locked
Pop Up Window from One Care while Surfing RRS feed

  • Question

  • While surfing last night a Window that looked like a OneCare warning said that I had a Virus or Spyware, listed it and recommended that I Clean All. I closed the Window  and launched OneCare on my own and did an express scan. No virus, malware etc. was found. Was this a scam and did I respond correctly assuming that the wwarning window may have been a virus entry point etc.?
    Wednesday, February 18, 2009 5:17 PM

Answers

  •  Without seeing the window in question I can only assume that the window was legitimate. OneCare will pop up a warning when it detects an infection, will clean it, and then advise a full scan. Your action was correct. Note that some malware, most notably WinAntivirus Pro and its variants, will present a pop-up that looks like it is coming from Windows and advises a complete scan and purchase of their product. Closing the pop-up often does not prevent infection. It would not look like a OneCare dialog, though.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Wednesday, February 18, 2009 6:09 PM
    Moderator

All replies

  •  Without seeing the window in question I can only assume that the window was legitimate. OneCare will pop up a warning when it detects an infection, will clean it, and then advise a full scan. Your action was correct. Note that some malware, most notably WinAntivirus Pro and its variants, will present a pop-up that looks like it is coming from Windows and advises a complete scan and purchase of their product. Closing the pop-up often does not prevent infection. It would not look like a OneCare dialog, though.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Wednesday, February 18, 2009 6:09 PM
    Moderator
  • Thanks. I got burned on a realistic Windows anti virus 2008 scheme a year ago and did not wish to repeat my error. In your comments however you implied that OneCare would notify and remove it. This dialog offered me an option to "Clean All" or "Cancel". Having not chosen to clean it , OneCare apparently did not find an issue when I express scanned afterwards. The OneCare logo was convincing but because of my past experience I chose the option of launching OneCare from my task bar after closing my browser. Do you recommend in the future that I proceed the same way or activate the "Clean All" request that I getwith the initial warning window?
    Wednesday, February 18, 2009 9:13 PM
  • Your direction was appropriate, especially since you had a prior encounter with the fake alert malware. The infected file was likely in your Temporary Internet Files and would have been blocked, so the full scan is really just a confirmation that nothing slipped past.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Thursday, February 19, 2009 3:37 PM
    Moderator