Urgent Chrome Update virus/scam
I was browsing DeviantArt recently when one of the tabs I had opened was redirected to the fake "Urgent Chrome Update" popup as seen here: https://productforums.google.com/forum/#!msg/chrome/HcXgFFaO9WU/Dd3PZ8VHCwAJ/
Now, supposedly the redirect will automatically download a file, but I closed the browser before I saw whether or not it had done so. To complicate matters, I was browsing in incognito, so chrome would have deleted any download history before I could check. I did check the downloads folder and didn't see anything more recent than June. However, I don't know if anything downloaded in incognito would go here or somewhere else.
So, a few of questions:
1. If something is downloaded during an incognito browsing session, will it still show up in the same downloads folder as files downloaded during normal browsing?
2. I've used Windows Explorer to check my computer for files with "chrome" in the name - which is, of course a lot. However, it;s my understanding that the file needs to actually be run to do anything malicious. Is that understanding correct?
3. One of the posts linked above claims that the virus creates a file in "%appdata%\Microsoft\Windows\Recent\CustomDestinations\" and two registry entries. Is this accurate? In any event, I was unable to find either of the two registry entries mentioned. While I did find the "CustomDestinations" folder, I was able to delete all the files there easily enough (though new ones have since popped up - is this normal?)
4. On the subject of the "CustomDestinations" folder mentioned above, I'm unable to see it in the "recent" folder, even with hidden files and folders made visible - to access it, I have to type the path directly into Windows Explorer's address bar.
5. And finally, also on the subject of "CustomDestinations", I've noticed that all of the files listed there have "CUSTOMDESTINATIONS" listd as their file type. Is that normal?
Can anybody help?