Ask Leo! by Leo A. Notenboom

I've received a popup telling me I'm infected and recommending a download to fix it. Should I?

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Viruses and Malware » Malware Prevention

Summary: Messages that indicate you have a problem and recommend a specific download as a solution are immediately suspect. There's typically a safer solution.

I've recently started getting a new warning message when I visit some sites. It says that my computer has tracks of all the adult sites I've visited and that this will affect me in various ways. It recommends that I install a drive cleaning program to remove these tracks.

Does this mean that my computer was infected by a virus, trojan or some kind of tracking software? Have I been hacked by someone? And do you recommend that I install the drive cleaning software? Is it safe?

The short answer is that if you get warning message that indicates you are infected which recommends that you download a specific product to resolve the errors, the answer is simple: don't.

There may be other things you want to do, but following some random pop-up message's instructions to download a specific product isn't one of them.

There are several forms of not-quite-malware that operate as follows:

  • Present a message that you are infected (or have security or privacy vulnerabilities) and that you should download some free program to automatically resolve the problems for you.

  • The free download then presents exaggerated alerts about how compromised your machine is, and encourages you to purchase the "full" version to clean up all the problems so identified.

  • The paid version may or may not actually do anything, except take your money.

The question is where does that initial message come from?

There are several possibilities. Some websites will present these messages as a form of advertising when you visit. Sometimes software that you download will include additional software that presents these messages. Sometimes the messages can be the result of a virus or some form of spyware.

As you can see, it varies.

The point is to scare you into downloading and running a specific program to resolve what may or may not be an issue.

The free programs that you might download then report errors that play on people's paranoia. For example they might claim that the Windows Clipboard is a "critical" security violation. It's not, and it's easily cleared with out additional tools. These programs rely on paranoia and a lack of understanding to a) make things seem much worse than they are, and b) position themselves as the only solution.

"If you get a warning that includes a recommendation to download a specific product to resolve the problem, don't."

It's unclear whether the paid versions actually do what they claim. I'm sure that a few do, but the approach to marketing the product makes them very suspect regardless. At the other end of the spectrum, some are simply vectors to become infected - remember, they started by asking you to download and run a specific piece of software that you've probably never heard of before.

So what should you do?

If you get a warning that includes a recommendation to download a specific product to resolve the problem, don't.

Instead, start by keeping yourself safe to begin with. That means have up-to-date anti-virus and anti-spyware software, make sure that they're kept up to date, and run them regularly. Get behind a firewall. Keeping yourself safe to begin with means that you can confidently ignore all these fear-mongering popup messages.

If you do get a message that indicates a problem, and it does not recommend a specific program or download to resolve it, then perhaps pay attention. It might be from Windows or from your anti-malware tools. Learn to recognize messages that come from those sources. If there's a problem, then address the problem with tools that you choose.

Also if you do get a message, with or without a specific recommendation, go ahead and take a moment to update and run your anti-malware software right then and there. If there's a problem, that should take care of it - again, using tools that you selected.

If you are interested in cleaning up traces that relate to privacy, a highly reputable and free program is CCleaner (short for Crap-Cleaner) that will remove most all the "crap" you need to worry about. (Their download page pushes for a donation, but it's not required, and neither is the somewhat controversial Yahoo toolbar that's included in the download. Donate later if you believe it to have been worth it.)

But in general, as long as you're playing safe yourself, you can typically ignore these messages trying to play on your fears.

Related:

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:


Why Subscribe?

Article C3107 - August 4, 2007

Recent Comments
6 Comments

What is going on? Is there a conspiracy of silence or is just me? I too have the same popup message saying I am infected recommending a download to fix it. This occurred after being redirected to a pornography site. What I do not understand is that I am being redirected to other sites every time I use Google to search for information (not pornography sites). To avoid this in most cases I just keep clicking on the link until it stops trying to divert me. What is really anoying is sometimes I get diverted and the back button will not take me back no matter how many times I click it. I then Have the touble of having to use the down arrow by the back button to get back to the search. Why is Google not doing anything about this problem? Why is there what seems to me a wall of silence about this? In particular why are pornography sites allowed to get away with this when children can be abused in this way?

Posted by: Ron Barker at August 11, 2007 2:37 AM

"Why is Google not doing anything about this problem? "

Have you informed Google of the problem? If no one tells Google there is a problem, how do they know about the problem.

Copy the address of the site causing the problem and do a screen capture of the page if possible (MWSnap is good for this). Go to Google home page and find the contact customer support. Send them the information you collected and see what happens.

Posted by: Ken Crook at August 11, 2007 11:47 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It's also possible that what you're experiencing has nothing at all to do with
Google. If you were to visit the sites in question without involving Google at
all, you may very well get the same results.

Also, some of what you describe could also be the result of a malware/spyware
infestation on your own machine. Again, nothing Google can do about it.

Google defintely *tries* to do the right thing, but there are so many sites and
so many places where this kind of crap happens, they can't keep up. And
ultimately, it's our own responsibility to keep our machines safe.

Leo


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFGvzM0CMEe9B/8oqERAs4FAJ9CN3gMD2s8yrxx4EXgBiZhnNybOgCfcafW
/cS+Y2egENOcDt6B2fzonjc=
=vhC+
-----END PGP SIGNATURE-----

Posted by: Leo A. Notenboom at August 12, 2007 9:19 AM

I too get these little yellow pop ups on some sites that warn me of virus, spyware. I never click on them. However sometimes I can't use the back button or the down arrow. I have to use Cont,Alt Del to get out of the mess.That means restarting the browser. This only happens on some sites I'm looking at.

Posted by: Gene at January 13, 2009 8:31 AM

when ever i use google to search for information it redirects me everytime i use a link but when i go back and press the link again it works. me thinking this is down to a malware infestation i recently bought norton 360 to solve the issue but when ever i do a scan to try and find anything the scan wont start or do anything i left my laptop on for three days trying to scan while i was on holiday when i got back the scan was still on zero items can you shed any light on this and if possible a solution?

Posted by: kev at June 17, 2009 3:39 PM

I have had the same messages popping up that I am infected and its from the links i select from the search results. Nats.org was one that kept doing and others as well. I have kaspersky internet security and found nothing on my system. But it does sound like a website has been jacked but when it repeatedly opens this window for infection it seems that the virus is being transfered to my computer.

This has happened on a good dozen or so links.

thank you,
southern belle

Posted by: Southern Belle at August 11, 2009 12:51 PM

Post a comment on "I've received a popup telling me I'm infected and recommending a download to fix it. Should I?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!

(you may use HTML tags for style)

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

  • Read the article at the top of this page. If your comment shows you didn't, it'll be deleted and ignored.

  • Comment only on this article. Use the Google search box at the top of the page if you have a question about something else.

  • Don't include personal information in the comment. No email addresses. No phone numbers. No physical addresses.

  • Don't spam. Excessive links to unrelated sites within a comment or across multiple comments will cause all such comments to be removed.

  • Don't ask me to recover lost passwords or hacked accounts. I can't, and those comments will be deleted.

  • I can't respond to every comment. And I can't vouch for the accuracy of others who do.

Please wait. Your comment is being processed ...


Question? Ask Leo!