Why do I get prompted once a day to install a Firefox update?
Starting around the beginning of this month (July) I get prompted once a day or so to update Firefox. Each day is a different link, I know it isn't Firefox actually trying to update. I've seen many other people voicing the same concerns. I've run Malwarebytes and Windows Defender and they haven't found anything. The first time this popped up earlier this month, Windows Defender activated saying it had blocked malware: trojan/kovner if I remember correctly. It doesn't matter what site I'm on, usually just browsing Reddit non external links. Once a day. I took a screenshot of the site of the day (July 13th around 3am) early this morning and will add it to the post.
Tutte le risposte (3)
Here is the screenshot
This is a scam, trying to give you malware. Do not run any download it offers.
Windows Defender is correct in blocking it.
Try browsing with an adblocker add-on like ublock Origin, that could keep it away. If it keeps popping up even with an adblocker, please report it.
As you say this is malware. Do not run or open the file.
We are trying to find our more about this. The trojan could be particularly dangerous and possibly able to reside in the memory and registry without using files, that makes it dificult to detect and remove.
There are two things you could do.
- First just in case you are infected with this malware use a specific removal tool.
- Second if you would like to help us see if you can catch the actual advert and its details. (The orange splash screen in a full page of its own does not help as the malware keeps changing the site it uses for that)
Note the removal tool will tell you if you if it does not find anything. If it does find something it will generate a log file. It would be interesting to see the content of the log file if one is generated. It is probably safer and good policy not to use an Admin account for day to day computer work and ordinary Browsing, however note you do need to run the removal tool from an Admin account.
- Notes & tool link: "Symantec Official Blog Kovter malware learns from Poweliks with persistent fileless registry update" http://www.symantec.com/connect/blogs/kovter-malware-learns-poweliks-persistent-fileless-registry-update
- Instructions for Trojan.Kotver Removal Tool https://www.symantec.com/security_response/writeup.jsp?docid=2015-092321-2230-99
- https://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixToolKotver64.exe https://www.symantec.com/content/en/us/enterprise/media/security_response/tools/FixToolKotver32.exe
- I have deliberately broken those links as it is against forum policy to post links to executables ln the forum. Please use the link in the Instructions page, OR copy and paste the address into your addressbar
These are the instructions for catching the ad information
{#c16}If ... affected users) could tell us what the ad URLs are, that would be helpful.
They would need to right-click on the ad image, choose "This Frame -> View Frame Info", and copy/paste the following info:
General tab: Address (URL)
Media tab: Location (URL) of each item in the list of media in that frame.
This will help us isolate the affected ad networks so we can contact them and inform them of the malware.
Thanks!