X
Tap here to go to the mobile version of the site.

Support Forum

Report an issue to firefox

Posted

Someone is trying to scam your browser, this page pops up using several advertising windows in legit sites, thought you might like to investigate it, it says you need to upgrade Firefox,

https://ierairosihanari.org/8801281637044/0f0b6cf1aecfe432c462b4883e6b5c34.html

Someone is trying to scam your browser, this page pops up using several advertising windows in legit sites, thought you might like to investigate it, it says you need to upgrade Firefox, https://ierairosihanari.org/8801281637044/0f0b6cf1aecfe432c462b4883e6b5c34.html

Chosen solution

Hi Aulemar, thank you for the report. You're absolutely right that those are fake patches.

These malware distribution sites seem to be using coded links that can't be viewed by support volunteers (we get a blank page).

Can you figure out from your history which site that tab might have launched from? One theory is that it comes from a bad ad in a page but it would be helpful to "name names" (or paste links) to the sites that are causing it.

And if you have never installed any add-ons to block ads, you might want to consider one. These are popular (Note: you would only want to use one at a time):

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • ActiveTouch General Plugin Container Version 105
  • Adobe PDF Plug-In For Firefox and Netscape 10.1.16
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.66.2 for Mozilla browsers
  • CANON iMAGE GATEWAY Mycamera Plugin
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Shockwave Flash 21.0 r0
  • Unity Player 5.0.3f2
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0

More Information

jscher2000
  • Top 10 Contributor
8837 solutions 72222 answers

Chosen Solution

Hi Aulemar, thank you for the report. You're absolutely right that those are fake patches.

These malware distribution sites seem to be using coded links that can't be viewed by support volunteers (we get a blank page).

Can you figure out from your history which site that tab might have launched from? One theory is that it comes from a bad ad in a page but it would be helpful to "name names" (or paste links) to the sites that are causing it.

And if you have never installed any add-ons to block ads, you might want to consider one. These are popular (Note: you would only want to use one at a time):

Hi Aulemar, thank you for the report. You're absolutely right that those are fake patches. These malware distribution sites seem to be using coded links that can't be viewed by support volunteers (we get a blank page). Can you figure out from your history which site that tab might have launched from? One theory is that it comes from a bad ad in a page but it would be helpful to "name names" (or paste links) to the sites that are causing it. And if you have never installed any add-ons to block ads, you might want to consider one. These are popular (Note: you would only want to use one at a time): * https://addons.mozilla.org/firefox/addon/adblock-plus/ * https://addons.mozilla.org/firefox/addon/ublock-origin/
Gus50310 0 solutions 8 answers

This seems to be another site along the same thing

https://ohchukentvideo.org/6451067054713/f06a0a773d6ee171675eafcd7df55bff.html

This seems to be another site along the same thing https://ohchukentvideo.org/6451067054713/f06a0a773d6ee171675eafcd7df55bff.html
the-edmeister
  • Top 25 Contributor
  • Moderator
5419 solutions 40428 answers

We are seeing one or two new sites like that are coming almost everyday. Like playing "whack a mole" when trying to shut crap like that down!

We are seeing one or two new sites like that are coming almost everyday. Like playing "whack a mole" when trying to shut crap like that down!
John99 971 solutions 13138 answers

What would be useful is tracking down the ads that may be behind this. jscher2000 #answer-895204 suggested looking for your History for clues. (Thee could be some delay between visiting a site and any ad or popup appearing).

Anyone able to reliably reproduce the situation where these ads or popups are seen ? (Other than clicking on a direct personalised link such as https://ierairosihanari.org/8801281637044/0f0b6cf1aecfe432c462b4883e6b5c34.html )

If you do find an ad then please follow these instructions. A lot of posts seem to suggest these just pop up the orange screens. If you could just confirm what site these originate from it will help. personally I have tried the newsites etc mentioned but have not yet seen this myself.

{#c16}If ... affected users) could tell us what the ad URLs are, that would be helpful.
They would need to right-click on the ad image, choose "This Frame -> View Frame Info", and copy/paste the following info:
General tab: Address (URL)
Media tab: Location (URL) of each item in the list of media in that frame.
This will help us isolate the affected ad networks so we can contact them and inform them of the malware.
Thanks!

If you see the orange splash screen Do NOT run, open, or click on any downloaded file. Please use keyboard Shortcut Ctrl + U to display the source code of the Orange Splash Screen. Please then save that. It may possibly hold some clues. if you are able to find steps to reproduce the display of this page other than using its link please let us know. I am not aware that anyone trying to study this has actually been able to see one of these orange screens recently.

Anyone who has run the downloaded fake update please post for instructions on what to do, you may have malware including the dangerous fileless kovter trojan.

What would be useful is tracking down the ads that may be behind this. jscher2000 [[#answer-895204]] suggested looking for your History for clues. (Thee could be some delay between visiting a site and any ad or popup appearing). Anyone able to reliably reproduce the situation where these ads or popups are seen ? (Other than clicking on a direct personalised link such as https://ierairosihanari.org/8801281637044/0f0b6cf1aecfe432c462b4883e6b5c34.html ) '''If you do find an ad then please follow these instructions.''' A lot of posts seem to suggest these just pop up the orange screens. If you could just confirm what site these originate from it will help. personally I have tried the newsites etc mentioned but have not yet seen this myself. <blockquote> {[https://bugzilla.mozilla.org/show_bug.cgi?id=1282106#c16 #c16]}If ... affected users) could tell us what the ad URLs are, that would be helpful. <br/> They would need to right-click on the ad image, choose "This Frame -> View Frame Info", and copy/paste the following info: <br/>General tab: Address (URL) <br/>Media tab: Location (URL) of each item in the list of media in that frame.<br/>This will help us isolate the affected ad networks so we can contact them and inform them of the malware. <br/>Thanks!</blockquote> '''If you see the orange splash screen''' Do NOT run, open, or click on any downloaded file. Please use keyboard Shortcut ''Ctrl + U'' to display the source code of the Orange Splash Screen. Please then save that. It may possibly hold some clues. if you are able to find steps to reproduce the display of this page other than using its link please let us know. I am not aware that anyone trying to study this has actually been able to see one of these orange screens recently. Anyone who has run the downloaded fake update please post for instructions on what to do, you may have malware including the dangerous fileless kovter trojan.