How to avoid fake "Windows Virus Alert"

Question

I was recently browsing online when I came across this page:

When I chose to close the tab, I received this message:

And after choosing "Leave this page" twice, I receive this message:

Choosing OK reverts back to the first message. It appears the only way I can close this tab is to force close Internet Explorer. I already know about scams like this; they show you your Event Log while declaring any errors are a sign of malware, then they talk you through installing remote control software, where they then talk you through handing out your credit card information, changing your log in password, and also doing god knows what else.

How can this type of hijacking be avoided? I am running Internet Explorer with Windows 8.

Answer 1

I would suggest using Firefox with NoScript or comparable setup.

NoScript allows you to monitor scripts loaded from websites and selectively allow certain JavaScript to run. That way you can avoid dubious scripts from running. It is especially useful as many malware is not hosted on the website itself , but often through ads or other third party content.

Other than that it is always a good idea to avoid shady websites, have AV product that is up-to-date, always install patches for your browser and OS.

In case you do need to visit websites with questionable reputation, you might want to use a VM with correct configuration to avoid infections of the host. This is not 100% secure but it is pretty good against average threats.

On the contrary of begueradj comment using NoScript prevents drive-by-downloads, when properly configured. Drive-by-downloads use exploits in the browser or it's extensions. Such exploits can be distributed through e.g. JavaScript, Java, Flash, Silverlight among others.
NoScript is able to monitor all content that is referenced and attempted to load by a website you are visiting. Such content can be disallowed and then is not loaded and of course not executed.
It also tries to protect against XSS (Cross-Site-Scripting), CSRF (Cross-Site-Request-Forgery) and clickjacking. Take a look at NoScript's website.

If you whitelisted a site that hosts exploits then of course NoScript cannot protect you (you allowed the execution of scripts manually). This is why you should also follow the other security guidelines.

Answer 2

How can this type of hijacking be avoided? I am running Internet Explorer with Windows 8.

Switch to Google Chrome. This has the following option which becomes active when repeated dialogue boxes are displayed:

Selecting the checkbox will help prevent a malicious webpage from holding your current browser session to ransom.

Answer 3

First of all, the phone number that appears on the message alarms appears to be used by nefarious people as you can read for example here.

This is said, I want to describe the scenario you experienced according to the behavior you witnessed:

Certain compromised websites could lead to malware installation on your computer by simpling visiting them and without noticing anything suspecious. Other websites can perform the same goal by poping-up annoying windows that whether you click on Ok or Cancel or even click on the close corner X could trigger malware installation (which thing is your case). In both cases the scenario is called drive-by download attack which simply exploits the vulnerabilities of your browsers or the plugins you installed within them. Lot of computers become zombies using this schema or simply have been infected by adware, spyware or other malware types.

This is not a fiction. May be one of the best examples I could mention is the famous PHP.net website that you may used already if you have developed in PHP. Thus, on 24-Oct-2013, 6,500 computers are infected by DGA.Changer, a malware title whose sole job is to surreptitiously download other malware onto compromised systems. Also, on June 2011, Amnesty International‘s homepage served malware that exploits a recently-patched vulnerability in Java.

Check if no extensions has been added to your IE browser without your agreement (you can do that depending on your IE version). If so then:

1. The first thing you need to do is to disconnect your machine from Internet. 2. Then run a full and deep scan on your machine with all AV software you have.
2. Even if you do not succeed to find anything suspicious, then scan your ports during Internet connection.

This is said, for the sake of your safety:

• Do not surf untrusted websites (without valid certificates)
• Do not use download managers that are easily compromised to download malware in the background process
• Clear always your browsing activities (cookies, sessions ...)
• Avoid popular websites that are the first targets used to spread malware (porn websites ...)
• If you are prompted to use your credentials for a given website then be sure of what you are doing.
• Use free but powerful services such as StopBadWare to check the safety of websites you want to use
• Best of all, use virtual machines for surfing on websites you do not trust.