Opening a popup without URL bar and emulating the URL bar functionality;
This would actually be incredibly difficult to pull off. Even ignoring the fact that most modern browsers make this impossible to do, there would have to be some kind of iframe in the page to navigate to other sites (which causes a whole host of problems for the malicious site to actually get any data from there), and you could easily look at the source to tell if this is the case. All of your buttons for browser settings would not work. Your bookmarks/extensions would not show up, and unless your browser was seriously compromised (like... seriously) it would not be able to fake this stuff. Changing your user agent string would most likely confuse an site that tried to do this (showing chrome address bar in Firefox for example).
Going into fullscreen mode and emulating URL bar (think mobile device browsers);
Most of the same things apply. A website cannot hide the top bar if you scroll all the way up, and none of the buttons would function correctly.
Is there a common (to different browsers, operating systems) guideline for users to detect such an attack?
I would say not really. A site that says it is
bank.com but is really
h4x0r.net and tries to use a certificate would give a big error in your browser. Other tricks using stylesheets/html would just not be convincing to a reasobaly competent user.
Some SO questions that are related: