×
INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

Possibly malware/script but not sure what or how

Possibly malware/script but not sure what or how

Possibly malware/script but not sure what or how

(OP)
Hello All,
Currently using updated W10 with updated Firefox which has ublock running. We have Trend Micro Business Security and are behind a business class firewall. Randomly, my FF will open up the open/save as dialog box as seen in my pic. Maybe once every other week. I have a ton of tabs open so I'm not really sure what site this may be stemming from but no manual action was taken on my part when these 4 popped up. I have recently added noscript which should likely fix the issue with whatever site is doing this assuming I don't whitelist it through noscript. I do not think that there is anything locally causing this like a piece of malware or virus as Adwcleaner/MBAM/Trend all say everything is fine. (Ignore the "1" on Trend for virus as it is an email I downloaded to test on our test server.) The only thing ADW found was a Browser helper from our printer.

Am I safe to assume that this is driven from a website script and that noscript will likely curtail this behavior? I know in this line of work nothing is 100% but just curious on your guys take on this situation.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

RE: Possibly malware/script but not sure what or how

I'd think it could be an add-in in Firefox gone crazy. I'd move or delete the user profile for Firefox under appdata, then see if the problem is gone. I realize you'll lose the open tabs, but that may be the simplest way to totally resolve.

NoScript works great in Firefox, but if it's a broken add-in, it won't fix that. If it is caused by a website, it'll definitely fix it. And then who's to say that the Firefox app itself hasn't gotten a bug somewhere - maybe a corrupted install - and it just happens to show this one behavior?

"But thanks be to God, which giveth us the victory through our Lord Jesus Christ." 1 Corinthians 15:57

RE: Possibly malware/script but not sure what or how

(OP)


Sorry forgot to post the photo.

@kjv1611 - That is a possibility. I will go through and uninstall/reinstall the apps and see if that makes a difference and worst case nuke the user data. Good ideas, thank you.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

RE: Possibly malware/script but not sure what or how

The screenshot appears to be pushing HTML files to save, which is nutty. That's far from the typical action for HTML. The crappy low-resolution, useless image suggests these files are coming from ad networks. Maybe an ad or script blocking add-on is misbehaving when it tries to block these.

I'd guess that your browser installation and user profile is messed up.

Back up your bookmarks and list of open tabs ...then clear out the browser installation and user profile. Then reinstall.

RE: Possibly malware/script but not sure what or how

(OP)
Damn that is a terrible pic. Didn't realize. But yea, you got the gist of it, they are prompting to save the html files. I haven't had the issue resurface with the addition of noscript but as soon as it happens again I will nuke FF and its user info and reinstall.
Thanks guys!

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

RE: Possibly malware/script but not sure what or how

Did the reinstall sort this out? I hand't check in for a while.

"But thanks be to God, which giveth us the victory through our Lord Jesus Christ." 1 Corinthians 15:57

RE: Possibly malware/script but not sure what or how

(OP)
It still has not resurfaced with Noscript and Ublock enabled so I have not reinstalled yet. If it does show back up, that will be my next step and will report back on it.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

RE: Possibly malware/script but not sure what or how

I am looking forward to it.

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members! Already a Member? Login

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close