SOMIS News & Updates:

Zimbra users may use the webmail site (Zimbra - log in with your PennKey) with full functionality. We expect to have restored all clients including mobile phones by tomorrow morning.
Many machines at the School of Medicine have been compromised by a new type of virus that presents itself as an actual anti-virus product while a user is browsing the internet. If you experience anything remotely similar to this virus description, or are concerned about any suspicious activity on your computer, please contact your LSP immediately. For more information, please visit the following link.
Zimbra users are reporting an increase in spear-phishing attempts. Penn computer administrators will NEVER ask you for your password at any time via any medium. For more information about phishing, please see the following link.

Home > Services > Information Security > Alerts & News > Fake Anti-Virus

Fake Anti-Virus

Computers infected with fake anti-virus applications are being seen with increasing regularity on campus. Machines are infected when users are presented with a pop-up that seems to indicate that the computer is infected with viruses, and they are asked to install an application to fix the problem. This scare tactic is common with this scenario, and can look like a legitimate application as seen in the screen shot below:

Fake Anti-Virus image

Once installed, these applications can be difficult to get rid of, often resulting in needing to re-image your computer.

What to do

If you are presented with a fake anti-virus installation pop-up window, DO NOT CLICK ANYWHERE IN THE DIALOG BOX. Instead, force quit the browser by doing the following:

Press Ctrl-Alt-Del to bring up the Windows Security window
Click on Task Manager
Make sure that you are in the Applications Tab
Click on the browser you have open, and click End Task

This will quit your browser application and prevent the fake anti-virus application from installing on your computer.

Immediately reboot your computer, and perform a full scan with a fully updated Symantec Endpoint Protection (SEP). Anytime you suspect that your machine may have been compromised, it is a good idea to run a full scan.

If you have any problems launching or updating SEP, or running a system scan, contact your computer support person for assistance.

Questions or concerns? Email medsecurity@mail.med.upenn.edu