View our Help Guides

Don't Click that Virus Notice!

“Scareware” tells a lie, then infects

We received this frantic support call from a client the other day: “My anti-virus is going crazy and says my PC is not protected. Please help!”

Who wouldn’t trust a pop-up window that said your computer was infected with a virus, especially when it almost looks like a typical Windows message box with an official-sounding name like “AntiVirus 2009”?

Take a moment to think twice before clicking that “Remove All” button, because what looks like an antivirus notice is not necessarily a legitimate antivirus notice. In fact, it could very well be the exact opposite.

Rogue software, or “scareware”, is not a new phenomenon, but it’s one we’re seeing more and more of among our clients. Using rudimentary "social engineering" techniques, scareware uses legitimate websites to expose your users to its advertisement, and then "scares" the user into clicking a link that initiates an "authorized action". That action can bypass your antivirus and malware protection and wreak havoc on the computer. And yes, contrary to popular perception, Apple Macs are vulnerable, too.

The dialogue boxes and web sites linked to by these rogues are treated as legitimate by many Internet search engines, making them very difficult to identify as malware. One offending company’s web site was even a sponsored link on Google and Yahoo!

These look like real Windows dialogue boxes, and usually warn that your computer is infected, with a prompt to download an anti-virus tool. The hook is to get you to buy something you do not need.

Clicking anywhere in these nasty pop-ups, including “Ignore” or "Close", could leave you with a screen full of pop-ups and, at worse, a program that keeps those annoying pop-ups coming until you visit the web site, and pay them money to turn off what they turned on. Unfortunately, these programs can be very difficult to remove.

So what should you do if your computer pops up with a virus warning? We suggest that users click the "X" in the upper right of the window to close the box. Don’t click anything else, including buttons labeled "Ignore" or "Close". Just click the "X" in the upper right corner. Or, give us a quick phone call. The battle against social-engineering is best waged by reducing naïveté among users, in that they need to take a less-reactive position and proactively be suspicious of anything that suddenly demands their attention with big, red letters and exclamation points.

If you’ve clicked on the notice already, definitely call us. We can help you delete the offending programs and, hopefully, save you added frustration.

Is there a way to actually combat this? Yes, there is. ClearLogic can provide you with an Internet filtering appliance which prohibits rogue sites from entering the network. Our clients who have employed Internet filtering have seen a dramatic reduction in problems resulting from website, plus the inherent potential of increased productivity since browsing can be constrained to business-related activity only. If you are interested in the best Internet filtering available, call
Dave Mohler at 937-528-7421 or Tim Nixon at 937-528-7422.