Does virus/spyware writer follow convention?

Recently, I had a chance to use an un-protected machine to surf the web. From time to time, pop-ups appear on my screen (even though I'm using firefox with popup blocker) with warnings such as "10 spywares are running on your machine, click to clean them", or "do you want to clean them?" I either clicked on "No", or the "close window" icon on the top-right corner of the window or whatever option that has the meaning of turning down their offer.

But as I was doing that, it seems to me that the virus/spyware writers can easily fool me by making all the choices lead to the same result: download virus/spyware. Does anyone know whether that's really the case? Do virus/spyware writers follow the conventions that normal programs follow?