Download problem with Adobe Flash update

HI Ron,

Flash Player is a built-in component of Chrome, so there's nothing to download and install.  Chrome automatically manages the updates for Flash Player.  The same thing is true for IE and Edge on Windows 10.

This means that it's pretty unlikely that the pop-up you encountered was legitimate.  We *do* have update notification dialogs, but they pop up outside the browser, and would only be relevant for browsers that use a Flash Player that we distribute, namely Firefox and Safari on Mac.  That said, you would have actually had to modify the update settings, either at install time or through the Flash Player settings in the Control Panel to "Notify me to Install Updates".

You can double-check this under Control Panel > Flash Player > Updates.

We highly recommend that people set this to Allow Adobe to Automatically Install Updates (recommended).  Just set it and forget it, and occasionally exit your browser so that any traces of old Flash Player versions that might be in memory are fully exited and loaded from the latest copy on your machine.

We used to force you to restart the browser, but that's really painful in a world where you can regularly have 20 tabs open... but it's still something you should do periodically.

One of the reasons that we recommend the automatic update approach, is that you pretty much know that any update dialog from then on is a scam.  If you think that the update dialog is legitimate, close the page, type http://get.adobe.com/flashplayer/ into the browser address bar (or make a bookmark), and download the update directly from us.  This is really true for any piece of software.  Get it through the relevant App Store, or download it directly from the publisher.  Don't follow links to downloads from email or popups.  If it seems real, Google the thing you need and find the actual vendor's download.  If you can't figure it out, it's probably a scam.

Chrome is aggressive about security, and because the entire Mac population across all MacOS versions and browsers represents about 6-7% of the overall web-browsing population, the tendency is for attackers with monetary interests to target the general population on Windows (20% of people are on WinXP still, which is like shooting fish in a barrel from a security perspective...).  If you're a state-sponsored actor with non-monetary interests, that's one thing, but if you're just trying to scam or extort some money from a few unlucky suckers, Windows is just better ROI.

So, if you're moderately lucky, you encountered an attack that targeted Windows users, and it failed.  It's very hard to prove a negative, and risk tolerance is a personal choice, so your options range from rebooting and running a reputable virus and/or malware scanner (malwarebytes.org is free and well-respected) to burning everything down and starting over from pristine sources.

As you've noted, virus and malware scanners are trailing-edge indicators, and identifying advanced threats requires rare and expensive expertise, and quite a bit of time.  If you're going to lose sleep over the open question, I'd go with the "burn it down" option just for peace of mind, and then do a good password rotation scrub once you've gotten things back to a baseline that you trust.

Hope that helps!