933157 - Due to following link with false security alarm, Firefox is now infected with some malware

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[gerhild]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130910160258

Steps to reproduce:

Firefox Problem re Malware: Three days ago, while browsing, a false security alarm with advice to download a ne adobe flash player came up. Download didn't work. Ever since, each browsing session is a nightmare - bleeps, ads, false links inserted into normal websites. Each of them are redirecting me to several nonsense sites including the ones listed below. I reset Firefox, but the malware remains.

Here are some of the sites I get directed to

a2zLyrics (or similar name)

rvzrjs.info

http://7xbzz.watchforfree.airclearners.com/?sov=63645201&hid=hplhphhjjltlp&id=XNSX.software

http://dfd.pathci.net/sd/cpops-1.2.0.html?u=http%3A%2F%2Fdfd.pathci.net%2Fsd%2Fapps%2Ffusionx%2F0.0.4.html%3Faff%3D1060-8102&p=a2zLyrics

https://dfd.pathci.net/sd/cpops-1.2.0.html?u=https%3A%2F%2Fad.yieldmanager.com%2Frw%3Ftitle%3D%26qs%3Diframe3%253FM9e4Gnd%252ETQAt4lsBAAAAAFIAYQAAAAAAAAAQAAAAAAAAAAwABQAEEj7GawAAAAAA%252DId5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACkZRkAAAAAAAICAgAAgD8AmpmZmZmZAUCamZmZmZkBQAAAAAAAAAAAAAAgHFJTBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxsh%252DFqx66Dmxhpq3Y2ZwFvqVFjorblTIbsvWFAAAAAA%253D%253D%252C%252Cdfd%252Epathci%252Enet%252CB%25253D10%252526H%25253D%252526I%25253D1060%252D8102%252526I%25253D1060%252D8102%252526M%25253D3%252526S%25253Dfirefox%252526S%25253Dfirefox%252526Z%25253D0x0%252526%255Fsalt%25253D1630063793%252526e%25253D224635%252526e%25253D224635%252526r%25253D0%2525253CSCRIPT%25252520TYPE%25253D%25252522text%25252Fjavascript%25252522%25252520SRC%25253D%25252522https%25253A%25252F%25252Fad%252Eyieldmanager%252Ecom%25252Fget%252Duser%252Did%25253Fver%25253D2%252526sig%25253Df9346bb6ae03cc2d%25252522%25252520%2525253E%2525253C%25252FSCRIPT%2525253E%252526ts%25253D1383152171%252526y%25253D28%252C2e16f214%252D4184%252D11e3%252Db2cb%252D47d5daad4283%252C1383152171598&p=a2zLyrics

https://dfd.pathci.net/sd/cpops-1.2.0.html?u=https%3A%2F%2Fad.yieldmanager.com%2Fiframe3%3FM9e4Gst.TQAnYmUBAAAAAHenWQAAAAAAAABAAAAAAAAAAA0AAQAFCv2sbgAAAAAAMphxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjaxkAAAAAAAIBAgAAgD8AmpmZmZmZ.T-amZmZmZn9P5qZmZmZmf0.mpmZmZmZ.T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACiDGyb4Pe6DoG9NPviGhqsl5Nr3WCa8MwFGrWSAAAAAA%3D%3D%2C%2Cdfd.pathci.net%2CB%253D10%2526H%253D%2526I%253D1060-8102%2526I%253D1060-8102%2526M%253D3%2526S%253Dfirefox%2526S%253Dfirefox%2526Z%253D0x0%2526_salt%253D39108892%2526e%253D890796%2526e%253D890796%2526r%253D0%25253CSCRIPT%252520TYPE%253D%252522text%252Fjavascript%252522%252520SRC%253D%252522https%253A%252F%252Fad.yieldmanager.com%252Fget-user-id%253Fver%253D2%2526sig%253D479a53a7a77445c4%252522%252520%25253E%25253C%252FSCRIPT%25253E%2526ts%253D1383207776%2526y%253D28%2Ca5465376-4205-11e3-b931-df150f46299d%2C1383207776636&p=a2zLyricsReset Firefox


Actual results:

Malware remains after resetting Firefox


Expected results:

automatic malware identification and neutralisation

Comment 1

[Andre Klapper]

Thanks for your report, however this is not a "bug" (a problem in the program code) but instead a support request (as you deliberately installed some malicious software yourself). Support is provided on http://support.mozilla.com/ - please take a look there and browse through the existing answers or ask a new question. Thanks!

Comment 2

[gerhild]

Thanks for coming back. I'd truly be happy to learn how a normal PC user is to discern what exactly a bug technically is, and what it isn't. I have already tried every entry on http://support.mozilla.com/, but couldn't solve the problem, and found no tel or e-mail contact there, which is why I landed on Bugzilla. Telling me I "deliberately" installed malware does not hit the nail, and neither is it helpful. Just for the record: I was tricked into installing that stuff by a pop-up faking a security alarm, which suddenly appeared during a normal browing session. I used safe websites at that moment which I've done for years without encountering any problems with malware.