Antivirus 2009 / "windows-defense.com" redirect & alert popup - resolved.

[Jeece]

I had this popup too yesterday. I started Firefox with my previous session's tabs, and my EM tab switched to this "Antivirus" crap automatically. Only occurence of this so far.

[Johnny Mullet]

I have yet to see this problem and I am usually here 2-3 times a day.

[jivany]

Just got this on my Mac in Firefox on the main forum page. It's not software or spyware installed on anyones computer, it's javascript running in an ad unit on the page.

[MetroMPG]

Need more info. We have ads served by 3 different parties. If someone can provide details, it would help us figure out which one needs to be notified. Like: URL of the affected page, screen cap... thanks.

[cmags]

OK, got it again clicking a subscription link in my email to the MPGuino Workspace thread. I didn't even make it to the thread - Firefox just minimized itself as soon as the page started to load, and the popup replaced it. Here's the first dialog that pops up:



Then clicking OK gives you this:



Clicking OK here or Cancel in the first popup brings you here (spaces inserted to avoid inadvertent click):

http :// windows-defense . com /2009/1/_freescan.php?aid=77024209

[justpassntime]

Wanna get rid of it? I did and the program was free. It found all of the crap and got rid of all of it.

I kept getting pop ups like that and it was a Anti virus fake attack to get you to buy their program.

Here's the link: SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!

[cfg83]

cmags -

Originally Posted by cmags

OK, got it again clicking a subscription link in my email to the MPGuino Workspace thread. I didn't even make it to the thread - Firefox just minimized itself as soon as the page started to load, and the popup replaced it. Here's the first dialog that pops up:



Then clicking OK gives you this:



Clicking OK here or Cancel in the first popup brings you here (spaces inserted to avoid inadvertent click):

http :// windows-defense . com /2009/1/_freescan.php?aid=77024209

Thanks for posting this. I literally had the exact same thing happen to me 2 hours ago. However, I clicked the X in the upper right corner, and yanked out my PCMCIA wifi card (old PC).

CarloSW2

[TomEV]

I got the popup today also - Haven't seen it anywhere else so it appears to be associated with this this site (EM) somehow...

[TomEV]

Additional info can be found here
Remove Antivirus 2009, removal instructions

and here -

Miguel Campos Blog : Removing the Antivirus 2009 infection

An interesting side note is that I viewed a youtube video about 'the price of electricity VS gasoline' about 30 minutes before the pop-up. May be related according to the msdn blog entry.

[MetroMPG]

Note that the popup does not mean you're infected with anything. It's simply a javascript redirect to a website which causes the alert and displays the fake virus scan progress. Just close the browser window.

I'm sure everyone knows that if you actually download and install the product from that site, you WILL be infected with malware.

Our server admin has checked and assured us the problem isn't on EcoModder, but with one of the advertisers whose ads appear on the site. We've been in touch with the advertisers. Waiting to hear back.