Bogus Virus Warning - How Did I get to the Webpage?

[Roger]

This morning I think I had one copy of IE8 running and was on my

my.yahoo.com home page when I got a popup "Message from webpage" that said:



"Warning! Your computer contains various signs of viruses and malware

programs presence. Your system requires immediate anti viruses check!

System Security will perform a quick and free scanning of your PC for

viruses and malicious programs." "OK" "Cancel"



I hit cancel, but was redirected to 94.102.55.9 anyway and a very

convincing virus checker appeared to be running.



I am running Windows 7 and MS System Security Essentials says no

problems found.



My question is - is there anyway to be certain where the popup message

or the link to 94.102.55.9 originated? Does the IE history contain

something like a referrer link that I can access?



Once the popup message appeared, I was unable to do a view source or run

any of the IE debuggers on the parent page. Is there any way to

investigate the source of the popup when it is on my screen?



Roger

 

[Leonard Grey]

Even if you could find out who served the pop-up, it probably won't be

there in a few hours.



If you regularly see that phony warning on the same web page (or

domain), /stop visiting that web page or domain/ and inform the

webmaster that their page has been hacked. You can also inform Microsoft

(or Mozilla as the case may be) to consider that page or domain for

their phishing filters.



Do /not/ attempt to learn anything about that bogus pop-up; there's

nothing you can do about it and your attempts may end up installing

malware on your computer.



When you see one of those things, the safest way to dismiss it is via

Task Manager > End Task.

---

Leonard Grey

Errare humanum est



Roger wrote:

> This morning I think I had one copy of IE8 running and was on my

> my.yahoo.com home page when I got a popup "Message from webpage" that said:

>

> "Warning! Your computer contains various signs of viruses and malware

> programs presence. Your system requires immediate anti viruses check!

> System Security will perform a quick and free scanning of your PC for

> viruses and malicious programs." "OK" "Cancel"

>

> I hit cancel, but was redirected to 94.102.55.9 anyway and a very

> convincing virus checker appeared to be running.

>

> I am running Windows 7 and MS System Security Essentials says no

> problems found.

>

> My question is - is there anyway to be certain where the popup message

> or the link to 94.102.55.9 originated? Does the IE history contain

> something like a referrer link that I can access?

>

> Once the popup message appeared, I was unable to do a view source or run

> any of the IE debuggers on the parent page. Is there any way to

> investigate the source of the popup when it is on my screen?

>

> Roger

 

[PA Bear [MS MVP]]

@Roger:



And if a Norton or McAfee free trial came preinstalled on the Win7 computer

when you bought it, MSE may not have installed properly and therefore may

not be working properly.



Leonard Grey wrote:

> Even if you could find out who served the pop-up, it probably won't be

> there in a few hours.

>

> If you regularly see that phony warning on the same web page (or

> domain), /stop visiting that web page or domain/ and inform the

> webmaster that their page has been hacked. You can also inform Microsoft

> (or Mozilla as the case may be) to consider that page or domain for

> their phishing filters.

>

> Do /not/ attempt to learn anything about that bogus pop-up; there's

> nothing you can do about it and your attempts may end up installing

> malware on your computer.

>

> When you see one of those things, the safest way to dismiss it is via

> Task Manager > End Task.

> ---

> Leonard Grey

> Errare humanum est

>

> Roger wrote:

>> This morning I think I had one copy of IE8 running and was on my

>> my.yahoo.com home page when I got a popup "Message from webpage" that

>> said:

>>

>> "Warning! Your computer contains various signs of viruses and malware

>> programs presence. Your system requires immediate anti viruses check!

>> System Security will perform a quick and free scanning of your PC for

>> viruses and malicious programs." "OK" "Cancel"

>>

>> I hit cancel, but was redirected to 94.102.55.9 anyway and a very

>> convincing virus checker appeared to be running.

>>

>> I am running Windows 7 and MS System Security Essentials says no

>> problems found.

>>

>> My question is - is there anyway to be certain where the popup message

>> or the link to 94.102.55.9 originated? Does the IE history contain

>> something like a referrer link that I can access?

>>

>> Once the popup message appeared, I was unable to do a view source or run

>> any of the IE debuggers on the parent page. Is there any way to

>> investigate the source of the popup when it is on my screen?

>>

>> Roger

 

[G. R. Woodring]

The site below explains how to use Process Explorer and MalwareBytes'

Anti-Malware to remove the infection, which is frequently recommended in this

newsgroup. You might not yet actually be infected but you should assume you are

until you have completed the tests described.







Clicking _any part_ of a malware pop-up is like saying "Please come in." to a

vampire! :-(



--

G. R. Woodring





Date: 2/19/2010 11:06 AM, Author: Roger Wrote:

> This morning I think I had one copy of IE8 running and was on my

> my.yahoo.com home page when I got a popup "Message from webpage" that said:

>

> "Warning! Your computer contains various signs of viruses and malware

> programs presence. Your system requires immediate anti viruses check!

> System Security will perform a quick and free scanning of your PC for

> viruses and malicious programs." "OK" "Cancel"

>

> I hit cancel, but was redirected to 94.102.55.9 anyway and a very

> convincing virus checker appeared to be running.

>

> I am running Windows 7 and MS System Security Essentials says no

> problems found.

>

> My question is - is there anyway to be certain where the popup message

> or the link to 94.102.55.9 originated? Does the IE history contain

> something like a referrer link that I can access?

>

> Once the popup message appeared, I was unable to do a view source or run

> any of the IE debuggers on the parent page. Is there any way to

> investigate the source of the popup when it is on my screen?

>

> Roger