Is this a scam?

Scam.

Websites in general have become saturated with advertising, and scam roll-over links that pop dialogs trying to get you to take action to install anti-virus, anti-malware, and so-called Mac cleaner applications — all of which put your Mac at risk. Don't click any of them. Continue to use common sense.

Certainly, one of these is the dialog that tells you that you have a virus/malware/something nasty, and call a certain phone number, or click a button. On OS X, ignore all of these fake dialogs, and force quit (option-command-esc) Safari. Press the shift-key while relaunching Safari, and on the Mavericks or earlier Safari menu, Choose Reset Safari, check everything, and click Reset. On Yosemite, select Clear History and Website Data… choose All History, and click Clear History button.

Remember, Apple will not pop any dialogs in Safari unless your Adobe Flash browser plug-in is out of date. As there is a scam that is also popping an official looking Adobe Flash dialog, simply ignore both. Visit System Preferences : Flash Player, click on its Update tab, and click the Check Now button. It will inform you if there is an actual Flash update available or not.

You can substitute “good judgment” for ”common sense.” I tend to use the term “malware” as a general catch-all word for all of this website detritus that attempts to deceive visitors into taking actions that can harm their computer, or themselves through scare and misinformation tactics.

The clever attackers use Javascript to display something different for the hover and when you click, or use chains of links and/or link shorteners and who knows where those go, or use — as recently arose with a bogus electronicfrontierfoundation domain used for spearphishing — legitimate-looking domains that aren't.

Use a plugin blocker. Or remove Adobe Flash Player. YouTube doesn't need it anymore, and it's a common source of vulnerabilities. Remove Oracle Java, or minimally disable the web start on all but the site(s) you really need to use Java with.

In general, "Spyware" and "Adware" and such are present on your system. That usually happens if you've installed the stuff — possibly as part of cracked software, some toolbar, or a package that's been "wrapped" as part of a download site — or if somebody else has had physical access, or if some network-accessible component of OS X has had a vulnerability.

Also ensure Gatekeeper is set to allow signed apps and App Store apps.

Don't install anything you didn't go looking for, and only install from the original source and not from a download site or aggregator.

Cracked software and torrented software often intendsto crack your local security, too.

Etc...

The difficulty encountered with OS X, Windows and other platforms — and with web browsers and the rest — is that end-user are often not familiar with computer security, but are increasingly expected to be, and are increasingly expected to manage their own systems and access and backups. IT has gotten vastly simpler and in ways I never expected, but it's still not simple. Both the attacks and the defensive recommendations are evolving, too. Tools like Xprotect and Gatekeeper might help, but it's just as easy to load some anti-malware tool that can end up making the system unstable or — as has happened — opens up additional paths for remote attacks.

Gatekeeper makes it yet harder to get around your preferences without notice. Accordingly, I prefer to leave it enabled.