733693 - Malware intercepts call to SagePay on Firefox 10.0.2 Windows 7 32bit

Status: RESOLVED INCOMPLETE

(Firefox :: Untriaged, defect)

Description

[Perry]

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11

Steps to reproduce:

I tried to pay for items on 2 seperate occasions on 2 different sites with SagePay.



Actual results:

Instead of the normal page that is still displayed through IE and Chrome, I get routed to a Malware Popup with Firefox 10.0.2 that asks for card details including my ATM NUMBER, obviously this isn't right.

I have contacted SagePay regarding this and also my Credit card company.


Expected results:

On IE or Chrome I get a completely different screen, not a popup, that doesn't ask for my ATM number.

Comment 1

[Bob Clary [:bc] (inactive)]

Perry, It sounds like you have been infected with malware. If you can help us try to determine how you got infected, it would be very helpful. Afterwards, you will need to clean your PC of the infection.

First, please check if this behavior still occurs if you run Firefox in safe mode. See http://support.mozilla.org/en-US/kb/Safe%20Mode

If it does not, then the most likely culprit is an extension that has been installed.

Please go to the page about:support, click copy all to clipboard then open Notepad or some other text editor, paste the results into the editor and save the results to a file. Then use the "Add an attachment" link above to upload the file to this bug.

Next, visit http://mozilla.org/plugincheck and see if you have any out of date plugins. If you could select the text on the page that contains *just* the list of plugins, their versions and their update status and copy+paste the results into this bug that would be very helpful.

Do you remember installling any add-ons, plugins, codecs or other software recently just prior to the occurring ?

Next, you may find http://support.mozilla.org/en-US/kb/Is%20my%20Firefox%20problem%20a%20result%20of%20malware helpful in trying to clean up your PC.

Comment 2

[Perry]

Hi Bob ,
 It is a work laptop and I was advised to uninstall Firefox, so I have done.
I only had a Flash Plugin and PDF reader plugin.
 I don't remember going to any suspect sites or installing any other plugins.

Sorry I couldn't be of more help.

Kind regards, Perry.

Comment 3

[Bob Clary [:bc] (inactive)]

Perry, Ok thanks. Without more information there is nothing more we can do. You should still try to check your PC for other unintended software.