Does Antivirus2009 or Antivirus360 automatically install on your computer and if so how?

Question

I run Firefox on Vista, and unfortunately I got tricked (through a deceptive google result) into going to a page containing one of those fake "Your Computer Has all of this Spyware on it!" pages. I tried manually closing the tab, but it had a "Are you sure you want to navigate away" JavaScript alerts (HATE THOSE). So I clicked "OK," and the tab closed. Then I closed Firefox altogether and rebooted.

Now, before I could close the tab, it did prompt me to download a file, but of course I choose not to, and checking my downloads folder, nothing new is there. Also, even if I ?did? download it, ?I? would still have to choose to run it by double clicking on it for it to install itself, right? Also, I ran Malware Bites and Windows Defender and both said everything was fine.

From this I would normally believe I am safe, but I have read everywhere that this thing "automatically installs" itself and that it is difficult to get rid of. Is it really possible for this thing to dig in if you are running Firefox and didn't choose to download it or run it after downloading?

Answer 1

The only way a piece of software can silently install itself through a web-browser is by exploiting a security hole in the browser itself. The only cases of AV2009 I've seen were accompanied by an IE-user, so I assume that file dialogue was firefox not breaking, and still keeping you safe. Close one!

However, probably best to run a scan with your AV of choice, just in case, because nothing is infallible. If it indeed did get through - don't worry, you'll find out soon enough. This is not quiet or subtle malware, this is in-your-face "Give me money or I'm never going away" malware.

Lifehacker ran a story on how to remove something similar, just in case.

Answer 2

It should only be able to install itself by using some sort of security hole.
My guess is that you update Firefox whenever there are updates; right? If yes, you can quite safely assume that it hasn't installed itself on your machine.

For the future you might want to have a look at the NoScript extension. It's targeted at advanced users but is generally a big security improvement. It would also have spared you those annoying JavaScript popups.

Answer 3

Is it really possible for this thing to dig in if you are running firefox

Yes, either through Firefox security hole exploits (if you haven't been letting it update itself) or — far more likely — through browser plugin security holes that can be exploited in any web browser. Ensure all plugins you have are up-to-date, and uninstall/disable any (Java, Windows Media Player, QuickTime, RealPlayer, PDF Reader, Silverlight, Office Web Components, and so on) that you aren't sure you definitely need.

The Adobe Reader PDF plugin is responsible for a large proportion of the exploits currently loading the fake-AVs. It is especially bad because it installs a plugin (that doesn't update itself) without telling you it is doing so, so many users have no idea they have a vulnerable browser plugin.

I ran Malware Bites and Windows Defender and both said everything was fine.

I wouldn't necessarily trust AV tools to detect (and certainly not remove!) today's trojans. But this does tend to back up the lack of any evidence that anything has installed.