IE Security threat?

[Osem]

H, the wife was just Googling for some recipes when she clicked on a link to a site and before anything else appeared, got what looked like a typical Internet Explorer alert box. This stated, in not very good English, something along the lines of 'your computer contains harmful programmes and applications etc....' and offered to so some sort of scan to remedy the problems. The box contained the usual OK and Cancel buttons plus the red/white 'close' box in the top right hand corner. She didn't click on any of these but tried to close the webpage down using the close button on the tab and then the main close button on the top right hand corner of the screen, neither of which worked. At this point the dubious webpage was still blank and the suspricious IE warning message box was still displayed. In the end she decided to simply logout from the start menu and this had the desired effect. Being even less PC literate than me, she was in a bit of a panic but did she do the right or best thing?

We're using Avast 4.7 and it didn't give any alert but we're doing a full scan now just in case.

I think this may have been one of these sites that trick people into downloading what they think is some sort of AV programme but turns out to be somethign else. Is that possible/likely?

[Matty_]

Originally Posted by Osem

I think this may have been one of these sites that trick people into downloading what they think is some sort of AV programme but turns out to be somethign else. Is that possible/likely?

Sounds about right Osem, any chance you could pm the link (or similar) so i can have a shufties?

Internet Explorer 8 is actually a pretty safe browser on Vista/7 with sandboxing. Unless the wife executed anything (provided there wasn`t an unpatched exploit) you should be fine.
Maybe do a quick scan with Malwarebytes and run CCleaner to check if anything is present in memory/clean your temp files.

[Osem]

Thanks for that Matty - we're running XPSP3 and IE7 BTW. No she didn't click on anything in the pop up box as I'd already warned her about other types of fake AV messages which are made to look like they've emanated from within Windows but activate some sort of dodgy download even if you click on what looks like a geneuine 'cancel' or 'close' button.

I'll PM you the link in a few mins.

[Mick Fisher]

You can always ctrl-alt-del and end the process using Device Manager.

[Osem]

Tks for that.

[Kymmy]

It sounds like a standard "we make you think you;ve got a virus so you buy our useless AV software" style link..

The scripting is designed so it's not easy to shut down and the supposedly OK/CANCEL buttons are normally part of the image so when you click on them it's the same as clicking anywhere on the image.

Best thing to do is to open up Task Manager and stop the browser process (either firefox.exe/iexplorer.exe/chrome.exe/..etc..) and restart the browser again..

Even going on the same page might not cause the same pop-up because they are done via an ad server (the same as google ads just not that user-friendly)

[heero_yuy]

Originally Posted by Kymmy

It sounds like a standard "we make you think you;ve got a virus so you buy our useless AV software" style link..

The scripting is designed so it's not easy to shut down and the supposedly OK/CANCEL buttons are normally part of the image so when you click on them it's the same as clicking anywhere on the image.

Best thing to do is to open up Task Manager and stop the browser process (either firefox.exe/iexplorer.exe/chrome.exe/..etc..) and restart the browser again..

Even going on the same page might not cause the same pop-up because they are done via an ad server (the same as google ads just not that user-friendly)

Those pages are a right pain when doing a search and as you say it's very difficult to get back to the original search. On my PC they're very obviosly not from the system as I run 98SE with a special XP themed skin but in non standard colours (Zune), there's an extra 3D button (from Madotate) in each correct window and AVG.

Next time it happens I need to see if the web developers toolbar that I have in Firefox can defeat the scripting.

[Osem]

Originally Posted by Kymmy

It sounds like a standard "we make you think you;ve got a virus so you buy our useless AV software" style link..

The scripting is designed so it's not easy to shut down and the supposedly OK/CANCEL buttons are normally part of the image so when you click on them it's the same as clicking anywhere on the image.

Best thing to do is to open up Task Manager and stop the browser process (either firefox.exe/iexplorer.exe/chrome.exe/..etc..) and restart the browser again..

Even going on the same page might not cause the same pop-up because they are done via an ad server (the same as google ads just not that user-friendly)

Thanks for an explanation even I can understand.