712125 - I was infected with the Vista Security 2012 virus after downloading the browser from the home site.

Status: RESOLVED INCOMPLETE

(mozilla.org :: Security Assurance, task)

Description

[Recon071993]

User Agent: Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3

Steps to reproduce:

I downloaded the browser from the main website. Shortly thereafter I found that I had be one infected with the Vista Security 2012 virus. 


Actual results:

My system was compromised and required a system restore. However, because of the virus, the restore points were "deleted" and it required much trial and error to find away to get back charge of my computer. 


Expected results:

No viruses should have been downloaded. I'm disappointed in Firefox because the computers at my school use the browser and I love it. However, I will not be using Firfox any time soon untill this is fixed.

Comment 1

[Mats Palmgren (inactive)]

> I downloaded the browser from the main website ...

"Main website"? - I'm assuming you mean http://www.mozilla.com/

When did you download it? (the exact day / time if you can remember it)

> Shortly thereafter I found that I had be one infected ...

What do you mean by "Shortly thereafter"?  Was it days, hours, minutes? 
What other activities did you do from the time Firefox was installed until
you discovered the virus - did you install other software? browse the web?
watch any videos?  etc.

There's also the possibility that your computer was already infected before
Firefox was installed and it was just a coincidence that you installed Firefox
shortly before it was discovered.  Also, since you're on Windows, doesn't
your virus scanner normally scan files as they are installed?

Regarding the "Vista Security 2012" malware - it seems it's method of spreading
by disguising as a Windows automatic update, Flash update or video codec update.
http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/how-do-i-remove-vista-home-security-2012-virus/1e3ea9ab-8b1b-486f-b840-1d1fd4988322
http://www.destroy-malware.com/remove-vista-security-2012-vistasecurity2012-virus/
http://www.precisesecurity.com/rogue/vista-security-2012

Is it possible a web site tricked you to install it when you believed you we're
doing one of those?

Anyway, it's not a bug in the Firefox product itself if one of our
distribution points had an infected copy.  Reassigning for further triage.

Comment 2

[Daniel Veditz [:dveditz]]

Our mirrors appear clean, don't know what else to check without knowing what "the main website" is. We've seen lots of scams trying to fool people into downloading from sites that are not ours and we get them shut down as we learn about them, but that's a legal process that can't keep up with the speed of the scammers.