How To Identify And Avoid Anti-Virus Scams

July 31, 2008

I would recommend that absolutely everyone who ever connects a computer to the internet should have some level of security running.

The basics of a firewall and anti-virus program should be considered a minimum requirement of surfing the web these days in order to thwart those would part you from your money.

Unfortunately, the internet is awash with criminals who spend their time looking to steal money or even people’s entire lives.

identifying-antivirus-scams

THE FAKE ANTI-VIRUS SCAM

Scammer and identity thieves are, generally, highly organised individuals or units.

They are exceptionally good at identifying new opportunities and one area that they have been dabbling in recently is the anti-virus and anti-spyware market.

There are many such criminals who are now selling, or even giving away, software that would appear to offer essential protection to those who surf the net.

In reality, however, many of the programs do not function at all, or are designed to infect and spread the malicious codes they were supposed to protect against.

FAKE ANTI-VIRUS POP-UPS

Have you ever visited a website and then been greeted with one of those annoying pop-up boxes?

I’m pretty sure you have as they are still far too common.

One of the ones I see on a regular basis is the one that has the yellow or red triangle, along with a warning that my computer is infected with a virus, or is bogged down with spyware.

If you are not particularly web savvy then you could be forgiven for thinking that the pop-up is telling you the truth.

After all, they often claim to have just scanned your computer.

Your immediate reaction may be to buy the solution that the pop-up offers, or to close the window by clicking on the ‘X’ in the top right corner if you are wise to such scams.

Either way.. they’ve got you!

OOOPS!

If you buy the ‘solution’ that is being offered then you may well be opening yourself up to a whole lot of trouble, as described a little later.

If you close the pop-up then expect to see more pop-up ads multiplying like rabbits, regardless of what you are doing on your computer.

Other unexpected consequences could include a computer that now constantly locks up and/or programs that fail to work.

Basically, closing the pop-up will have left you with a computer system that is much slower at best and completely compromised at worst.

WHO IS BEHIND THESE FAKE ANTI-VIRUS SCAMS?

Fake virus scams are typically run by 3 distinct types of cyber-criminals – the scammer, the hacker and the identity thief.

The scammer will be looking to trick unsuspecting web surfers into buying their anti-virus products, whether they work or not.

Often these products are fake and will cause a whole lot more problems than they cure.

The hacker may just be looking to gain entry into your system for various purposes which may include stealing data, setting your computer up as a ‘zombie’, or purely for some malicious fun.

The identity thief, as you may imagine, will be looking for personal data, either to steal your identity themselves or to sell on to others.

HOW DO THE FAKE ANTI-VIRUS SCAMS WORK?

Fake virus alerts are typically triggered by a trojan which has found it’s way onto your system.

Trojans are often installed without your knowledge when you open an email attachment, download torrents or other files from peer-2-peer networks, visit malicious websites or click on a pop-up advert.

It is also possible for hackers to access your computer remotely, or through internet messaging services.

Often, these fake anti-virus pop-ups will lead you to believe that your system has been infected with spyware or a virus, even though it hasn’t.

In some instances, malicious software will actually install viruses and spyware onto your system in the first place, most commonly after you have requested a free online scan.

HOW DO YOU IDENTIFY FAKE ANTI-VIRUS PROGRAMS?

  • Fake anti-virus software will often find more suspicious activity on your computer than those programs that are made by legitimate companies.
  • The number of pop-ups you see will increase drastically, even when you are not connected to the internet.
  • After installing the fake anti-virus program you may notice that your computer slows down drastically due to the amount of junk that has been installed onto your system.
  • You may also find that your default homepage has been changed and now points to the scammer’s ‘official-looking’ site.
  • Words on websites are now underlined and now hyperlink to undesirable locations, such as adult sites.

PREVENTATIVE MEASURES

1. I would always recommend using Firefox as your browser rather than Internet Explorer because as it would appear to be considerably more secure.

2. Keep your computer system secure by always having a firewall in place, working in conjunction with a good anti-virus program from a reputable vendor.

3. Never click on pop-up adverts. Ever.

4. Only open email attachments if you can verify the sender and trust them. Always scan email attachments with your anti-virus program if it doesn’t do so automatically as the messages are downloaded.

5. If you are running Windows then leave your security setting on medium as an absolute minimum.

6. If you land on a website and see a warning from Google about it’s content then pay attention to it and leave.

7. Only buy anti-virus and anti-spyware products from reputable companies. Remember that the scam artists will often use names that make their sites or products appear to be from such vendors.

As internet users become more aware of some of the dangers and risks posed by the net, they are learning the importance of internet security.

However, there are cyber-criminals who will take advantage of these willing purchasers by offering poor or fake products.

If you follow the tips above you are much less likely to fall prey to their cons.

Article by

Lee's non-technical background allows him to write about internet security in a clear way that is understandable to both IT professionals and people just like you who need simple answers to your security questions.

Lee has written 2873 awesome articles for us at Security FAQs

{ 33 comments… read them below or add one }

jIM April 24, 2012 at 11:56 pm

I have found another anit vius scammer.AVG. I use the free edition. what a mistake that is.I see now thes so called anit virus groups Say FREE and when you log into it you get the best but after so long I believe AVG on purpose miss up one computer claimming your computer is infected, Why? to get you to buy the program
It has gotten to the point you CAN NOT TRUST ANY ONE ARE ANY THING. EVERY ONE OUT OF THE MIGHT DOLLAR.iT TOOK ME MOST OF THE DAY TO GET THAT OFF MY COMPUTER.

Reply

sharon June 14, 2011 at 5:56 pm

Ad ware keeps popping up saying a malisious process is running and I keep x it out and they keep popping up, what can I do to get this pop up to stop,? anything I can do? sharon

Reply

sharon June 14, 2011 at 5:44 pm

I got a ad ware pop up say I have a malisious something and they scanned my computer and it showed virus but I didn”t believe them and just got out of that and when it pops up I just x it out , am I am okay? sharon

Reply

Lee June 15, 2011 at 10:32 am

Is it this Ad-Adaware – http://www.lavasoft.com/products/ad_aware_free.php – thats giving you the message? If so, that is definitely a legitimate program and you should be fine, other than the fact that you may well have a ‘malicious something’ that you will need to deal with.

Reply

sharon June 15, 2011 at 5:14 pm

I have my own security thru microsoft and don{t need them, why do they keep asking me, wish I could tell them to stop popping up

Reply

scared August 12, 2010 at 12:34 am

Urrmm bunny I have exactly the same problem at this exact same moment the way that I am dealing with it is by switching my laptop onto safe mode and then using mcafee to scan it it’s taking a LONG time but will hopefully work..so I advice u to do the same :)

Reply

Will July 20, 2010 at 10:18 am

Thanks LEE. I may have fallen for the whole virus scan. One came up saying files were infected and I just xed out of it. Haven’t gotten pop ups yet but fear they may start. This information helped though, both by you and the other comments.

Reply

Lee July 20, 2010 at 7:33 pm

Thanks for the encouragement Will – its always good to know that what I do actually helps a few people :)

If you get the pop ups or any other issues you need help with then please do ask.

Reply

thunderwolfxp July 15, 2010 at 8:40 am

thanks
my computer is always getting attacked by all these scams i never buy into them tho and i had avast personaly it isn’t the best out there
it never told me these were in my computer intill the viruse showed itself it was a b***h getting rid of them
secerity tool that was an easy one to get rid of
and pc tools i couldn’t get rid of it sooooo i tryed system restor
perfect everything is perfect again
my virus protection didn’t help one bit
i had to do it all

Reply

Bunny May 22, 2010 at 6:31 am

Hi, reading this webpage has confirmed my fears – it’s not legit. I was downloading a document from a trusted website absolutely fine, but then the downloading suddenly quit out on me and this pop-up thing came up, saying I had 21 infected files, and I needed to remove them. At first, I was absolutely shocked, because we have AVG 8.5, and it’s been working fine for years. But then, I decided to look up the said files in the Run Program – they didn’t even exist. I was pretty sure that it was a scan – if I was infected, surely AVG would tell me so? Now that I know it’s a scam, I want to scan my Laptop with AVG, but it won’t let me open it. And I want to get rid of it, and ALT + CTRL + DEL doesn’t want load either. Help!

Reply

Dave May 1, 2010 at 10:44 am

Since browsers (Firefox &IE) have pop up blockers i have been telling people to use it or install a good blocker to help prevent accidently clicking on one of these pop ups, seems the only effective way to make sure you dont click on it.

With Firefox i also think Ad-Blocker Plus is a help.

Reply

Lee May 1, 2010 at 12:00 pm

I would like to think that most people are using a modern enough browser that blocks pop ups but that obviously isn’t the case.

Ad-blocker would work for them, or the old Ctrl+Al+Delete method of getting into Task Manager and then ending the process.

Reply

m March 28, 2010 at 3:01 pm

Something like this has happened to me to, but i think that a trojan installed the software onto my laptop without me being aware. Basically, pop ups keep coming up warning me that my system is being attacked by viruses (even when offline) and asking me to do a scan. I scan and it said I have to buy the full version to get rid of the viruses (of course im not paying) I cant open anything without it saying that a virus is infecting it and i cant open it.(task manager and even the volume meter cant be accessed). One strange thing is that I know its activated when it appears at the bottom right hand box. It usually doesn’t activate strait away and before it activates I can open the volume mixer etc. Once it does activate nothing can open because apparently its infected. Once i managed to open up my AVG before the virus one activated and did a scan. The scan found no viruses so my conclusion is that the the protection system (that installed itself without my knowledge) is preventing me from opening most of my programs and is trying to get me to buy the full version.

Reply

Stuart February 8, 2010 at 1:44 pm

I’m sure I clicked something that put one of these bugs on my computer. At first it was just an annoying little bubble that popped up saying my computer was at risk, but the warnings got more frequent and now the ONLY program I can open is firefox, which runs smoothly still. Basically every link that my ‘antivirus software’ goes to is the purchase page for the product. The warnings keep popping up in different ways and some of the logos look a bit…unprofessional (scratchy edges, fonts don’t match, etc), so I’m 99% sure I have what you described. Now what I need to know is what to do to get rid of it. I’m not very computer savvy..

Reply

Lee February 8, 2010 at 1:48 pm

Hi Stuart.

Prior to getting ‘infected’ did you have an otherwise legit antivirus program installed already?

Reply

Stuart February 9, 2010 at 3:59 am

I don’t think so. Just generic firewalls and whatnot.

Reply

Lee February 9, 2010 at 9:59 am

In that case the first thing I would recommend is downloading a free and legit antivirus program, such as AVG Free (http://free.avg.com/gb-en/homepage), and see if that helps with detecting and resolving your issue.

If not then please feel free to get back to me.

Reply

Helen January 19, 2010 at 5:04 pm

HI
I just got snookered! I even bought the program they offered. Now how do I get this shit off my computer? Should I have my daughter cancel the debit/credit card I used? (Oh she is NOT going to be happy). I really know need to know how to get this off my computer!

Before this happened my computer was running slow, it took several times to get to a particular website, my desktop background would only show a solid color no matter what I changed it to so I figured “they” were right plus my computer was very slow and I have Roadrunner Turbo so it should not be slow at all.

I have McAfee virus protection and it’s up to date but it didn’t show anything in the scans.

Anyway the site is called “anti virus live v2.7 (791)…does this help anyone so they can tell me what to do?

Reply

Lee January 20, 2010 at 1:13 am

Hi Helen

I don’t know much about the particular ‘program’ you purchased but from how you’ve described it I would have to say it sounds most suspicious.

If it was me then I would be cancelling cards for sure as you just can’t be too careful if you think you may have bought a rogue product.

I think the fact that this program found untold errors, whilst the well-known McAfee found none, is quite telling!

Can you remove ‘anti virus live v2.7′ via Add/remove programs under your control panel?

If not, you could try booting in safe mode and then running McAfee to see if that works.

Otherwise, get back to me and I’ll see if I can get a more detailed removal guide for you.

Reply

Sarah January 21, 2010 at 10:14 pm

Would using System Restore to reset your computer to a previously date where the computer was functioning well get rid of a virus of any type? or are they perminatly nested i the system somehow?

Reply

FrancieJ July 19, 2010 at 6:22 am

Lee, Thank you so much for the information you gave Helen. I had her same problem and did what you suggested and it worked. This is my second time with an uninvited antivirus group. It is hard to know who to trust and where to go. Appreciate the help…Thanks Again….

Reply

Lee July 19, 2010 at 8:51 pm

I’m glad it worked for you FrancieJ :)

Reply

Sarah January 12, 2010 at 10:05 am

I just recently was visiting a website when I was redirected to another site, then in the Internet Explorer window I saw something like my computer files with a little folder which had bars lighting up on it as if it was installing or downloading, then my computer told me it was infected and went straight to another site where It said to download something to remove it. I closed it… I was just wonderring what you thought? do I have something installed that I should remove or was it a trick to get me to install a virus at the ‘so called’ anti virus webpage.
It seemed fairly authentic, though like I said… it showed the computer files within a Internet Explorer window. What do you think it is?

Reply

Lee January 12, 2010 at 10:16 am

Hi Sarah

Without knowing or seeing the site in question it is impossible to give a definitive answer but it certainly sounds suspicious.

A genuine security vendor would not download anything onto your computer without your express permission.

Neither would they then randomly search your computer for infection and report back on it.

The fact that the web page then offered you the opportunity to purchase the ‘solution’ makes it sound even more suspicious.

If I were you I would run a full scan on your computer with whatever antivirus you already have installed, or use an online antivirus scanner to check for anything untoward.

Reply

Sarah January 12, 2010 at 1:29 pm

Thank you for the quick response Lee
I did run 2 scans, Windows and Norton and they did not find anything. So I’m thinking maybe it was a trick to get me to press someting that downloads an actual virus.
This all happened when I reached the log in page of http://www.mocospace.com, I noticed alot lately that randomly when going to the log in page a new window will open up then go behind the current window, it seems to differ in different types of advertising so I usually close them the instant they appear and that last one was the first one that seemed to do something weird.
Anyway I think all is fine & I’ve avoided anything for now though it’s good to know this site is here.
Thank again Lee

Reply

Amanda December 28, 2009 at 6:44 am

I’ve been getting these popups on both of my computers for days, but I have no symptoms that you mentioned. I did scans and found no viruses, but the popups come often, whether checking email, going to yahoo, or just reading a webpage. It closes my webpage and says that my computer may have a virus. I clicked on the x (oops) and then a fake Microsoft security page comes up, each time with a different web address, so I close that as well. I can’t find the problem, but I would like to fix it. Any suggestions? Thanks!

Reply

joan December 14, 2009 at 10:03 am

This has happened to my laptop and it is now frozen, how do I fix it

Reply

Lee December 14, 2009 at 2:46 pm

What exactly is the problem?

Reply

mhelton September 1, 2009 at 3:09 am

Hello folks
Just bought and installed defender pro ani virus and within 2 days my machine was infected. After several attempts to contact the (suppoposablly customer support) I had to do a system retsore applieng a reputable anit virus to eliminate my problems.
Anything you recieve through email or pop uo from pc doctor BE WARE

Reply

Lee April 19, 2009 at 11:23 pm

Well thats good reason for me not to visit that link! What was the issue with it?

Reply

William April 19, 2009 at 10:24 pm

this site looked risky and had to be closed with alt f4

http:// justscan6.info/22/?uid=13400

Reply

Peter August 1, 2008 at 7:35 am

I’ve seen these popups dozens of times and thought they were trying to get me to buy antivirus to fix a problem I had. I never realised that the viruses they claimed I had didn’t exist.

Reply

Lee August 1, 2008 at 8:26 am

Worse still Peter, some of these anti-virus programs are responsible for actually infecting your system with viruses in the first place!

Reply

Leave a Comment

{ 17 trackbacks }

Previous post:

Next post: