Adobe Flash Player Update

[Guest]

I repeatedly get a web page popping up in IE that says "Adobe Flash Player - Your Flash Player may be out of date" which triggers an IE pop up asking what I want to do with FlashPlayer.hta.

The website is   ohcoyinfotraxsys.org

Is this really from Adobe and legitimate?

[lorio81025281]

who it is from does not help??

from: iuyeeonline-red.com

[_maria_]

when I've sent just a domain, like you have provided, they've asked for the entire URL.  Going to that website actually returns a server/site not found error:

[lorio81025281]

Thank you.

If it pops up again I will capture the url.

[lorio81025281]

It happened again.  This is the full url

https://upahbapkusa.org/2331612911713/f72ab95a7f960f53ecdb0df0cb65bee3/44b010a87edefd82cd3ee9dd58e1b...

[lorio81025281]

it happened again this is the full url

https://upahbapkusa.org/2331612911713/f72ab95a7f960f53ecdb0df0cb65bee3/44b010a87edefd82cd3ee9dd58e1b...

[_maria_]

Hi lorio81025281

Thank you for the URL.  I've forwarded it to the fraud team for follow-up.  Your post is currently being moderated and the URL may be removed by the moderator, considering it's pointing to a malicious installer.  In the future, you can forward these URLs directly to phishing@adobe.com or private message them to me.

--

Maria

[Guest]

I get that same screen ALL the time, Your Flash Player May Be Out Of Date, but it ONLY happens when I'm logged into and checking my Yahoo Email. It only happens once and not every single day. I know it's garbage and never click on it, but I CAN'T figure out why it keeps happening? 

[lorio81025281]

Yes.  I believe it has to do with Yahoo email and IE.  I went to Adobe to see if my flash player needed to be updated.  There was a "test" button to see if it was working.  Mine worked fine so I do not believe I need to be updated.  I think I have some sort of spam/virus on my computer.  I do not select it but it is annoying.  I would like to know how to remove it.  Ive tried ccleaner and Malwarebytes.

[_maria_]

Please post a screenshot of the update notification window, including the ENTIRE website address that is displaying the update notification.

Thank you.

[lorio81025281]

https://peburdirectory-access.com/7621196508952/312cea28506f68caeec56289e85077a0/6b34f9bb98901f24e34...

[_maria_]

Thank you, lorio81025281

is the update notification you're seeing similar to the ones in the screenshots posted to this discussion topic in posts 5, 7, & 14?

[Guest]

It's exactly the same. In fact, it JUST happened when I logged in. I used the snipping tool to show you:

[_maria_]

@Limber Log

Thanks for the screenshot and confirming.  Do you have the complete URL for the site?

@lorio81025281

Thanks for confirming. I'll forward the URL to the fraud team.

Searching the internet for FlashPlayer.hta indicates this is a 'redirect virus' or a malicious browser extension.  I found a few sites that claim to have fixes to remove this from your system, but I can't claim their efficacy, as such, am not posting links to the site.  You can perform an internet search and find the same results.

A few things to begin with:

• Task Manager: look for FlashPlayer.hta process, if it's present terminate it.
  • You may need to select to view processes for all users
• Control Panel > List of installed programs: check to see if there's an entry for FlashPlayer.hta or other suspiciously named software that you don't recall install installing (e.g. some search toolbar, etc).
• Browser plugins: same as above, look for a FlashPlayer.hta or other suspiciously named plugins that you don't recall installing

I did find references to FlashPlayer.hta on the MalwareBytes sites and their forums, so they are aware of this.  If you have the latest definitions installed I suspect it would detect this on your system. 

[patrickp69576991]

I also get this pop up when I am on ebay Canada.

[_maria_]

Hi patrickp69576991

Thank you for reporting this.  As per the URL this is NOT an official Flash Player installer.  Please do not download the file.  Please private message me the entire URL and I will forward it to our security/fraud team.

I recommend you run an entire system scan for viruses, malware, adware, etc.

Thank you.

--

Maria

[jimhill100]

This just popped up as a tab in Internet Explorer after I visited my company's Office365 SharePoint site.  Of course I didn't follow it.

[_maria_]

Do you have the page URL, not just download URL?

[jimhill100]

Yes, here is an image of the URL that is infected:

[lorio81025281]

yes.  like 14.  each time it seems to be from a different website.  I have not written them all down.

[michealg48373061]

Here is the pop-up that I am receiving

[michealg48373061]

and a second site pop-up today

[John T Smith]

Never ever click on a link from a pop up like that... there are MANY sites that have been hacked and have malware

Getting Flash Player https://get.adobe.com/flashplayer

[_maria_]

Hi,

Definitely a fake, as denoted by the non-adobe URL.  I'll forward this to our fraud team for follow-up.  In the future, please send it directly to phishing@adobe.com.

<edit>

Please note that fake alerts can be caused by Ads that have been infected with malicious code (so-called Malvertising) or even by malware/viruses itself.  You help help protect your system by running up-to-date anti-virus, malware, etc software, performing regular virus/malware/etc scans, and blocking ads (if feasible, as some sites now require ads to be unblocked in order to view content).

--

Maria

[_maria_]

I'm going to lock this discussion topic - it's quite old with quite a few different people on it.  Every time there's a new post, everyone receives an email notification.

For those of you that are getting these fake Flash Player update notifications, please take a screenshot of the entire page, including the address field with the full URL.  Depending on the browser, you may need to click in the address field to display the entire URL.  Send the URL and the screenshot to phishing@adobe.com.  To take a screenshot, see https://forums.adobe.com/docs/DOC-7043#jive_content_id_How_do_I_attach_a_screenshot

Thank you.

--

Maria