“Your system is heavily damaged by (4) virus!” – fake alert used to spread malware

“Your system is heavily damaged by (4) virus!” is a social engineering attack know as bait or tech support scam[1]. Its developers use multiple psychological strategies to create the feeling of immediacy, the risk of a fatal system crash, and fear of personal data loss.
To protect the system from possible consequences, the victim is asked to purchase the PC Smart Cleanup utility, which is nothing else but malware. In the middle of March 2018, a new version of this dangerous infection has been spotted circulating around. Dubbed as Four Virus, this potentially malicious infection is considered to become as widespread as the Android and iPhone viruses.
According to people's reports, a target for both Four virus and “Your system is heavily damaged by (4) virus!” versions are iPhone, Android, and iPad users. The tablet and smartphone users may get another variant, stating that your battery is badly damaged by 4 virus.
| name | Your system is heavily damaged by (4) virus! |
|---|---|
| Type | Adware, PUP, tech support scam |
| Purpose | Convince people to download a rogue tool that shows fake scan results trying to persuade you into purchasing its worthless paid version |
| Risks | PUP installation, malware infections, financial losses, privacy issues |
| Distribution | Software bundles, fake Flash Player updates, file-sharing platforms, deceptive ads |
| Removal | Scan your device with the FortectIntego system tool to remove adware and tracking cookies |
Nonetheless, comparing this scam with other samples of the online felony, it does not manifest any extraordinary behavior or features. On the other hand, there is a distinguishable feature. Unlike the majority of tech support scams which alert users with Zeus virus, for instance, Your computer has been infected with Zeus virus and threatens that your Facebook login and email account information is about to be stolen, this sample of the tech support scam behaves a bit differently.
It says that your computer is heavily damaged by four virus. However, it is unknown whether the “four” indicates the malware's name or the number of viruses supposedly detected on the system. Furthermore, this tech support scam sample advised you to acquire technical support not by dialing a specific number but by installing a program called PCSmartCleanup. Here's where the problem lies.
The Four virus is not only intrusive as it locks the web browser completely but can expose the system to potentially unwanted programs (PUPs). The pretend-to-be legitimate PCSmartCleanup utility has been condemned for questionable behavior, such as the usage of cookies, delivery of predetermined scan results, and ongoing proposals to purchase the Advanced or Licensed version. Thus, it is not recommended to install it or if you already did, remove it. Speaking of the scam, ignore it and close the tab.
If you got redirected to its counterpart — “Your Computer is heavily damaged! (33.2%)” scam – you should not comply with the demands either. If you cannot exit the page, shut it down via the Task Manager. In addition, it is recommended to scan the device and remove “Your system is heavily damaged by (4) virus!” web elements. You can do so with the assistance of FortectIntego.

Tech support scams are carried out via freeware bundles
Browser-based tech support scams are often hidden in the form of web scripts. You are most likely to get redirected to the article's culprit scam site after you click on the play button in an illegal movie streaming or gaming site, click on deceptive as, etc. Speaking of PC-based tech support scams, you might encounter it if you install a corrupted application or browser extension[2].
Therefore, it is of utmost importance to pay attention to the installation of any new software, especially if you downloaded it from a third-party vendor. Always choose the Advanced/Custom installation modes over the Recommended/Standard/Quick ones. Only then will you be able to deselect all additional, untrustworthy, questionable applications from installing on your device.
Get rid of “Your system is heavily damaged by (4) virus!” hoax
All browser-based scams can be terminated by closing the tab or the browser. If you get regularly redirected to such a site, it is necessary to clean your browser and device from adware or other PUPs. You can do so by scanning the device with a malware elimination tool. It will also come in handy dealing with PC-based tech support scams.
In order to cease “Your system is heavily damaged by (4) virus!” ads and pop-up alerts, it is also recommended to reset your affected browser. For your convenience, detailed instructions for doing that are posted below this article.
All, not only UK[3] users should be wary of the scam as the browser scam might pop up in miscellaneous web pages. After you remove virus elements with an anti-spyware tool, you should check the manual guidelines as well and run system diagnostics to ensure a stable working environment.
Uninstall from Windows
Uninstall from Windows 10/8:
- Type Control Panel into the Windows search box and open the result.
- Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:
- Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:
- In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
- If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.

- Finally, empty the Trash to permanently remove the leftovers.
Remove from Microsoft Edge
Delete unwanted extensions from MS Edge:
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click Remove.

Clear cookies and other browser data:
- Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
- Under Clear browsing data, pick Choose what to clear.
- Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:
- Click the menu icon and choose Settings.
- Then find On startup section.
- Click Remove next to any suspicious startup page.
Reset MS Edge if the above steps did not work:
- Press on Ctrl + Shift + Esc to open Task Manager.
- Click on More details arrow at the bottom of the window.
- Select Details tab.
- Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge
Delete extensions from MS Edge (Chromium):
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.

Clear cache and site data:
- Click on Menu and go to Settings.
- Select Privacy, search and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.

Reset Chromium-based MS Edge:
- Click on Menu and select Settings.
- On the left side, pick Reset settings.
- Select Restore settings to their default values.
- Confirm with Reset.
- This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.

Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.

- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.

Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.

Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.

Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.

Did this guide help?
Be the first to comment