Hope It's Not a Virus

[Nashida]

This has happened twice in the last two months. I'll be surfing the web on a legit site, getting the page to load, when it decides to change the page to something like "My Online Computer Scan" and a pop-up window stating

"Your machine could have spyware installed on it? Would you like us to scan? Y/N"

will show up. Both times I have never clicked on this window; rather, I'd go to Task Manager and end the program that way. I then promptly scanned for anything with Spybot and Symantec. I found nothing, and my computer behaved fine. No files missing, no random ads popping up, nothing of that sort.

It just happened again for the second time about an hour ago. I've scanned with Spybot and I'm currently scanning with Symantec, neither seems to be finding anything (as was the case the first time). The first time I also scanned in Safe Mode just to be sure, still found nothing.

I've installed NoScript and Flashblock in Firefox (my primary browser), and updated that to it's newest version as well. I'm not seeing anything buggy or out of the ordinary yet, and as far as I know of this was the worm/virus I was thinking of, I wouldn't have been able to open my antispyware stuff in the first place.

I'm running WinXPPro, with SP3 installed right now. Is there anything else I should do, or any fixes I should use? I'm not afraid of having to wipe n star over; this was just backed up a few days ago on my external.

[LionMan]

Not a virus, but the page will try to send you some files to download and those are bad.

In this case, these are pages that have been hijacked. Likely, they are running something like php and someone was able to use that to change the page to redirect to another site. Unfortunately, google still maintains a copy of the old page so they get onto listings. Or else someone was able to interject a redirect on the page still leaving the original contents.

[Nashida]

So basically as long as I have NoScript and Flashblock running in FF, I'll be okay? I'm also vigilant with updating my antispyware every three days and scanning.

Also, by using the task manager to close the browser, am I stopping it or it's not really doing anything special.

[lordlundar]

Until you agree to something, they're not doing anything. Try running the adblock addon for firefox, that should tone it down. Nothing else you can really do about it.

[LionMan]

Its not doing anything when it claims its scanning your system. However, whoever put that together wants you to download some files and run those, which you shouldn't do.

Personally, I get a chuckle when I see that page when it shows all those "infected" files I have. I'm not running windows.

[MadMike]

A lot of sites use ads that push these fake virus scans. Sometimes they do nothing but show a bunch of fake results and try to trick you into buying their worthless product. Others will try to install spyware. I wish these sites would show a bit more discretion when they accept advertisers. Facebook is one of the worst offenders.

[MrSmiley]

This has happened twice in the last two months. I'll be surfing the web on a legit site, getting the page to load, when it decides to change the page to something like "My Online Computer Scan" and a pop-up window stating

"Your machine could have spyware installed on it? Would you like us to scan? Y/N"

will show up. Both times I have never clicked on this window; rather, I'd go to Task Manager and end the program that way. I then promptly scanned for anything with Spybot and Symantec. I found nothing, and my computer behaved fine. No files missing, no random ads popping up, nothing of that sort.

"legit sites" assuming you mean major ones like CNN or BBC or Customerssuck shouldn't have that problem. AT ALL. If you're getting them on those kinds of sites than there is something wrong with your computer or browser that's "infected" where it's able to redirect and change the information you're visiting.

If you're visiting "legit sites" that are less major ones that full of content but seem to have made an unfortunate choice over which kinds of banner ads/pop-up ads they carry... well, then you're doing the right thing. I've come across more than a few of these. It's hard to police the entire web... but since there is a lot of people who hate these things, it's probably one of the factors that prevents them from becoming BIG MAJOR websites (combined with lousy and/or niche/specific content).

As for Firefox specifically, because it's not "integrated with the browser" on a variety of levels, you generally see "strange things" happen a lot less with it than with Internet Explorer. Even so, there are 2 good areas of attack that aren't viruses: 1) Plugins/Addons. Take a look at Tools > Addons and look for anything you don't recognize/don't trust. ESPECIALLY the Plugins which tend to include a bunch of stuff that's transparent to the user, both legitimate and otherwise. 2) a website link on the computer that another program is issuing a RUN/OPEN command to, which then launches the browser. You can look for these by searching for .url links, or by searching for the specific web address that you've seen before.

NoScript/Flashblock are great tools btw... but I'd also throw them into the "advanced user" pile simply because they're so (legitimately) annoying and cause complaints about blocking all kinds of legitimate stuff and wide range of content until the user (you) throws it on the whitelist. . Plus NoScript updates way too often which seems to be a ploy to have users autmatically visit their website and increase ad revenue.

[Nashida]

I've installed both NoScript and Flashblock for now, and I'm loving both of them. But you're right MrSmiley about having to remind myself to unblock certain things because suddenly the site's not working (like my school's Blackboard site, for one).

Good news is since I installed aforementioned addons I haven't seen that page since.

[Geek King]

"legit sites" assuming you mean major ones like CNN or BBC or Customerssuck shouldn't have that problem. AT ALL. If you're getting them on those kinds of sites than there is something wrong with your computer or browser that's "infected" where it's able to redirect and change the information you're visiting.

Just a heads up, but legit sites can still have issues if they host ads. Occasionally someone will slip some code into what looks like a legit ad, and it doesn't get caught by the ad company before rolling out to the website.

[MrSmiley]

Just a heads up, but legit sites can still have issues if they host ads. Occasionally someone will slip some code into what looks like a legit ad, and it doesn't get caught by the ad company before rolling out to the website.

Totally, but it's becoming less common as the companies that host and serve up ads are forced to develop audit/review processes just so that the aforementioned doesn't happen.

You're right though in that you shouldn't feel 100% secure anywhere, and large outbreaks have come from "big name" sites (even if it only shows up once for 15 minutes, that's still a large chunk of visitors). My own successful avoidance of viruses over the past 20 years probably has a large enough dependence on luck along with everything else

[MadMike]

Just a heads up, but legit sites can still have issues if they host ads. Occasionally someone will slip some code into what looks like a legit ad, and it doesn't get caught by the ad company before rolling out to the website.

Or worse yet, someone hacks a site and installs a bad script. That actually happened here on CS a couple years ago. Someone somehow got into an admin account and used it to install a template that tried to infect people's machines. What really made it confusing was that some people were having problems and some weren't. It turned out that the infection was one that took advantage of unpatched machines, so those that were up to date were OK.