I was browsing the web today, when I saw the firefox page telling me that my flash needs updating.. Just like here http://www.firefoxfacts.com/wp-content/uploads/2010/07/fakeupdate.jpg
I saw this the other day after I updated firefox, so I didn't even think it may not be legitimate, figured that flash had issues installing so I downloaded and installed "Firefox-Update.exe" which I now suspect is a virus or spyware.. Almost instantly I noticed that my windows 7 gadgets all went white, my antivirus isnt loading in the system tray when I restart, and I keep getting "Windows Security" errors saying "these files cannot be opened, your internet security settings prevented one or more files from being opened." Also I noticed a weird program running in my task manager called "nkeusa.exe" i believe, which i imidiately ended that process, noticing the description said "gold" which I saw some other tasks with that desription that I ended also.
I have read a little bit about this rogue firefox update and see that it it installs some garbage fake virus program telling you that you have a virus so that you will pay for their software.. Although I have not seen any instructions with removing it. I have had AVG on my computer which apparently didn't catch this crap.. I did restart into safemode and ran Malware Bytes, as well as did a system scan in AVG, but didn't find anything unusual.. I have now installed HiJackThis hoping that the log would shed some light as to what this garbage is.. I will post my log in hopes that someone can PLEASE help me with this! I also notice I have NO restore points that I can restore to.
I am so mad at myself that I installed this crap without thinking twice about it because it looked almost EXACTLY like the legitimate page that I was from mozilla the other day.. Please someone help as soon as you can!
hijackthis.log 9.5KB 4 downloads
Oops, sorry mods, I accidentally put this in the wrong section.. I am running in safemode and see about 1% of my screen.. I appologize
Merged posts and moved to log forum. ~ OB
Edited by Orange Blossom, 24 October 2010 - 12:21 AM.