There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months.
The pesky pop-up always advertises "super-resume.com" with a https://href.li/ link.
Here's the security that was in place during the original infection and every time the malware has popped up, without ever setting off any warning or alert:
- Symantec Endpoint Protection (Virus, Spyware, Proactive Threat and Network Threat Protection modules all enabled and updated)
- Daily anti-virus and anti-malware scan
- Corporate firewall
Here are the things that have been done off the top of my head to try to find/remove it:
- Uninstalled and reinstalled Mozilla Firefox
- Tried using different builds of Firefox, including Beta and Alpha releases (now back to the production release)
- Many Malware Bytes scans
- Removing all browser addons
- Using Ad Block Plus with pop-ups disabled
- Many Spybot Search and Destroy scans
- Audited the registry
- Many CCleaner runs
All failed miserably. Nothing ever detected a threat and nothing has prevented the pop-up from recurring. User has not visited an infected site since the original infection.