Last updated

Scareware is a form of malware which uses social engineering to cause shock, anxiety, or the perception of a threat in order to manipulate users into buying unwanted software. Scareware is part of a class of malicious software that includes rogue security software, ransomware and other scam software that tricks users into believing their computer is infected with a virus, then suggests that they download and pay for reakantivirus software to remove it. [1] Usually the virus isn't real and the software is non-functional or malware itself. [2] According to the Anti-Phishing Working Group, the number of scareware packages in circulation rose from 2,850 to 9,287 in the second half of 2008. [3] In the first half of 2009, the APWG identified a 585% increase in scareware programs. [4]


The "scareware" label can also apply to any application or virus which is designed to instill victims with anxiety and/or panic.


NightMare was the first scareware ever created, developed by Patrick Evans in 1990, it is distributed on the Fish Disks for the Amiga computer (Fish #448).

Scam scareware

Internet security writers use the term "scareware" to describe software products that produce frivolous and alarming warnings or threat notices, most typically for not real or useless commercial firewall and registry cleaner software. This class of program tries to increase its perceived value by bombarding the user with constant warning messages that do not increase its effectiveness in any way. Software is packaged with a look and feel that mimics legitimate security software in order to deceive consumers. [5]

Some websites display pop-up advertisement windows or banners with text such as: "Your computer may be infected with harmful spyware programs. [6] Immediate removal may be required. To scan, click 'Yes' below." These websites can go as far as saying that a user's job, career, or marriage would be at risk. Products using advertisements such as these are often considered scareware. Serious scareware applications qualify as rogue software.

Some scareware is not affiliated with any other installed programs. A user can encounter a pop-up on a website indicating that their PC is infected. [7] In some scenarios, it is possible to become infected with scareware even if the user attempts to cancel the notification. These popups are specially designed to look like they come from the user's operating system when they are actually a webpage.

A 2010 study by Google found 11,000 domains hosting fake anti-virus software, accounting for 50% of all malware delivered via internet advertising. [8]

Starting on March 29, 2011, more than 1.5 million web sites around the world have been infected by the LizaMoon SQL injection attack spread by scareware. [9] [10]

Research by Google discovered that scareware was using some of its servers to check for internet connectivity. The data suggested that up to a million machines were infected with scareware. [11] The company has placed a warning in the search results of users whose computers appear to be infected.

Another example of scareware is Smart Fortress. This site scares people into thinking they have many viruses on their computer and asks them to buy the professional service. [12]


Dialog from SpySheriff, designed to scare users into installing the rogue software SpySheriffPopUp.png
Dialog from SpySheriff, designed to scare users into installing the rogue software

Some forms of spyware also qualify as scareware because they change the user's desktop background, install icons in the computer's notification area (under Microsoft Windows), and claiming that some kind of spyware has infected the user's computer and that the scareware application will help to remove the infection. In some cases, scareware trojans have replaced the desktop of the victim with large, yellow text reading "Warning! You have spyware!" or a box containing similar text, and have even forced the screensaver to change to "bugs" crawling across the screen. [13] Winwebsec is the term usually used to address the malware that attacks the users of Windows operating system and produces genuine claims similar to that of genuine anti-malware software. [14]

SpySheriff exemplifies spyware and scareware: it purports to remove spyware, but is actually a piece of spyware itself, often accompanying SmitFraud infections. [15] Other antispyware scareware may be promoted using a phishing scam.

Uninstallation of security software

Another approach is to trick users into uninstalling legitimate antivirus software, such as Microsoft Security Essentials, or disabling their firewall. [16] Since antivirus programs typically include protection against being tampered with or disabled by other software, scareware may use social engineering to convince the user to disable programs which would otherwise prevent the malware from working.

In 2005, Microsoft and Washington state successfully sued Secure Computer (makers of Spyware Cleaner) for $1 million over charges of using scareware pop-ups. [17] Washington's attorney general has also brought lawsuits against Securelink Networks, High Falls Media, and the makers of Quick Shield. [18]

In October 2008, Microsoft and the Washington attorney general filed a lawsuit against two Texas firms, Branch Software and Alpha Red, producers of the Registry Cleaner XP scareware. [19] The lawsuit alleges that the company sent incessant pop-ups resembling system warnings to consumers' personal computers stating "CRITICAL ERROR MESSAGE! - REGISTRY DAMAGED AND CORRUPTED", before instructing users to visit a web site to download Registry Cleaner XP at a cost of $39.95.

On December 2, 2008, the U.S. Federal Trade Commission ("FTC") filed a Complaint in federal court against Innovative Marketing, Inc., ByteHosting Internet Services, LLC, as well as individuals Sam Jain, Daniel Sundin, James Reno, Marc D’Souza, and Kristy Ross. The Complaint also listed Maurice D’Souza as a Relief Defendant, alleged that he held proceeds of wrongful conduct but not accusing him of violating any law. The FTC alleged that the other Defendants violated the FTC Act by deceptively marketing software, including WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus. According to the complaint, the Defendants falsely represented that scans of a consumer's computer showed that it had been compromised or infected and then offered to sell software to fix the alleged problems. [20] [21] [22]

Prank software

Another type of scareware involves software designed to literally scare the user through the use of unanticipated shocking images, sounds or video.

See also


  1. "Millions tricked by 'scareware'". BBC News. 2009-10-19. Retrieved 2009-10-20.
  2. 'Scareware' scams trick searchers. BBC News (2009-03-23). Retrieved on 2009-03-23.
  3. "Scareware scammers adopt cold call tactics". The Register. 2009-04-10. Retrieved 2009-04-12.
  4. Phishing Activity Trends Report: 1st Half 2009
  5. John Leydon (2009-10-20). "Scareware Mr Bigs enjoy 'low risk' crime bonanza". The Register. Retrieved 2009-10-21.
  6. Carine Febre (2014-10-20). "Real Warning Example". Carine Febre. Retrieved 2014-11-21.
  7. JM Hipolito (2009-06-04). "Air France Flight 447 Search Results Lead to Rogue Antivirus". Trend Micro . Retrieved 2009-06-06.
  8. Moheeb Abu Rajab and Luca Ballard (2010-04-13). "The Nocebo Effect on the Web: An Analysis of Real Anti-Virus Distribution" (PDF). Retrieved 2010-11-18.Cite journal requires |journal= (help)
  9. "Mass 'scareware' attack hits 1.5M websites, still spreading". On Deadline. April 1, 2011.
  10. "Malicious Web attack hits a million site addresses". April 1, 2011.
  11. "Google to Warn PC Virus Victims via Search Site". BBC News . 2011-07-21. Retrieved 2011-07-22.
  12. "Smart Fortress 2012". Kaspersky Lab Technical Support. February 29, 2012. Archived from the original on 2017-01-28.
  13. "bugs on the screen". Microsoft TechNet.
  14. Vincentas (11 July 2013). "Scareware in". Spyware Loop. Archived from the original on 8 November 2014. Retrieved 27 July 2013.
  15. filed under "Brave Sentry."
  17. Etengoff, Aharon (2008-09-29). "Washington and Microsoft target spammers". The Inquirer. Archived from the original on October 2, 2008. Retrieved 2008-10-04.CS1 maint: unfit URL (link)
  18. Tarun (2008-09-29). "Microsoft to sue scareware security vendors". Lunarsoft. Retrieved 2009-09-24. [...] the Washington attorney general (AG) [...] has also brought lawsuits against companies such as Securelink Networks and High Falls Media, and the makers of a product called QuickShield, all of whom were accused of marketing their products using deceptive techniques such as fake alert messages.
  19. "Fighting the scourge of scareware". BBC News. 2008-10-01. Retrieved 2008-10-02.
  20. "Win software". Federal Trade Commission.
  21. "Wanted by the FBI - SHAILESHKUMAR P. JAIN". FBI.
  22. "D'Souza Final Order" (PDF). Federal Trade Commission.
  23. Contents of disk #448. - see DISK 448.
  24. Dark Drive Prank

Further reading

Related Research Articles

Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the user during the installation process. The software may generate two types of revenue: one is for the display of the advertisement and another on a "pay-per-click" basis, if the user clicks on the advertisement. Some advertisements also act as spyware, collecting and reporting data about the user, to be sold or used for targeted advertising or user profiling. The software may implement advertisements in a variety of ways, including a static box display, a banner display, full screen, a video, pop-up ad or in some other form. All forms of advertising carry health, ethical, privacy and security risks for users.

Malware Portmanteau for malicious software

Malware is any software intentionally designed to cause damage to a computer, server, client, or computer network. A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper and scareware.

Spyware is software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user. For example, by violating their privacy or endangering their device's security. This behavior may be present in malware as well as in legitimate software. Websites may engage in spyware behaviors like web tracking. Hardware devices may also be affected. Spyware is frequently associated with advertising and involves many of the same issues. Because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.

Antivirus software Computer software to defend against malicious computer viruses

Antivirus software, or anti-virus software, also known as anti-malware, is a computer program used to prevent, detect, and remove malware.

Norton Internet Security, developed by Symantec Corporation, was a computer program that provided malware protection and removal during a subscription period. It used signatures and heuristics to identify viruses. Other features included a personal firewall, email spam filtering, and phishing protection. With the release of the 2015 line in summer 2014, Symantec officially retired Norton Internet Security after 14 years as the chief Norton product. It was superseded by Norton Security, a rechristened adaptation of the Norton 360 security suite.

A registry cleaner is a class of third-party utility software designed for the Microsoft Windows operating system, whose purpose is to remove redundant items from the Windows Registry.

WinFixer Rogue security software

WinFixer was a family of scareware rogue security programs developed by Winsoftware which claimed to repair computer system problems on Microsoft Windows computers if a user purchased the full version of the software. The software was mainly installed without the user's consent. McAfee claimed that "the primary function of the free version appears to be to alarm the user into paying for registration, at least partially based on false or erroneous detections." The program prompted the user to purchase a paid copy of the program.

AntiVirus Gold

AntiVirus Gold is rogue software developed by ICommerce Solutions S.A. that poses as a legitimate antivirus program. It attempts to persuade users to buy the software by displaying ads and other nagware. It is believed that the name of the program is an attempt at social engineering to confuse people about the legitimate program AVG Anti-Virus.

The Vundo Trojan is either a Trojan horse or a computer worm that is known to cause popups and advertising for rogue antispyware programs, and sporadically other misbehavior including performance degradation and denial of service with some websites including Google and Facebook. It also is used to deliver other malware to its host computers. Later versions include rootkits and ransomware.

Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on their computer. It is a form of scareware that manipulates users through fear, and a form of ransomware. Rogue security software has been a serious security threat in desktop computing since 2008. Two of the earliest examples to gain infamy were BraveSentry and SpySheriff.

SpySheriff Spyware

SpySheriff is malware that disguises itself as anti-spyware software. It attempts to mislead the user with false security alerts, threatening them into buying the program. Like other rogue antiviruses, after producing a list of false threats, it prompts the user to pay to remove them. The software is particularly difficult to remove, since it nests its components in System Restore folders, and also blocks some system management tools. However, SpySheriff can be removed by an experienced user, antivirus software, or by using a rescue disk.

The Zlob Trojan, identified by some antiviruses as Trojan.Zlob, is a Trojan horse which masquerades as a required video codec in the form of ActiveX. It was first detected in late 2005, but only started gaining attention in mid-2006.

Ultimate Defender is a rogue antivirus program published by Nous-Tech Solutions Ltd. The program is considered malware due to its difficult uninstallation and deceptive operation.

Computer virus Computer program that modifies other programs to replicate itself and spread

A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a computer virus.

MS Antivirus is a scareware rogue anti-virus which purports to remove virus infections found on a computer running Microsoft Windows. It attempts to scam the user into purchasing a "full version" of the software. The company and the individuals behind Bakasoftware operated under other different 'company' names, including Innovagest2000, Innovative Marketing Ukraine, Pandora Software, LocusSoftware, etc.

AV Security Suite is a piece of scareware and malware, or more specifically a piece of rogue security software, which poses as a pre-installed virus scanner on a victim's computer system. It is currently known to affect only Microsoft Windows systems, though may simply operate under a different name on other platforms to better fit in with their user-interfaces, as its disguise is a key component of its success. In the task manager it appears as a string a random characters that end with "tssd.exe" – an example is yvyvsggtssd.exe. It also can show a random string of characters that end with "shdw.exe".

Internet Security Essentials

Internet Security Essentials, also InternetSecurityEssentials, is rogue security software pretending to protect the computer against malware and viruses. It is one of several clones belonging to the "FakeVimes" family of fake antivirus malware.

Winwebsec is a category of malware that targets the users of Windows operating systems and produces fake claims as genuine anti-malware software, then demands payment to provide fixes to fictitious problems.

ByteDefender also known as ByteDefender Security 2010 is a scareware rogue malware application on Windows that masquerades as a legitimate antivirus program. It uses a false system scanner that produces large deposits of malware and it attempts to scare the users to purchase the full version of the rogue software for the removal of nonexistent and/or unnecessary spyware items. The name of this antispyware program is used to confuse the user looking for the legitimate Bitdefender before downloading the software.