Scareware comprises several classes of scam software, often with limited or no benefit, sold to consumers via certain unethical marketing practices. The selling approach is designed to cause shock, anxiety, or the perception of a threat, generally directed at an unsuspecting user. Some forms of spyware and adware also use scareware tactics.
A tactic frequently used by criminals involves convincing users that a virus has infected their computer, then suggesting that they download (and pay for) antivirus software to remove it. Usually the virus is entirely fictional and the software is non-functional or malware itself. According to the Anti-Phishing Working Group, the number of scareware packages in circulation rose from 2,850 to 9,287 in the second half of 2008. In the first half of 2009, the APWG identified a 583% increase in scareware programs.
The "scareware" label can also apply to any application or virus (not necessarily sold as above) which pranks users with intent to cause anxiety or panic.
Internet Security bloggers/writers also use the term "scareware" to describe software products that — while serving some desired purpose — also produce a lot of frivolous and alarming warnings or threat notices, most typically commercial firewall and registry cleaner software. This class of program tries to increase its perceived value by bombarding the user with constant warning messages that do not increase its effectiveness in any way. Software is packaged with a look and feel that mimics legitimate security software in order to deceive consumers.
Some websites display pop-up advertisement windows or banners with text such as: "Your computer may be infected with harmful spyware programs. Immediate removal may be required. To scan, click 'Yes' below." These websites can go as far as saying that a user's job, career, or marriage would be at risk. Products using advertisements such as these are often considered scareware. Serious scareware applications qualify as rogue software.
In recent findings some scareware is not affiliated with any other installed programs. A user can encounter a pop-up on a website indicating that their PC is infected. In some scenarios it is possible to become infected with scareware even if the user attempts to cancel the notification. These popups are especially designed to look like they come from the user's operating system when they are actually a webpage.
In 2005, Microsoft and Washington state successfully sued Secure Computer (makers of Spyware Cleaner) for $1 million over charges of using scareware pop-ups. Washington's attorney general has also brought lawsuits against Securelink Networks, High Falls Media and the makers of Quick Shield.
In October 2008, Microsoft and the Washington attorney general filed a lawsuit against two Texas firms, Branch Software and Alpha Red, producers of the Registry Cleaner XP scareware. The lawsuit alleges that the company sent incessant pop-ups resembling system warnings to consumers' personal computers stating "CRITICAL ERROR MESSAGE! - REGISTRY DAMAGED AND CORRUPTED", before instructing users to visit a web site to download Registry Cleaner XP at a cost of $39.95.
On June 25, 2009, the Federal Trade Commission in the United States reached a settlement with two defendants in a case involving a massive “scareware” scheme. The two defendants settled charges of deceptive advertising and forfeited more than $100,000 in assets. According to the Federal Trade Commission, the two settling defendants were part of a massive deceptive advertising scheme that tricked more than a million consumers into buying “rogue” computer security products, including WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus. The scheme allegedly relied on deceptive advertisements featuring bogus computer “scans” that falsely claimed to detect viruses, spyware, and illegal pornography on consumers’ computers. The settlement imposed a judgment of nearly $1.9 million against the two Cincinnati-based defendants, James Reno and ByteHosting Internet Services, LLC. This amount represents the gross revenues these two settling defendants realized from the alleged scam. The settlement prohibits James Reno and ByteHosting from using deceptive “scareware” advertising tactics and from installing malicious programs on consumers’ computers. The settlement also permanently bars Reno and ByteHosting from ever again doing business with their co-defendants. The settlement does not affect the FTC’s ongoing case against the remaining defendants in the suit.
According to the complaint, the two companies charged in the case – Innovative Marketing, Inc. and ByteHosting Internet Services, LLC – operate using a variety of aliases and maintain offices in various countries. Innovative Marketing, incorporated as a company in Belize, maintains offices in Kiev, Ukraine. ByteHosting Internet Services is based in Cincinnati, Ohio. The complaint alleges that these two companies, along with individuals Daniel Sundin, Sam Jain, Marc D’Souza, Kristy Ross, and James Reno, violated the FTC Act by misrepresenting that they conducted scans of consumers’ computers and detected a variety of security or privacy issues, including viruses, spyware, system errors, and pornography. The complaint also names a sixth individual, Maurice D’Souza, as a relief defendant who received proceeds from the scheme.
Some forms of spyware also qualify as scareware because they change the user's desktop background, install icons in the computer's system tray (under Microsoft Windows), and generally make a nuisance of themselves, claiming that some kind of spyware has infected the user's computer and that the scareware application will help to remove the infection. In some cases, scareware trojans have replaced the desktop of the victim with large, yellow text reading "Warning! You have spyware!", and have even forced the screensaver to change to "bugs" crawling across the screen.
Another type of scareware involves software designed to literally scare the user through the use of unanticipated shocking images, sounds or video.
The first program of this type is generally credited to be "NightMare", a program distributed on the Fish Disks for the Amiga computer (Fish #448) in 1991. When NightMare executes, it lies dormant for an extended (and random) period of time, finally changing the entire screen of the computer to an image of a skull while playing a horrifying shriek on the audio channels.
Anxiety-based scareware puts users in situations where there is no positive outcome. For example, a small program can present a dialog box saying "Erase everything on hard drive?" with two buttons, labeled "OK" and "OK". Regardless of which button is chosen, nothing is destroyed other than the user's composure.