Security Topics #001: Popups

February 2009

Tell Yourself: “Do NOT click on ANYTHING that pops up when browsing the Internet!”

In the last few months there has been a rash of new malware on the Internet. From Wikipedia: “Malware, a portmanteau from the words malicious and software, is software designed to infiltrate or damage a computer system without the owner's informed consent.” Computer viruses are a type of malware and anti-virus software is typically designed to deal only with viruses. Web pop-ups, however, are typically not flagged by anti-virus software.

One of the most prolific web pop-up schemes is fake anti-virus software. While there are several in circulation, the most common one is “Antivirus 2009”. (There were previous incarnations of Antivirus 2008, Antivirus 2007, etc.) You’ll be surfing along and suddenly a pop-up comes up that looks like this:
It looks real, but it is not!! The “Microsoft” in the title bar is a lie. The list of items found are false. If you click on the Remove All button, it will take you to a web site, pretend to scan your computer, and install the malware on your computer.

From then on, it will continually put pop-up messages on your computer saying that it has found bad stuff on your computer. Other than being extremely annoying, nothing dangerous has happened to your computer so far.

The people who created this malware are in it for profit, however. The program will beg you to register it so that you can then download the full version and clean up the alleged problems with your computer. The sad part is that it all looks real enough that lots of people send in the money to register it!

The simple answer to this threat is don’t ever believe anything that pops up when you’re browsing the Internet! There are dozens of scams going around at any given time. Another popular one happening recently is a pop-up telling you that you have to upgrade your version of Flash in order to see some particular content on a web site. However, the “upgrade” that it tricks you into downloading is a virus. Furthermore, not all anti-virus software will stop these types of attacks and you have little recourse since your clicking on the pop-up ad is considered “consent”. Go back to the quote from Wikipedia and note the phrase “informed consent”. Your clicking on the ad is the consent. Your responsibility is to be informed!

-Farren