Another Rogue Strikes Again!

Sally was attacked by an online virus scanner and couldn’t get away.
I want to thank you for everything you do and for providing common sense, plain English answers to our computer questions.

Recently I was browsing the Web and suddenly a window appeared saying I was infected with something. But it wasn’t my AVAST it was something else.  I tried using the F4 key to close the window but it wouldn’t let me, it said something about if I close this window I might damage my computer. So, thanks to your newsletter I knew better than to click “Close” on that box. I had no choice but to shut down my computer by turning it off using the power button. Luckily when I turned my computer back on, everything was normal. Afterwards I scanned my computer with Avast andSuperAntiSpyware but found nothing. What happened? Thanks!

Our Answer
Hi Sally – thanks for your nice comments. Rogues are the most common form of malicious attack you’re likely to encounter these days. You’re much more likely to encounter a rogue as you are a virus. You cannot F4 yourself out of this one.  But you did very well in not clicking any “Close” buttons or in trying to close these windows by clicking the “X” in the top-right corner. You would have ended up installing VirusDoctor – a rogue, malicious program most likely another AntiVirus2011 clone from the world of rogue security software.

Here’s a tip for you the next time you find yourself in a similar situation. If the ALT+F4 key combination does not work, don’t panic.

• Calmly right-click on an empty place on your taskbar and right-click it. Select Task Manager.
• When Task Manager opens, click the Processes tab and locate your Brower’s exe file. Internet Explorer is called iexplore.exe and Firefox is called firefox.exe.
• Right-click on the browser’s exe and choose “End process tree”. Ignore the warning and proceed. This will close your browser immediately regardless of whatever tricks the site may be playing.
• If you have more than one instance of your browser running you may have to individually close each instance. Simply repeat the steps above.
• If all else fails – turn your computer off at the switch.

For the benefit of those who’ve not had the misfortune to encounter these kinds of rogues, here are some screen shots we created when we intentionally went out and tried find one for you. We found it and we allowed it to begin its attack on our computer. We’re nuts, I know. But this will help you recognize a scam when you see it — and this, friends, is a blatant scam and a violation of your computer. This is a crime.

Fig 1.  “System Security” sounds like it’s a Windows function. It is not. It’s a deception. Do not click the “X” and do not click “OK”. Press ALT+F4. If ALT+F4 does not work, follow the steps outlined below.

Fig 2. Tricky, tricky, tricky. See how it looks like your own computer. It’s not. We did this on Vista on a computer with 4 hard drives. This is just a clever reproduction that could be anyone’s Windows XP computer. It couldn’t be a Vista or Windows 7 computer. Look at the folders and look at the name “My Documents”. On Vista and Windows 7 “My Documents” are called “Documents”. Again, never click the “X” or “OK” or “Cancel” , if you do you’re going the installation will start. Never click anything on these kinds of pages. Use ALT+F4. If that fails to close the browser use Task Manager to end the process and terminate your browsing session.

Fig 3. Kind of hard to see this? Click on the picture to see the full-size image. Note our computer is “infected”. Why? Every computer is infected because this is just an graphic, everyone who gets caught in this trap sees the same picture. It’s used to scare unwitting users into downloading malware. Not only that, they’ll want you to pay to “clean” your computer. Can you say “scam”? We were using Windows Vista when we took this screen shot. Notice the graphic still showing a Windows XP computer. It can’t be a Windows 7 or Windows computer – but if you’re not paying attention you might THINK it is your computer – even if you are using Vista or Windows 7.

So there you have it. These kinds of scummy tricks go on every day on the Web. If you haven’t seen one yet, just wait, you probably will. But, now you know what to do. If ever the ALT+F4 key combination doesn’t work, don’t panic, don’t turn your computer off at the switch, use Task Manager to shut down your browser. If you can’t find it in Task Manager – then shut down your computer at the switch. It’s been than dealing with the damage installing one of these rogues can cause.