# Anyone else getting fake anti-virus errors? **URL:** \ **Category:** About This Message Board\ **Created:** [March 2, 2010, 6:29pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020 "2010-03-02T18:29:59Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![The\_wind\_of\_my\_soul](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@The\_wind\_of\_my\_soul](https://boards.straightdope.com/u/The_wind_of_my_soul)\ **Post date:** [March 3, 2010, 4:31pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/21 "2010-03-03T16:31:23Z")
I got it. I had let my computer idle for nearly an hour, so I was wondering what the heck could have caused it. Now I know. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [March 3, 2010, 6:16pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/22 "2010-03-03T18:16:00Z")
Jim the ad tech guy spent the morning prowling around the board but encountered nothing out of the ordinary. We need more to go on. Please submit details per: [http://boards.straightdope.com/sdmb/showpost.php?p=11967039&postcount=1](http://boards.straightdope.com/sdmb/showpost.php?p=11967039&postcount=1) ---
**Author:** ![jasg](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@jasg](https://boards.straightdope.com/u/jasg)\ **Post date:** [March 3, 2010, 6:36pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/23 "2010-03-03T18:36:16Z")
Here is what I just got hit with. MS Security Essentials caught and cleaned it on Windows 7 Ultimate. Category: Trojan Downloader:JS/Renos Description: This program displays deceptive product messages. Recommendation: Remove this software immediately. Microsoft Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the ‘Allow’ action and click ‘Apply actions’. If this option is not available, log on as administrator or ask the local administrator for help. Items: containerfile:C:\Users\acct\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O6US7WLQ\s2[1].htm file:C:\Users\acct\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O6US7WLQ\s2[1].htm-\>(SCRIPT0000) Get more information about this item online. [http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=TrojanDownloader%3AJS%2FRenos&threatid=2147609530](http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=TrojanDownloader%3aJS%2fRenos&threatid=2147609530) ---
**Author:** ![Busy\_Scissors](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@Busy\_Scissors](https://boards.straightdope.com/u/Busy_Scissors)\ **Post date:** [March 3, 2010, 7:10pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/24 "2010-03-03T19:10:32Z")
> [@Fear\_Itself](#): > > For those who reported this virus, I am curious about the updates on some software on your computer. What version of Adobe Reader are you using? What version of Java is installed? Both can be determined by looking in “Add/Remove Programs” > > The reason I ask is that both programs have been the target of spyware attacks recently, and if you don’t have the most recent updates, it can expose you to infection. The most current Adobe Reader is 9.3.1, and the most recent Java is version 6, update 18. I got this problem today, on a managed desktop machine at work running XP. I restarted and noticed that adobe 9 updated to the most recent version, so that’s one data point I guess. The machine is running java version 5, though, so who knows. ---
**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\ **Post date:** [March 4, 2010, 1:53am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/25 "2010-03-04T01:53:48Z")
I just had this happen. I’m using a computer on a University network. I didn’t see what ads were showing so I can’t really help on the thread Ed linked to. Now, I’ve seen these “fake virus scan” popups before, and in my experience, they don’t actually install anything unless you click on them. I simply close them, and when I’ve scanned afterwards, nothing turned up. But do these things actually end up installing something even if you don’t click on them? I use Windows Vista, with Microsoft’s anti-virus thing. ---
**Author:** ![suranyi](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@suranyi](https://boards.straightdope.com/u/suranyi)\ **Post date:** [March 4, 2010, 4:00am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/26 "2010-03-04T04:00:42Z")
I’ve been hit twice today. Both times I’ve been able to avoid infestation by turning the power off immediately. It may be drastic, but it works. I may have to stop visiting the SDMB until this problem is fixed. ---
**Author:** ![xash](https://avatars.discourse-cdn.com/v4/letter/x/c6cbf5/32.png) [@xash](https://boards.straightdope.com/u/xash)\ **Post date:** [March 4, 2010, 7:50am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/27 "2010-03-04T07:50:29Z")
I refreshed ads on the SDMB every 5 seconds for an hour, for a total of 720 ad views, across all forums, and I did not detect any malware. I would advise everyone, whether or not you are seeing this issue, to please follow instructions in [this thread](http://boards.straightdope.com/sdmb/showthread.php?t=538187) to safeguard your computer from all Internet malware, while the SD staff tries to investigate this further. - **xash** Administrator ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [March 4, 2010, 9:24am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/28 "2010-03-04T09:24:54Z")
> [@suranyi](#): > > I’ve been hit twice today. Both times I’ve been able to avoid infestation by turning the power off immediately. It may be drastic, but it works. > > I may have to stop visiting the SDMB until this problem is fixed. I believe **xash** has mentioned cutting power to your computer as soon as you see this popup as an appropriate response to prevent the problem from happening. I don’t think it made it into the above-mentioned computer sticky. But it’s what I told my Dad. You see, he has gotten this malware before (albeit from somewhere else). I have him running as a Limited User (which I think helped), and all I had to do was cut power, reboot in safe mode, and run MalwareBytes AntiMalware (link in the sticky). I even checked the registry entries mentioned above to make sure it was gone. To avoid having to avoid the SDMB, might I suggest blocking the ad’s IP (as reported in this thread)? If you have adblocking software, you may want to put that IP on the adblocking list. If not, you can try editing your hosts file. It will be at C:\WINNT\system32\drivers\etc\hosts (for Windows 2000) or C:\WINDOWS\system32\drivers\etc\hosts (for any other Windows, ME or greater). Open it in Notepad, and you can add the following line to block this particular ad’s IP: ```auto 127.0.0.1 94.23.72.47 ``` ETA: Forgot to mention that, after finding the IP mentioned as being a bad site on Norton, I reported it to Google, which will check and report it to [stopbadware.org](http://stopbadware.org), which is used by Mozilla to create their blacklist that runs by default in copies of Firefox, keeping its users from going there. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [March 4, 2010, 10:58pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/29 "2010-03-04T22:58:23Z")
In the last 24 hours: Now the malad is getting past AVG at work and Norton at home. It only occurs on this site and only intermittantly. Next time I’ll try to get more info. ---
**Author:** ![MerryGreenleaf](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@MerryGreenleaf](https://boards.straightdope.com/u/MerryGreenleaf)\ **Post date:** [March 5, 2010, 10:06pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/30 "2010-03-05T22:06:42Z")
Hello…I’m pretty new here, but I want to let ya know that this site tried to install one of those fake virus protection programs on my computer a couple of times. I don’t know if you have any control over that, but I hate when that happens! Take care, peace, mgL ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [March 5, 2010, 10:08pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/31 "2010-03-05T22:08:19Z")
> **[If you think you see malware on the SDMB](https://boards.straightdope.com/sdmb/showthread.php?t=546869)** > > If an ad on the SDMB has given you problems, please provide the following info if possible: Time/date of occurrence. Screenshot(s) of ALL ads on the page - typically there are three (on PCs you can do this with Alt-Print Screen, then copy into... ---
**Author:** ![xash](https://avatars.discourse-cdn.com/v4/letter/x/c6cbf5/32.png) [@xash](https://boards.straightdope.com/u/xash)\ **Post date:** [March 6, 2010, 12:38am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/32 "2010-03-06T00:38:58Z")
Thanks to **anson2995** ’s feedback in another thread, the GQ sticky has now been updated with specific instructions on how to clean the fake “anti-virus”: [**How to protect your computer from malware**](http://boards.straightdope.com/sdmb/showthread.php?t=538187) ---
**Author:** ![Muffin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/muffin/32/4341_2.png) [@Muffin](https://boards.straightdope.com/u/Muffin)\ **Post date:** [March 6, 2010, 1:14am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/33 "2010-03-06T01:14:43Z")
It tried to get me a couple of times today while I was on the SDMB. Since I immediately turned off the power each time, I can’t provide any better details. Sorry. ---
**Author:** ![mangeorge](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@mangeorge](https://boards.straightdope.com/u/mangeorge)\ **Post date:** [March 6, 2010, 1:51am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/34 "2010-03-06T01:51:38Z")
I haven’t turned my computer off for days, and no problem yet. iMac G5, safari, earthlink. Peace, mangeorge ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [March 6, 2010, 4:04am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/35 "2010-03-06T04:04:34Z")
Jim had a hunch about a particular ad and shut it off Friday afternoon. Please advise if the phony virus scan thing persists. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [March 6, 2010, 4:14am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/36 "2010-03-06T04:14:10Z")
> [@mangeorge](#): > > I haven’t turned my computer off for days, and no problem yet. > iMac G5, safari, earthlink. > Peace, > mangeorge It’s Windows malware. You should be fine. ETA: Forgot to mention: I’ve been saying I ran MalwareBytes, when I really used SUPERAntiSpyware. I got them mixed up. ---
**Author:** ![DanBlather](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@DanBlather](https://boards.straightdope.com/u/DanBlather)\ **Post date:** [March 6, 2010, 5:04am UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/37 "2010-03-06T05:04:16Z")
I saw it as well, but have not seen any more problems. Any quick way to see if it really did install something? Will AVG detect and delete it? ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [March 6, 2010, 1:56pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/38 "2010-03-06T13:56:37Z")
> [@mangeorge](#): > > I haven’t turned my computer off for days, and no problem yet. > iMac G5, safari, earthlink. > Peace, > mangeorge You wouldn’t see any malware anyway, as you are a subscriber, and do not see the ads which are the vector for the malware. ---
**Author:** ![mangeorge](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@mangeorge](https://boards.straightdope.com/u/mangeorge)\ **Post date:** [March 6, 2010, 2:53pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/39 "2010-03-06T14:53:03Z")
> [@Fear\_Itself](#): > > You wouldn’t see any malware anyway, as you are a subscriber, and do not see the ads which are the vector for the malware. Doubly protected, eh. I feel so warm and fuzzy. 😉 ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [March 6, 2010, 4:27pm UTC](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020/40 "2010-03-06T16:27:53Z")
> [@Muffin](#): > > It tried to get me a couple of times today while I was on the SDMB. Since I immediately turned off the power each time, I can’t provide any better details. Sorry. I haven’t seen this particular fake AV, but based on ones I have seen you are far more at risk of damage by killing the power on your pc than you are by a fake AV page who’s instructions you _don’t_ follow. [Previous page](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020.md?page=1) [Next page](https://boards.straightdope.com/t/anyone-else-getting-fake-anti-virus-errors/531020.md?page=3)