PDA

View Full Version : Firefox related nastie?



minster
12-02-2012, 08:56 PM
Was browsing F1 Forums last night om my desktop and on closing page got a pop up saying my pc was infected!
It tried to get me to download an exe file to clean computer but I closed the page and run malawarebyte/msse scans to check and they came up clear.
This morning on my laptop the same thing pops up (Windows Secure Kit 2011)
After a bit of searching I found that Windows Secure Kit 2011 is browser related (Firefox) and could cause trouble if a user was to install it.
Wondering if this has come up before on F1 and if there are any easy removal options if the worst was to happen?

bevy121
13-02-2012, 12:18 PM
....on closing the page?
you weren't using a search link or anything?

this seems to be a very recent recurrence of an "SEO" hijack using redirect techniques to load the scare-ware url instead of an intended page searched for

see here (http://nakedsecurity.sophos.com/2012/02/09/is-this-the-resurgence-of-blackhat-seo/)

minster
13-02-2012, 12:28 PM
Yes I had earlier done a search to see if the apparent problem had been discussed before but after my search I spent 30 mins or so reading posts before closing.
Also, this same program reappeared the next morning, but this time on my laptop so I do not believe there could be any link between PressF1 and the nastie as I had not been near F1 with the laptop.

Paul.Cov
13-02-2012, 08:58 PM
Turning off Java scripting tends to allow you to wrestle control back from many of these things.

Easiest way to do it is to switch to a different tab, and disable Java from there, then return to the tab with the bogus page and close it.