SECURITY - ANTI-MALWARE - 23.02.2016

Virus alerts: genuine or fake?

Scareware

The alerts which pop up during your browsing look genuine, but generally they aren’t. They are examples of “scareware”: attempts to frighten you into installing a fake antivirus program which will infect your computer. How can you recognise these fakes?

Disguises

Fake virus alerts typically come in one of three disguises:

1. Ads disguised as alerts. This is the most frequent type: somewhere prominently on a webpage, generally at the top, an alert in flashy colours and strong terms pops up trying to make you believe that it has scanned your computer. To prove this it produces a list of malware that has allegedly been detected. To make everything more realistic, it may also show your current IP address and other browser details. In fact, they are ordinary ads but they make clever use of an animated GIF image to imitate a dialogue window. Their only aim is to make you click on an “Install Anti-Virus Software Now!” button or similar, after which real malware will be downloaded and installed. The best thing you can do is to completely ignore these fake alerts. Alternatively, you can install a reliable ad blocker in order to get rid of them.

2. Browser pop-ups disguised as alerts. A second type is a pop-up window appearing at the top of the webpage. This can be a genuine browser dialogue window (you can recognise it by the OK and Cancel buttons) or it can be an “overlay” (part of a webpage without any borders which is laid over the webpage itself). Such an overlay may look like a message from a real antivirus program, but the tone (see below) is different. Close the pop-up using the Close button (X). Tip. If there’s no such button, a browser extension such as BehindTheOverlay for Google Chrome may come in handy: this extension will rid you of all annoying overlays. Alternatively, you can close the browser window itself or even your entire browser.

3. Alerts in the Windows system tray. The third type of scareware makes notifications appear in your Windows system tray at the right of the Windows taskbar - in Windows 10 these will appear in the Action Centre. It goes without saying that you should certainly not click on such a scary notification, but simply close it.

Important note. The fact that your computer can show such notifications at all means that something fishy has already nestled itself in your computer system. You should therefore launch your antivirus program instantly and perform a full scan of your computer.

Content and tone

Pay attention to the tone of the message. Indeed, the aim of these alerts is to frighten you and urge you into taking action. If they try to foist a product on you which you’ve never heard about, describe vague functions and prices, and state that you definitely need to install it for your security, you can be sure that it’s a fake. If you’re in doubt Google the name of the product concerned. If you can’t find it or you discover that other people are also wondering whether it’s real, you can be sure that there’s something fishy about it.