[Yellowhaze]

Hello. This is my first time using this site. I am experiencing an annoying problem with my Mac OS X Leopard computer. About 50% of the time, I receive a Windows internet security warning window. I do not run Windows on my system, only a MS Office for Mac program. The window says the following:

"Your browser is under the threat of infection. Windows requires your permission to install online protection tool." This text displays in a yellow section of the window. In smaller print, the warning window goes on to say: "Your browser is run in unsafe mode. Running the protection mode will help you to keep your computer safe..."

My browser is Safari. I also have Mozilla installed. I do not have any anti-virus, malware, spyware, or other programs installed. I also have not installed any new software (that I can remember) since this problem occurred about 4 weeks ago. Your help is appreciated. Thank you. Steve

Ah, I now see the file upload button. Here is a screen shot of the warning...

Attached Thumbnails

• 

[Advertisements]

This is how most Windows Machines get Infected with the scare ware that is so prevalent these days. It looks like a microsoft warning so "I must Click it." Since Windows is the most used OS this attack could be effective on 90% of the PC's on the internet.

It's a script in the pages code that launches the fake security warning. Most of them it doesn't matter which action the user chooses it is going to install it's payload. The Windows machine is now infected and its user is in for the pop up h3ll that will follow until they can clean the machine.

Very few of these attacks will work on other OS platforms. I've seen them on my Linux boxes from time to time and they make me smile. It's the social engineering of today. "Everybody knows Windows is insecure so any warning must be true." It's in the news all the time so the general public will believe the fake warnings.

[silverbeard]

This is how most Windows Machines get Infected with the scare ware that is so prevalent these days. It looks like a microsoft warning so "I must Click it." Since Windows is the most used OS this attack could be effective on 90% of the PC's on the internet.

It's a script in the pages code that launches the fake security warning. Most of them it doesn't matter which action the user chooses it is going to install it's payload. The Windows machine is now infected and its user is in for the pop up h3ll that will follow until they can clean the machine.

Very few of these attacks will work on other OS platforms. I've seen them on my Linux boxes from time to time and they make me smile. It's the social engineering of today. "Everybody knows Windows is insecure so any warning must be true." It's in the news all the time so the general public will believe the fake warnings.

[Yellowhaze]

OK, thanks for identifying what it is. So,
how do I get rid of it?

[k_ny]

The same thing happening to me two 2-3 weeks ago. The most annoyed message ever.
It happens even when I'm open the browser for preview web page ( dreamweaver)
My Internet has become very slow especially with firefox. I have done many researches the last 2 weeks but nobody knows how to remove that.

Any help how to remove it?
I have Power Mac G5 10.5.8

[silverbeard]

The only thing I've seen is MacScan. It seems to be free.

[fisheromacs]

It would appear to me to be a pop-up window, either Java or Javascript based, most likely. It is VERY unlikely to be an app running on the local machine.

[Yellowhaze]

Thanks Geeks-to-go for your help and to those who commented. I downloaded MacScan and ran the full scan option. It only found some tracking cookies which I isolated. However, it did not eliminate the darned Windows security warning from appearing now and then. I always enable Safari's pop-up blocker feature, so that is not preventing this annoying item either. Any other suggestions or options?

Thanks. Steve

[Matthew C. Miller]

If it is running from the specific websites in question there isn't anything you can do except block pop-ups for that site. I agree with fisheromacs that it is extremely unlikely to be anything on your Mac. These are targeted at Windows users, as you can see from the design of the window (designed to look like Windows chrome, not Mac) and you can identify it as a scam because of the bad grammar in the text portion. It sounds like

• The pop-up is bypassing whatever detection Safari uses
• Block pop-up isn't actually turned on, whatever Safari is telling you , or
• The specific site has been excluded from pop-up blocking.

I don't know of any way to get a specific site un-excluded in Safari - there's no preference panel setting for that or anything. However, although annoying, this pop-up doesn't appear to be anything to be concerned about from a security standpoint.

Edited by Matthew C. Miller, 10 May 2010 - 12:17 PM.