BleepingComputer.com: Foistware

This thread will illustrate what happens when you go to a malicious website that won't let you leave without downloading their program. Its very hard to get away from once you go there. It will also discuss what to do when this happens and how to get out of the situation without getting any unwanted malware related programs installed on your computer without your consent or knowledge.

Please be aware that these are only screenshots and nothing will happen to your computer. They are not clickable. The following is based on using Internet Explorer and concerns a feature called "Install on demand". There are instructions at the end of the post for disabling this feature

So you click on a link for an anti-spyware program or maybe its a popup or a link in your email and you are taken to a website like this:





If you don't have Install on demand disabled and you use Internet Explorer you are already the unwitting recipient of the following download. It has been downloaded and installed on your computer. You are infected with malware now. This is known as a "Drive By Download".




If you do have Install on demand disabled you receive the above security warning and you would think that you are ok. You click No. You try to navigate away from the site, but wait, what this?




No, no, no, You don't want to do this. You click cancel. Now you get this:





Now what are you going to do? I don't believe that if you clicked Ok on that box that you would have the option of Run or Open, which implies a Cancel option too. I think the download may start right away.

Its important not to panic or to get frustrated and click Ok just to make the boxes go away. Personally, I chickened out at this point. If you were using a ZoneAlarm Firewall or any other type that has an Internet Lock this would be the ideal time to use it. In order to get out of this you need to close the browser using the Task Manager/Close Programs feature accessed by using Ctrl+Alt+Delete and closing the page. The second time I went to this site when I forced the window to close I got a blue screen.

If I get brave I'll go back and click Ok on that last one.

In Firefox, you can disable the automatic install feature this way:

"tools tab", under "tools, options, web features", the
default setting is "Allow websites to install software". Uncheck that.

Thanks to our jgweed for that info.

In Internet Explorer go to Tools>Internet Options>Advanced and take the check mark from Enable Install On Demand (Internet Explorer) and Enable Install On Demand (Other). The consequence of this will be that you will begin to see Security Warnings when something tries to install on your computer. Unless it is something you want to install (which happens rarely) always say no.

Many thanks to Pandy for all her hard work on the screenshots in this post and her timely advice.

Leurgy. It was my distinct pleasure to assist you.

Very informative posts and a great job on the research. This is a great example on how our members can see how malware/foistware/adware can get installed on their computers and how to avoid it.

Kudos!

Excellent write up. Well done.


UKBiker

As a newbie..i have just read this item and it was so easy for a non-puter savvy person like myself to understand.....thankyou pandy and Leurgy!

Your fans over at CoU will see this link

A great wtite up as you know I got hammered by one of those a few days ago. I hope every body reads the aticle. Because these sites can be monsters.. Thanks for all the work.....

Oh Haroldo Thank you so much for the link there at CoU. That's awesome!

Great advice! Very helpful in protecting yourself, regardless if you use Firefox or IE.

Personally I leave the "Allow Websites to Install Software." Checked, however I have only Mozilla's Official Firefox Extension website under the "allow list."

Very helpful for users and a good read.

Thanks for the info. I actually just accidentally visited one of these sites. I had misspelled a popular antivirus web site's URL and got the bad web site instead.

Sneaky little devils, ain't they!

Thanks for the tip! I hate those sites. It's one of the reasons I switched to Mozilla.

Thanks for the tips, always appreciated guys.

Leurgy and Pandy,

It is my distinct pleasure to utilize my 100th post to, congratulate you both on an excellent job on this topic. It's very well written and illustrated. And long overdue to have this "Bleeping" subject addressed. Keep up the great work you two.

Be (Foistware) Safe

Da Animal

Animal Thank you