Fake Virus Alerts

Fake virus alert messages are becoming more common.  They usually have greater potential for harm on Windows-based computers.  Sometimes they appear while you're surfing the web, but they can also appear during other activities.

Phony alerts are frequently designed to look like legitimate warnings, thereby attempting to fool you into clicking inside the alert window -- the very action which can potentially cause your computer to become infected.

Here's what users of ECN-supported Windows PCs might want to keep in mind:

• Purdue's licensed anti-virus software for University-owned PCs is named McAfee VirusScan Enterprise, and it is installed on every ECN-supported Windows PC.
• Updates to the McAfee anti-virus software are installed automatically on ECN-supported Windows PCs on a daily basis.
• Our McAfee software will never ask you to download updates or prompt you for activation.
• If you're ever not sure about the legitimacy of any anti-virus alert message which appears on your screen, please contact ECN.

Notes for home users and "self-supported" computers: The version of McAfee software used on laptops, home computers, or other self-supported (non-ECN-maintained) computers might work differently. In those contexts, McAfee VirusScan might legitimately prompt you for updates or activation renewal. This might also be true for other legitimate commercial anti-virus products. We recommend familiarizing yourself with the software's documentation so that you can learn to discern real virus alerts from fake warnings.

Fake alerts exist in more forms than we could ever hope to document. A few examples of some fake virus alert messages appear below.

"Windows Security Center"

The screen capture at right is a fake alert which mimics Windows XP's actual Security Center control panel window. Here's how we know it's fake:

• It says "Virus Protection ... NOT FOUND". On ECN-supported Windows PCs, McAfee anti-virus software is already installed.
• The message reads "Windows Security center reports that 'WinPC Antivirus' is inable." A legitimate warning would likely use correct spelling and capitalization.
• If you search for "WinPC Antivirus" at Google.com, the search results identify the program as rogue software.
• A link appears which reads "Click here to get your WinPC Antivirus License". There's no need to acquire a software license on an ECN-maintained Windows PC. And the name of the fake product is itself misspelled.

Fake alerts like this one won't always employ misspellings and/or incorrect English grammar. It's important to look at all the cues. Unless you're sure it's real, don't click on any part of the window -- even the parts which don't look like clickable buttons or links.

"Critical warning alert"

The screen capture at right is not a real warning; it was not generated by Windows XP itself or by legitimate anti-virus software. Here's how we know it's fake:

• If you search for "WinPC Antivirus" at Google.com, the search results identify the program as rogue software.
• Some of the phrases represent writing which isn't particularly polished: "junk content of low privacy threats" and "Windows hangovers and crashes without limitations".
• The "Activation is highly recommended" phrase and "Activate Now" button try to fool you into downloading software. There's no need to activate anti-virus software on an ECN-maintained Windows PC.

Unless you're sure it's real, don't click on any part of the window -- even the parts which don't look like clickable buttons or links.

Windows Vista-like dialog

The screen capture at right shows another fake alert. Some of the clues are very subtle:

• The visual style of the dialog is more like the overall style of Windows Vista. At this writing, ECN-supported Windows PCs run Windows XP. (ECN does not support Windows Vista.)
• The minimize and close buttons at the upper right corner (we've circled them in red in the illustration at right) look like Windows Vista's buttons, not Windows XP's.
• At lower left (also circled in red), a "warning" tries to convince you to "Activate the software to protect it" and "Get full time protection now". There's no need to activate anti-virus software on an ECN-maintained Windows PC.

Unless you're sure it's real, don't click on any part of the window -- even the parts which don't look like clickable buttons or links.

"Firewall Warning"

This screen capture shows fake alerts which appeared at the lower right corner of the user's monitor, near the "system tray" in which the current time of day appears. We know this one is fake as well because:

• When in doubt, use Google.com to search for the software name. As noted earlier, search results for "WinPC Antivirus" identify the program as mal-ware.
• Also as before, an example of somewhat poor English writing appears here: "WinPC Antivirus has detected that new threat database is available."
• Yet again, the dialog wants you to download an update. On an ECN-supported Windows PC, updates are downloaded and installed automatically on a daily basis.

Unless you're sure it's real, don't click on any part of the window -- even the parts which don't look like clickable buttons or links.

See also:

• Phishing, e-mail scams which try to trick you into revealing passwords and private information, http://eng.purdue.edu/jump/9dc491