652396 - this link load a virus called ftk.exe which took me over 6 hr to remove

Status: RESOLVED INCOMPLETE

(Firefox :: Security, defect)

Description

[loren]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16

i did a search for this (german military officer’s navy cap - Google Search) which took me to http://www.google.com/search?q=German+Military+Officer%E2%80%99s+Navy+Cap&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a  
then it open (i think)http://hjt-data.trendmicro.com/hjt/analyzethis/index.php?report=3560990  which load a virus that removed my restore points, close Window SECURITY AND OPEN AN NEW SECURITY cALLED WINDOW 7 SECURITY OR something like that, it put a exe file called ftk and every browser that I open gave me a security warring, I had to shut down boot to my other hard drive and try to find it which i did and deleted most of the associated file, Then I had to boot back to the original drive and Uninstall window 7 manager then reinstall it then fix association files as exe file would not work, restore my regester to an previous period, get system restore to work again, fix all window links. took over 5 hr to fix Just because I click on a link, your warning did not come up on this link so fix it ok. 

Reproducible: Always

Steps to Reproduce:
1.did not try to reproduce it 
2.
3.

Comment 1

[Daniel Veditz [:dveditz]]

I'm may not be following the steps correctly

1. you did a Google search (link above)

Then what? Did you click on one of the choices, or did the the next thing happen by itself while you were on Google?

I don't understand the trendmicro link -- that's a valid link that's not going to give you malware (unless maybe your network is hijacked). Or are you saying you ran their utility and that's what found ftk.exe?

What plugins (and versions) do you have? You can find that information either from about:support or (better) by going to https://www.mozilla.com/en-US/plugincheck/

Comment 2

[loren]

 [Bug 652396] this link load a virus called ftk.exe which took me over 6 hr to remove
I did the google search and click on one of the link on the first page and that were the virus started im affraid to click on any of the link on the first page and my history do not show the link the only thing after the search in the history was the trend link and I did not go to trend it just appeared.,then  bug auto loaded, normally I can tell and i kill my browser but this one I could not tell it was loading , i was using version 3.6.16 and I found the virus myself by seeing what was running and doing a google ck on unknown  exe file running in my processes.

I just look in plug in and their is one I didn't add  called conduit engine 3.3., I did delete it, other plug ins , 
Java Deployment Toolkit 6.0.220.4

Adobe Acrobat

Java(TM) Platform SE 6 U22

Silverlight Plug-In

Shockwave Flash

QuickTime Plug-in 7.6.9

Microsoft® Windows Media Player Firefox Plugin

NVIDIA 3D VISION

Windows Live™ Photo Gallery

NPCIG.dll

Google Update

Google Talk Plugin

Google Talk Plugin Video Accelerator

Battlefield Play4Free Updater

Logitech Device Detection

. thats all. the plug in i have 

I hope this helps

Comment 3

[Daniel Veditz [:dveditz]]

I wanted versions as well, bug "Java Platform SE 6 U22" is bad enough -- The latest is U25 and there are severe security holes fixed in U24 that are being exploited widely on the web.

If your Java is out of date other things are too. What Flash do you have? What Acrobat version? Both are also widely exploited. Turn off everything you don't regularly know you use.

visit https://www.mozilla.com/en-US/plugincheck/

get help at http://support.mozilla.com/

Unfortunately the link you gave is either not the real source of your infection, or has been cleaned up since (maybe an infected ad network?) so there's no way to know how you got infected. The odds say "plugins" rather than Firefox though.