3

I've gotten, over the past couple of weeks, at least three screens popping up saying "Urgent Firefox Update". These are from URL https://eexowdlzyjx.net/. At least once they have been preceded by "request to load" security popups from unknown (and equally obscure) URLs. All this while browsing the BBC news site.

Am I correct in assuming that these are bogus?

I'm running Mozilla Firefox, version 47.0, and I have Flashblock 1.5.20 installed. My AV software is Norton Internet Security version 22.6.0.142.

Update 7/23/2016:

For some reason today Norton "caught" this, since right after the bogus screens popped up it came up with a warning that it had stopped a virus. It labels it pf06aivz.js.part and calls it a "JS.Downloader".

The bogus screens came up just after I closed a BBC screen, and the bogus web screen loaded over ("pushed down") a CNN screen. Not sure what that suggests.

  • 2
    Yes, you shouldn't believe this pop up, and scan your computer, you must have a virus. – Damien Jul 6 '16 at 11:32
  • 6
    @Damien "you must have a virus" - are you sure? maybe a hacked ad-server? – DaniEll Jul 6 '16 at 11:43
  • Indeed, I'm not sure, but it'd be better to scan the computer than do nothing – Damien Jul 6 '16 at 11:45
  • 2
    @Damien - I take it as being some sort of malicious advert that is being loaded by a "legitimate" page. A bit disturbing that this happens off of BBC, but I suppose it's hard for them to police thousands of ads. (I have Norton installed, and it scans daily.) – Hot Licks Jul 6 '16 at 11:52
  • They could be opened by some other page that you have open in the background as well in another tab or window. – Anders Jul 6 '16 at 12:21
4

Always, always use ad-blockers. Browsing the web without an ad-blocker is like sex without a condom. Always use one unless you are 100% sure the site you are browsing has malware-free ads.

I would refrain from clicking on any pop-up, especially in this case, as Firefox auto-updates in the background and requires no user input, unless a browser restart is required.

2

When I get it, it's not a pop-up, the page I'm at is replaced by the "Urgent Firefox Update" page and then it immediately tries to download firefox-patch.exe. This has happened to me twice, once I was on eBay and the other time I was on a random local news website. FWIW, I have Flash set to ask permission before loading, so it's not a flash ad doing it. But I do believe it must be an ad somehow calling this malicious website because the only action on my part is possibly scrolling. I'm running AVG with the latest definitions and it doesn't find anything.

enter image description here

  • Yep, this describes what I see. The screen looks pretty convincing -- I'm sure many people fall for it. – Hot Licks Jul 10 '16 at 1:26
  • (Do you recall what sites you were browsing when it occurred?) – Hot Licks Jul 10 '16 at 1:27
1

Scan your computer. Check your host file for weird entries. I have the habit of using a non-admin windows account and whenever a program wishes to make changes or launch, it will prompt for my admin credentials. This will mitigate any unknown changes from malware. Currently using WebRoot security program because it has a feature of blocking known malicious IP from connecting to your OS.

Always type in the URL if you know rather than clicking on a given link or pop up. You can use your browsers/programs update button to check for legit updates.

Store your data on a separate hard disk away from your system disk if you can. Backup your data regularly, I use a NAS to sync data from my computer like how Dropbox does. So, I will always have two copies of my data.

Also, do not trust these Green Locks or HTTPS seen on your browser easily. It's not difficult to get a certificate or to make a self-signed certificate looks legit (although this method needs an attacker to install a trust cert into your browser first)

0

Probably a malware or an advertisement popup. Scan your computer and block popups from unwanted websites.

protected by Community Jul 20 '16 at 17:58

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.