washingtonpost.com
Help File: Dealing With 'Scareware' Alerts on the Web

By Rob Pegoraro
Sunday, September 20, 2009

QI'm getting a "Personal Antivirus" pop-up that says it wants to scan my computer for viruses. I click "cancel" and it doesn't go away unless I force-quit my browser. I'm using a Mac, but the remedies for this involve Windows programs.

AThis "scareware" attack is becoming a widespread problem -- last week, it was embedded in ads placed on the New York Times' Web site by a fraudulent buyer.

Personal Antivirus and scams like it try to mimic the warnings of legitimate security programs. But real antivirus utilities don't scatter exclamation points in their prompts to try to panic users. Nor do they infect your PC with malware after you click a "cleanup" button. (On a Mac, scareware can only keep pestering you about phony virus threats.)

As my colleague Brian Krebs has outlined in his Security Fix blog (http://voices.washingtonpost.com/securityfix), if you see one of these windows pop up, don't bother clicking its "cancel," "OK" or "continue" buttons. Assume that everything in that window is a lie.

If you clicked one of those buttons anyway and your PC got hit with a virus, Krebs recommends Malwarebytes' Anti-Malware (http://malwarebytes.org), a free download for Windows.

To dispel the scareware, use the regular window-close controls-- the red "x" at the top right of the window in Windows XP or Vista, the red button at the top left in Mac OS X. If that doesn't work, you may need to force your browser to shut down. In Windows, hit Ctrl-Shift-Esc to pull up the Task Manager, select your browser and click the "End Task" button. In OS X, hit the Option, Command (Apple logo) and Esc keys to bring up the "Force Quit" dialog.

Then stay away from whatever site launched this pop-up in the first place. Make sure you've got the latest version of your Web browser -- in most cases, Microsoft's Internet Explorer 8, Mozilla Firefox 3.5 or Apple's Safari 4.

Rob Pegoraro attempts to untangle computing conundrums and errant electronics each week. Send questions to The Washington Post, 1150 15th St. NW, Washington, D.C. 20071 or robp@washpost.com. Visit http://voices.washingtonpost.com/fasterforward for his Faster Forward blog.

View all comments that have been posted about this article.

© 2009 The Washington Post Company