"Virus Found" Web Browser Pop-up

Question

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for both Safari and Chrome on OS X) saying "Virus Found"... which I took a screenshot of:

The first few times this happened, I was using Safari, panicked, and just quit out of Safari, which worked fine. For some reason, Safari would typically not re-encounter this pop-up (or any new tab ads from the site) until I closed all the way out of Safari again.

I recently used Chrome, which got locked by the same pop-up but would not quit (that is, right-clicking the chrome icon in the dock and clicking "Quit" was non-responsive). So, I clicked the "OK" on the pop-up which brought me to an obviously scammy site wanting me to click a button to scan my computer for viruses. I did not click that button; rather, I immediately closed out of that tab. I've noticed that Chrome does not re-display that ad unless I delete its browser cache/history.

My first question is: could any harm have been done by clicking the Safari/Chrome pop-up "OK" button which redirected me to a scam site (note that I immediately closed out of the scam site)?

A related question that I am simply curious if anyone knows the answer to is why Chrome has a much harder time with this than Safari?

Some additional information: I installed AdwareMedic and scanned for Adware but it found nothing; after that, I followed instructions to look at Safari's extensions (but there are none) and to change the homepage to google (with https) which I did and the pop-up has not returned on Safari since then. I followed similar instructions to "Reset Settings" for Chrome which only brought the pop-up back (it disappears after clicking the "OK" until I remove that event's history/cache I think).

EDIT I think @aviv adequately answered my question, but in case this may sate curiosity or help future users, I'll post here the scam url (which I do not recommend visiting)

http://app.macoscleaner.com/secure/en8/index.html?voluumdata=vid..00000003-a935-4042-8000-000000000000__vpid..4f731800-0f3e-11e5-8777-238ebdf4bb87__caid..48dced12-25c7-4982-b011-527d198fa9ea__rt..D__lid..b1d13635-3362-4e00-b49f-3daef77eb6d5__oid1..07bb6eaa-c983-4d90-b4ad-3670b87ec557__var1..20026__rd..onclickads%5C.%5Cnet&zoneid=20026&visitor_id=66476472834

Additionally, the website that sparked this question has a url of www dot animefreak dot tv (I don't have enough reputation to post another url).

To try to get the pop-up to appear (there are other new tab "on-click" ads that appear that don't cause a dialog box to appear and go to more mundane sites), I recommend using Chrome's Incognito mode, since the site seems to have a timer or something on normal use (that is, a pop-up occurs when I click one of the hyperlinks on the site only after a while; after I close it on Safari/Chrome for my normal preferences, it does not show up again for a while but it does every time for Incognito Chrome).

If people think this update/edit would better serve the community as a new question (about how a site can open a new tab even though my preferences say not to allow such, or something along those lines), leave a comment and I will do so.

Also note that I'll may be out of contact for up to a week at a time but I will be active when able to do so.

Answer 1

This message is just utilizing the alert function from javascript which is used to display a message to the user. One thing you need to understand is that once this tab has been opened you have already browsed to the "scam" site, the message is shown by the scam site. No harm can be done from the message itself and not from clicking OK. It doesn't matter whether you close that tab before or after clicking OK since once you browsed to that page it controls the order of things done and if it had any malicious intent it would have executed it before showing you this message... So it doesn't really matter if you use Safari or Chrome. It is strange though that your browser allows the site you are visiting to open a new tab, this behavior is usually disabled by default and instead you get a notification that this site wants to open a pop up. Maybe you allowed it sometime and thats why you get this annoying new tab opened. To disable it follow the instructions from Google

It is true that Chrome does not allow any action if a dialog window is open, but its not that it is having a harder time or that this is putting you in danger.

Regarding your question about the possible harm done: probably if you didnt interact with the scam site, no harm is done, perhaps beyond that site making some money from you visiting this site and maybe that site tracking your visit there by some analytics engine such as google analytics. As long as you have not granted it any special permission like using your camera, or did not enter any password into it it can not do much. Usually these sites will try to trick you into entering credentials for some of your accounts, or downloading some malware in disguise of some useful application.

Answer 2

Its a fake alert for scaring users, it will later download fake antivirus program and show you fake scan results. These results will be very alarming and exaggerated displaying various types of virus present on the system and will ask users to buy the product in order to clean the system. Don't fall prey to such scams and never buy any of these products. Always use best antivirus products and consult experts or reviews before installing such applications.

Answer 3

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense.

Another way to protect yourself from such invasive advertising is to deactivate Javascript and browser plugins like Flash or Java. This makes it impossible for websites to open any kind of popup and also prevents lots of other annoyances. Unfortunately many websites today depend on Javascript and are unusable without. A good solution for this is the browser plugin like ScriptSafe which allows you to switch Javascript on or off for individual websites. When a website abuses its scripting privileges, disable it.

Answer 4

It's a fake, and is trying either to get you to click on the "OK" button so that it can run something nastier, or to lead you to some scammer's site.

The good news is that there are limits on what code that runs on page-load can do in modern browsers, because it isn't started by the user. Just popping up an alert-box isn't much of a risk. It's awkward, in that you might have to restart your browser, but usually nothing more.

The bad news is that if you do click on the button in one of these alert boxes, your browser will assume that you intend to run whatever javascript code has been bound to it. That means that the code will run with the same privileges as your user account has in the browser, and can do things such as kick off the download of a virus, which can in turn mess around with your files, et cetera - whatever it's been written to do. This is one reason not to run your computer with root (or administrator) access, or to set up your browser to download files without prompting you.

When you see one of these alert boxes in your browser, just ignore the thing, close that browser tab, restart the browser, and clear the browser cache to make sure that the rogue code is gone. The last step could be viewed as excessive, but it should keep you quite safe.