browsing the Internet in general. Select "Custom/Advanced" settings and carefully analyze each window of the download/installation dialogs.

Opt-out of additionally-included programs and decline offers to download them. You are advised to never use third party download/installation tools, since developers monetize them by promoting ("bundling") rogue apps. Software should be downloaded from official sources, via direct download links.

Note that developers invest many resources into intrusive ad design, thereby making them seem legitimate, however, most lead to pornography, adult dating, survey, gambling, and other untrustworthy sites. If you encounter these ads, uninstall all suspicious applications and browser extensions.

If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate them.

Text presented in "Your McAfee Subscription Has Expired" pop-up:

Windows Security Center: Your McAfee subscription has expired today. Renew now to protect your computer from the latest Ransomware viruses.
Your McAfee subscription has expired on 8 July 2018
Do not leave your PC unprotected against the latest threats. Renew your subscription now to stay protected.
What Should I Do?
Step 1: Click the button below to download the latest version of McAfee 2018
Step 2: Run McAfee Antivirus to scan and remove all potential threats

The appearance of "Your McAfee Subscription Has Expired" pop-up (GIF):

Your McAfee Subscription Has Expired scam gif

Another dubious website (protect-now[.]online) promoting McAfee:

protect-now.online website promoting McAfee anti-virus suite

Text presented within this site:

Antivirus Protection Notice
Purchase now to stay protected for your PC.

If your PC is Unprotected, protect it now.

$70.00 Off Available Now

Protect Now

Another variant of "Your McAfee Subscription Has Expired" pop-up scam promoted via Amazon AWS service:

Your McAfee Subscription Has Expired pop-up scam (2020-04-23)

Text presented within:

Your McAfee Anti-Virus Protection!
Due to recent reports of Malware and Viruses, McAfee has released an Antivirus update.

Computers without the Antivirus, could be exposed to viruses and slower performance.

Clean and improve the performance of your Computer now. No computer restart is required.

Please Enable Now:

Xylodos.com website promoting McAfee via "Your Windows 10 is infected with 5 viruses!" pop-up scam:

Your Windows 10 is infected with 5 viruses! pop-up scam promoting McAfee

Another variant of "Your McAfee Subscription Has Expired" pop-up scam (displayed by antivirus.secure-12.com website):

Your McAfee Subscription Has Expired pop-up scam (2020-06-16)

A variant of "Your McAfee Subscription Has Expired" pop-up scam displayed by onlineprotection.site website:

Your McAfee Subscription Has Expired pop-up scam displayed by onlineprotection.site

A variant of "Your McAfee Subscription Has Expired" pop-up scam displayed by securitytoday.org website:

McAfee scam displayed by securitytoday.org website

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by apps-notification.com website:

Your McAfee Subscription Has Expired scam displayed by apps-notification.com

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by subscriptions.click website:

subscriptions.click delivering Your McAfee Subscription Has Expired scam

Example of a questionable McAfee ad pushed via browser notifications:

McAfee ad pushed via browser notifications

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by your-privacy-guardians.com website:

Your McAfee Subscription Has Expired pop-up scam delivered by your-privacy-guardians.com website

A variant of "Your McAfee Subscription Has Expired" pop-up scam delivered by renew-subscriptions.com website:

Your McAfee Subscription Has Expired pop-up scam delivered by renew-subscriptions.com website

IMPORTANT NOTE! Pop-ups that promote scams like "Your McAfee Subscription Has Expired" are often delivered by websites that ask to enable web browser notifications:

Example 1:

Your McAfee Subscription Has Expired pop-up scam-promoting browser notification delivered by y2mate.com

Example 2:

Browser notification promoting McAfee subscription scam

Therefore, before commencing, perform these steps:

Google Chrome (PC):

  • Click the Menu button (three dots) on the right upper corner of the screen and select "Settings"
  • Scroll down to the "Privacy and security" section, select "Site settings" and then "Notifications"
  • Click three dots on the right hand side of each suspicious URL and select "Block" or "Remove" (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Disabling browser notifications in Google Chrome web browser (PC)

Google Chrome (Android):

  • Click on the Menu button (three dots) on the right upper corner of the screen and tap "Settings"
  • Scroll down, tap on "Site settings" and then "Notifications"
  • In the opened window, locate all suspicious URLs and tap on them one-by-one
  • Once the pop-up shows up, select either "Block" or "Remove" (if you tap "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Disabling browser notifications in Google Chrome web browser (Android)

Mozilla Firefox:

  • Click the Menu button (three bars) on the right upper corner of the screen
  • Select "Settings" and click on "Privacy & Security" in the toolbar on the left hand side of the screen
  • Scroll down to the "Permissions" section and click the "Settings" button next to "Notifications"
  • In the opened window, locate all suspicious URLs and block them using the drop-down menu or either remove them by clicking "Remove Website" at the bottom of the window (if you click "Remove Website" and visit the malicious site once more, it will ask to enable notifications again)

Disabling browser notifications in Mozilla Firefox web browser (Android)

Microsoft Edge:

  • Click the menu button (three dots) on the right upper corner of the Edge window and select "Settings"
  • Click on "Cookies and site permissions" in the toolbar on the left hand side of the screen and select "Notifications"
  • Click three dots on the right hand side of each suspicious URL under "Allow" section and click "Block" or "Remove" (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Disabling browser notifications in Microsoft Edge web browser (PC)

Safari (Mac):

  • Click "Safari" button on the left upper corner of the screen and select "Preferences..."
  • Select the "Websites" tab and then select "Notifications" section on the left pane
  • Check for suspicious URLs and apply the "Deny" option using the drop-down menu or either remove them by clicking "Remove" at the bottom of the window (if you click "Remove" and visit the malicious site once more, it will ask to enable notifications again)

Disabling browser notifications in Safari web browser (Mac)

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

How to identify a pop-up scam?

Pop-up windows with various fake messages are a common type of lures cybercriminals use. They collect sensitive personal data, trick Internet users into calling fake tech support numbers, subscribe to useless online services, invest in shady cryptocurrency schemes, etc.

While in the majority of cases these pop-ups don't infect users' devices with malware, they can cause direct monetary loss or could result in identity theft.

Cybercriminals strive to create their rogue pop-up windows to look trustworthy, however, scams typically have the following characteristics:

  • Spelling mistakes and non-professional images - Closely inspect the information displayed in a pop-up. Spelling mistakes and unprofessional images could be a sign of a scam.
  • Sense of urgency - Countdown timer with a couple of minutes on it, asking you to enter your personal information or subscribe to some online service.
  • Statements that you won something - If you haven't participated in a lottery, online competition, etc., and you see a pop-up window stating that you won.
  • Computer or mobile device scan - A pop-up window that scans your device and informs of detected issues - is undoubtedly a scam; webpages cannot perform such actions.
  • Exclusivity - Pop-up windows stating that only you are given secret access to a financial scheme that can quickly make you rich.

Example of a pop-up scam:

Example of a pop-up scam

How do pop-up scams work?

Cybercriminals and deceptive marketers usually use various advertising networks, search engine poisoning techniques, and shady websites to generate traffic to their pop-ups. Users land on their online lures after clicking on fake download buttons, using a torrent website, or simply clicking on an Internet search engine result.

Based on users' location and device information, they are presented with a scam pop-up. Lures presented in such pop-ups range from get-rich-quick schemes to fake virus scans.

How to remove fake pop-ups?

In most cases, pop-up scams do not infect users' devices with malware. If you encountered a scam pop-up, simply closing it should be enough. In some cases scam, pop-ups may be hard to close; in such cases - close your Internet browser and restart it.

In extremely rare cases, you might need to reset your Internet browser. For this, use our instructions explaining how to reset Internet browser settings.

How to prevent fake pop-ups?

To prevent seeing pop-up scams, you should visit only reputable websites. Torrent, Crack, free online movie streaming, YouTube video download, and other websites of similar reputation commonly redirect Internet users to pop-up scams.

To minimize the risk of encountering pop-up scams, you should keep your Internet browsers up-to-date and use reputable anti-malware application. For this purpose, we recommend Combo Cleaner Antivirus for Windows.

What to do if you fell for a pop-up scam?

This depends on the type of scam that you fell for. Most commonly, pop-up scams try to trick users into sending money, giving away personal information, or giving access to one's device.

  • If you sent money to scammers: You should contact your financial institution and explain that you were scammed. If informed promptly, there's a chance to get your money back.
  • If you gave away your personal information: You should change your passwords and enable two-factor authentication in all online services that you use. Visit Federal Trade Commission to report identity theft and get personalized recovery steps.
  • If you let scammers connect to your device: You should scan your computer with reputable anti-malware (we recommend Combo Cleaner Antivirus for Windows) - cyber criminals could have planted trojans, keyloggers, and other malware, don't use your computer until removing possible threats.
  • Help other Internet users: report Internet scams to Federal Trade Commission.

Frequently Asked Questions (FAQ)

What is a pop-up scam?

A pop-up scam is a fraudulent message designed to trick unsuspecting users into providing personal information, downloading files, installing potentially software, transferring money, purchasing unnecessary services, products.

Why do I encounter fake pop-ups?

Most of the pop-up scams are displayed by untrustworthy websites. Users do not open these pages intentionally. They end up on these pages through sites that use questionable advertising networks. It is also common for these pages to be promoted via potentially unwanted applications.

Will Combo Cleaner protect me from pop-up scams?

Combo Cleaner is designed to scan websites and detect malicious ones. Including the ones designed to deliver pop-up scams. This app will notify about untrustworthy pages and restrict access to them.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk logo

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Removal Instructions in other languages
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Your McAfee subscription has expired pop-up QR code
Scan this QR code to have an easy access removal guide of Your McAfee subscription has expired pop-up on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

▼ REMOVE IT NOW
Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.