3

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for both Safari and Chrome on OS X) saying "Virus Found"... which I took a screenshot of:

"Virus Found" Web Browser Pop-up

The first few times this happened, I was using Safari, panicked, and just quit out of Safari, which worked fine. For some reason, Safari would typically not re-encounter this pop-up (or any new tab ads from the site) until I closed all the way out of Safari again.

I recently used Chrome, which got locked by the same pop-up but would not quit (that is, right-clicking the chrome icon in the dock and clicking "Quit" was non-responsive). So, I clicked the "OK" on the pop-up which brought me to an obviously scammy site wanting me to click a button to scan my computer for viruses. I did not click that button; rather, I immediately closed out of that tab. I've noticed that Chrome does not re-display that ad unless I delete its browser cache/history.

My first question is: could any harm have been done by clicking the Safari/Chrome pop-up "OK" button which redirected me to a scam site (note that I immediately closed out of the scam site)?

A related question that I am simply curious if anyone knows the answer to is why Chrome has a much harder time with this than Safari?

Some additional information: I installed AdwareMedic and scanned for Adware but it found nothing; after that, I followed instructions to look at Safari's extensions (but there are none) and to change the homepage to google (with https) which I did and the pop-up has not returned on Safari since then. I followed similar instructions to "Reset Settings" for Chrome which only brought the pop-up back (it disappears after clicking the "OK" until I remove that event's history/cache I think).

EDIT I think @aviv adequately answered my question, but in case this may sate curiosity or help future users, I'll post here the scam url (which I do not recommend visiting)

http://app.macoscleaner.com/secure/en8/index.html?voluumdata=vid..00000003-a935-4042-8000-000000000000__vpid..4f731800-0f3e-11e5-8777-238ebdf4bb87__caid..48dced12-25c7-4982-b011-527d198fa9ea__rt..D__lid..b1d13635-3362-4e00-b49f-3daef77eb6d5__oid1..07bb6eaa-c983-4d90-b4ad-3670b87ec557__var1..20026__rd..onclickads%5C.%5Cnet&zoneid=20026&visitor_id=66476472834

Additionally, the website that sparked this question has a url of www dot animefreak dot tv (I don't have enough reputation to post another url).

To try to get the pop-up to appear (there are other new tab "on-click" ads that appear that don't cause a dialog box to appear and go to more mundane sites), I recommend using Chrome's Incognito mode, since the site seems to have a timer or something on normal use (that is, a pop-up occurs when I click one of the hyperlinks on the site only after a while; after I close it on Safari/Chrome for my normal preferences, it does not show up again for a while but it does every time for Incognito Chrome).

If people think this update/edit would better serve the community as a new question (about how a site can open a new tab even though my preferences say not to allow such, or something along those lines), leave a comment and I will do so.

Also note that I'll may be out of contact for up to a week at a time but I will be active when able to do so.

  • The pop up you see is just using a javascript call to show the alert.(Basically this page is trying to fool you that it found a virus on your machine and is luring you to download the fake antivirus programm) However you should think twice before clicking any unknown links while browsing the internet. Some links can download a malicious file to your machine or redirect your to a phishing page to steal your credentials etc. I use Adblocker plus, HTTPS everywhere and NoScript addons and they are cool and help preventing some common problems. – ρss Jun 7 '15 at 12:05
  • @pss Why would files be automatically downloaded? Shouldn't my browser (Safari or Chrome) ask me first before downloading anything? Or can a scam hyperlink dodge that security setting? – Ryan Farber Jun 7 '15 at 21:03
  • 1
    You are right the browser will prompt for sure. Some users have made settings in their browser to download a file without prompting. For eg: in Mozilla when you have file save dialog box at bottom there is an option to do make this action a default. – ρss Jun 7 '15 at 21:46
12

This message is just utilizing the alert function from javascript which is used to display a message to the user. One thing you need to understand is that once this tab has been opened you have already browsed to the "scam" site, the message is shown by the scam site. No harm can be done from the message itself and not from clicking OK. It doesn't matter whether you close that tab before or after clicking OK since once you browsed to that page it controls the order of things done and if it had any malicious intent it would have executed it before showing you this message... So it doesn't really matter if you use Safari or Chrome. It is strange though that your browser allows the site you are visiting to open a new tab, this behavior is usually disabled by default and instead you get a notification that this site wants to open a pop up. Maybe you allowed it sometime and thats why you get this annoying new tab opened. To disable it follow the instructions from Google

It is true that Chrome does not allow any action if a dialog window is open, but its not that it is having a harder time or that this is putting you in danger.

Regarding your question about the possible harm done: probably if you didnt interact with the scam site, no harm is done, perhaps beyond that site making some money from you visiting this site and maybe that site tracking your visit there by some analytics engine such as google analytics. As long as you have not granted it any special permission like using your camera, or did not enter any password into it it can not do much. Usually these sites will try to trick you into entering credentials for some of your accounts, or downloading some malware in disguise of some useful application.

  • I followed the Google instructions you hyperlinked and found that the new tab ad occurs even if pop-ups are "blocked". The problem disappears if I block the site from using Javascript, but then the actual content of the site also fails to work. Since you say clicking OK shouldn't harm me at all, I'm inclined to just live with the pop-up. Thanks, and I'll accept your answer tomorrow if it is still the best. – Ryan Farber Jun 7 '15 at 21:01
  • Another thing you can do is install an ad blocker extension like adblock, it might also help. You can also post the link to the site you are accessing in order for us to have a look. – aviv Jun 8 '15 at 8:10
  • Clicking OK can be harmful. Please see my answer below for my understanding of the reason why. – Grizzled Jun 8 '15 at 20:15
4

Its a fake alert for scaring users, it will later download fake antivirus program and show you fake scan results. These results will be very alarming and exaggerated displaying various types of virus present on the system and will ask users to buy the product in order to clean the system. Don't fall prey to such scams and never buy any of these products. Always use best antivirus products and consult experts or reviews before installing such applications.

1

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense.

Another way to protect yourself from such invasive advertising is to deactivate Javascript and browser plugins like Flash or Java. This makes it impossible for websites to open any kind of popup and also prevents lots of other annoyances. Unfortunately many websites today depend on Javascript and are unusable without. A good solution for this is the browser plugin like ScriptSafe which allows you to switch Javascript on or off for individual websites. When a website abuses its scripting privileges, disable it.

-5

It's a fake, and is trying either to get you to click on the "OK" button so that it can run something nastier, or to lead you to some scammer's site.

The good news is that there are limits on what code that runs on page-load can do in modern browsers, because it isn't started by the user. Just popping up an alert-box isn't much of a risk. It's awkward, in that you might have to restart your browser, but usually nothing more.

The bad news is that if you do click on the button in one of these alert boxes, your browser will assume that you intend to run whatever javascript code has been bound to it. That means that the code will run with the same privileges as your user account has in the browser, and can do things such as kick off the download of a virus, which can in turn mess around with your files, et cetera - whatever it's been written to do. This is one reason not to run your computer with root (or administrator) access, or to set up your browser to download files without prompting you.

When you see one of these alert boxes in your browser, just ignore the thing, close that browser tab, restart the browser, and clear the browser cache to make sure that the rogue code is gone. The last step could be viewed as excessive, but it should keep you quite safe.

  • 2
    I am sorry but you are stating things which are simply incorrect. The Javascript running on page load can do anything it can also after, except accessing DOM elements which have not been rendered yet, but that has nothing to do with security. Clicking OK simply dismisses the dialog window, nothing more. There is no relevance for user account since no one said he has a user account on that web site and the browser does not have access to files so it can not mess with them, unless in some modern browsers you are prompted for that access and grant it and select the specific file. – aviv Jun 9 '15 at 10:25
  • @aviv Please read section 13.6.1 of David Flanagan's JavaScript: The Definitive Guide and get back to me. Browsers do limit JS execution, and users can tweak their security settings. – Grizzled Jun 9 '15 at 11:34
  • 2
    @avid What you state with "That means that the code will run with the same privileges as your user account, and can do things such as kick off the download of a virus, mess around with your files, et cetera" is still completely wrong. Javascript engines in web browsers simply don't expose the APIs to do things like that and clicking OK in a alert(string) box doesn't grant a script any additional privileges either. – Philipp Jun 9 '15 at 14:32
  • @Philipp I see your point - I managed to imply that it was accessing the OS level directly, which wouldn't be possible unless it broke out of the sandbox. I'll rephrase later this evening. – Grizzled Jun 9 '15 at 16:36
  • @Grizzled Since the url doesn't change from the new-tab opened to when I hit the "OK" (it's just that then the page loads) I'm inclined to think that the only harm could be from an automatic download of malicious files; however, I have my browser preferences set to notify me before downloading any files, so I think I should be safe from that threat. – Ryan Farber Jun 10 '15 at 8:04

protected by Community Nov 17 '18 at 14:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.