Windows Security Tutorials - Herong's Tutorial Examples - Version 3.00, by Dr. Herong Yang
WinAntiVirusPRO 2006 Faked Security Popup
This section describes the security popup caused by the IE WinAntiVirus addon. The popup gives faked security warning messages that your computer has a spyware sending out private data to a remote site and you should download the specified software for protection.
Symptom: Once a while in January of 2006, while visiting a website with IE (Internet Explorer), an IE popup window showed up with http://188.8.131.52 in the address field. This pop up window contains a false warning message and advertisements for "WinAntiVirusPro 2006, WinAntiSpyware 2006, and WinFixer 2006". The warning message said:
Attention! Security Center has detected spyware on your PC sending private information and documents to remote computer. One of processes (Win32res.exe) has just sent this information: IP address: 184.108.40.206 Browser: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Computer OS: Windows XP Full PC control: Gained Sent Information: approximately 17 Megabytes Your current security software is unable to stop this kind of spyware. To clean up your computer and prevent further possibilities to be infected, you need to download one of these security software: WinAntiVirusPRO 2006 - Download WinAntiSpyware 2006 - Download WinFixer 2006 - Download
Here is an example of this popup window:
Apparently, this IE addon is trying to invite you to download and install some software products. See sections below on what I did to remove it.
Last update: 2006.
Table of Contents