0

Related to this question: Is This A Hack/Malware/Breach?

Date: Noticed between 5/23-5/24/2018

OS: Windows 10

Applies to: Windows 10 version 1709 for x64-based Systems

Browser: Microsoft Edge 41.16299.402.0, Microsoft EdgeHTML 16.16299

A download pop up appears on KCRG.com (and other sites) asking to download mapuser?providerid=29472userid=

From: usync.nexage.com

Downloads: Two files downloaded when saved. I did it twice. Both appear empty when opened with notepad.

Two Files

Size of file: 345 bytes

Issue: Download will be added to browser Downloads history. Unable to remove queued download from Downloads history. Clicking the item in the history does nothing. Closing browser gives a warning about downloads in progress.

If you interact with the pop-up dialog box you can save the files. Open button does the same as save.

It will not stay in Downloads history when browser is closed and reopened.

This issue may appear on other websites using the same advertising network.

1) Does this pose a threat?

2) Is this an MS Edge exploit?

This does not happen in Chrome or Firefox. At least on the computers I have tested.

3) Any solutions for the problem?

New 5/26/2018: While checking Nexusmods.com per blib Edge version 42.17134.1.0 has caught and blocked content.

enter image description here

While checking PhotoBucket.com per Viking Knight, Edge version 42.17134.1.0 has caught and blocked Adobe Flash content.

enter image description here

In both cases no Download dialog box appeared and no download was added to Downloads history.

  • You are now providing the technical details that this issue requires. I'm curious, though: how do you come to the conclusion that this is the result of the new Windows update and is about the privacy experience? – schroeder May 25 '18 at 9:21
  • 5
    Well, after the 0kb details, this looks like a bug in their ad network code. – schroeder May 25 '18 at 16:35
  • Time table is the only thing that I have so far for my conclusion. The thought is the update causes Edge to catch a servlet causing the download prompt. – Rob0today May 25 '18 at 16:42
  • Updating system to Feature update for Windows 10, version 1803. MS Windows Edge is built into the OS. This will most likely fix the issue. Will post when complete. I'll be away so it'll be a while before I post. – Rob0today May 25 '18 at 18:49
  • 3
    While we normally do not handle this type of question, the fact that there is no known answer, the details are difficult to nail down, the threat level is unknown, and we are getting lots of people asking the very same question, I'm leaving this one open because it offers the most details and the OP is putting a ton of work in. – schroeder May 26 '18 at 20:07
3

Threat: After testing, files have been found to be benign.

Threat Level: As stated this is more of an annoyance.

Cuckoo Score: (1.6 out of 10) This url shows some signs of potential malicious behavior.

http://cuckoo.cert.ee/analysis/2196788/summary

Cause: As mentioned, could be an Advertising Network code issue.

Solution: Updating to Windows 10, version 1803 solved the problem. MS Edge is built into Windows 10.

Latest Windows update as of May 2018:

Windows 10 Update History, version 1803

This updates Edge to:

enter image description here

  • Was able to update to the latest version of WIN10 and so far have not experienced a repeat of the problem. That being said, on at least 2 occasions the 1709 version of Edge was hijacked and bounced me to pages that MS had deemed unsafe to view. Therefore this should definitely be considered malware. Thanks for your help Rob0today. – blib May 28 '18 at 15:45
  • @blib why do you think that this is related to your redirect experiences? – schroeder May 28 '18 at 15:52
  • "Feature update", you know if they would actually be a little bit transparent about this, security people wouldn't have to lose their asses over it. – Nomad May 28 '18 at 15:53
  • You can mark this as your accepted answer, now. Yes? – schroeder May 30 '18 at 16:54
  • Sure will. Was wondering how far to chase the rabbit. – Rob0today May 30 '18 at 17:02
-2

I ran a "Reset PC" which is for Windows 10 (kinda like a W7/System Restore) That solved the problem, so far.

I found this option by putting the word "RESTORE" in the Windows search bar.

  • 2
    Right, that would be expected, because it rolls back the update. But is this thing being downloaded a risk? That's the question. – schroeder May 25 '18 at 16:24
  • risk or not, it's not suppose to be there, I was disturbed by every time I closed all my windows, it said "still downloading, do you want to interrupt" which of course I wanted stopped completely ! as if it was pulling every single thing I had on my computer for God knows what, so either way, don't want it, I didn't ask for it, it's resistance to being deleted off recent downloads is very telling re; intentional maliciousness – Viking Knight May 25 '18 at 16:56
  • lol glad I'm not the only one. I have noticed that this version of Edge is older. Why it was not updated in the latest updates is a mystery to me. – Rob0today May 25 '18 at 17:13
  • 1
    it just came back when I opened photobucket, had you visited photobucket lately or ran across one of it's HTML pictures – Viking Knight May 25 '18 at 17:22
  • @VikingKnight "not wanting it" does not mean that it is malicious. A bug in the download process does not mean that it is malicious. Just annoying. – schroeder May 25 '18 at 17:26

protected by Community May 28 '18 at 15:51

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.