What Is a Drive-by Download Attack and How to Avoid It

A drive-by download is malware that reaches your computer from a web page you visit, either without you doing anything, by exploiting a security flaw, or by tricking you into a download that looks harmless.

Two kinds

• Silent exploits: a hacked page or a malicious ad uses a flaw in your browser or system to run code. These were common in the era of Flash and Java plugins, and are much rarer now that browsers update automatically, but they still happen with unpatched flaws.
• Tricked downloads: the far more common kind today. A page says your browser is out of date, a video needs a codec, or a file is ready, and the "update" is malware.

How they reach you

• Hacked websites, often small, trusted sites with outdated software.
• Malicious ads on otherwise legitimate sites, known as malvertising.
• Search results and ads for popular software that lead to fake download pages.
• Fake update pop-ups. See fake Chrome update popups.

How to avoid them

1. Keep everything updated. Restart Chrome when it shows the Update button, and install system updates promptly.
2. Turn on Enhanced protection: Settings → Privacy and security → Security. Chrome checks downloads and sites more thoroughly.
3. Download software only from the official site, and type its address rather than clicking ads.
4. Don't open unexpected downloads. If a file appears that you didn't ask for, delete it.
5. Remove software you don't use, especially old plugins and readers, since every program is something to keep patched.
6. Block ads on untrusted sites, which cuts off malvertising.
7. Keep Windows Security or your antivirus on, and let Windows SmartScreen or macOS Gatekeeper warn you about unknown apps.

Signs something got through

• New programs, toolbars or extensions you didn't install.
• Your browser's search engine or homepage changed. See signs Chrome was hijacked.
• Security warnings, a much slower computer, or unknown sign-in alerts from your accounts.

If you think you're infected

1. Disconnect from the internet.
2. Run a full scan with your antivirus.
3. From a clean device, change important passwords and sign out other sessions.
4. If in doubt, get professional help or reinstall the system.

More protection

See how to download files safely. Clipboard Guard covers a different risk: it stops pages from reading your clipboard. It doesn't block downloads, so the steps above still matter.