I’ve been meaning to write up a bit about these fake virus warnings but haven’t had the time to go out and find some good screenshots and info. Well I was “lucky” enough to get one such attack tonight while tooling around on Facebook. Below are some screen shots showing the progression of this style of attack as I attempt to close out the windows.

This image shows the initial phaze of the attack: deception\immitation. It is attempting to look like a valid Windows Security Component. There are a few key points that give away the ruse:
1) This is still an Internet Explorer window (could be FireFox or Safari – same thing – it’s still a browser window).
2) The web address in the Internet browser is not easily identifiable as a credible security source and is DEFINITELY not a Microsoft or windows system address.
3) The “System” items which the false page displays do not match up with the actual system… and in my case I’m running a version of windows that looks completely difference than this.
4) After attempting to close the window by clicking the [X] button, this pop-up labeled “Message From Webpage”. If you weren’t leery yet you should be now. Lets click the [X] on this message box and see what happens.
Another pop-up displays which is again designed to look like a legitimate windows component. If I were running Windows XP at this point I might have been a bit nervous at first but a second glance reveals the false nature of the window. I’ve never personally heard of Windows Web Security and after reading the entire window the grammar is the biggest give-away. I’ll click the [X] here too.
After making it past the first few somewhat well crafted attempts at subterfuge, this is a pretty paltry attempt to keep my interest. The grammar again is the big give-away on this window.
Bottom line? If you see antivirus\anti-spyware messages be wary and vigilant. Don’t take any pop-ups or the messages they claim at face value. Read them, and understand them before continuing.
Modern attacks are aware of antivirus software being present and are designed to That’s a basic walk through of a typical fake Windows Security attack. Identifying this type of attack and avoiding it is the most important step in avoiding its damaging effects. What I have not yet mentioned is almost as important. If you get through the windows before realizing what’s up, do NOT restart your computer until you’re fairly sure a cleanup has occurred. That can be difficult due to the nature of these programs, but your best chance of recovery will be to undo the damage before a restart. Give your local PC service provider a call as on site service will be your best bet. And of course you can always call me and I’ll do my best to help you work through it.