Possibly malware/script but not sure what or how

[DrB0b]

Hello All,
Currently using updated W10 with updated Firefox which has ublock running. We have Trend Micro Business Security and are behind a business class firewall. Randomly, my FF will open up the open/save as dialog box as seen in my pic. Maybe once every other week. I have a ton of tabs open so I'm not really sure what site this may be stemming from but no manual action was taken on my part when these 4 popped up. I have recently added noscript which should likely fix the issue with whatever site is doing this assuming I don't whitelist it through noscript. I do not think that there is anything locally causing this like a piece of malware or virus as Adwcleaner/MBAM/Trend all say everything is fine. (Ignore the "1" on Trend for virus as it is an email I downloaded to test on our test server.) The only thing ADW found was a Browser helper from our printer.

Am I safe to assume that this is driven from a website script and that noscript will likely curtail this behavior? I know in this line of work nothing is 100% but just curious on your guys take on this situation.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

 

[kjv1611]

I'd think it could be an add-in in Firefox gone crazy. I'd move or delete the user profile for Firefox under appdata, then see if the problem is gone. I realize you'll lose the open tabs, but that may be the simplest way to totally resolve.

NoScript works great in Firefox, but if it's a broken add-in, it won't fix that. If it is caused by a website, it'll definitely fix it. And then who's to say that the Firefox app itself hasn't gotten a bug somewhere - maybe a corrupted install - and it just happens to show this one behavior?

"But thanks be to God, which giveth us the victory through our Lord Jesus Christ." 1 Corinthians 15:57

 

[DrB0b]

Sorry forgot to post the photo.

@kjv1611 - That is a possibility. I will go through and uninstall/reinstall the apps and see if that makes a difference and worst case nuke the user data. Good ideas, thank you.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

 

[spamjim]

The screenshot appears to be pushing HTML files to save, which is nutty. That's far from the typical action for HTML. The crappy low-resolution, useless image suggests these files are coming from ad networks. Maybe an ad or script blocking add-on is misbehaving when it tries to block these.

I'd guess that your browser installation and user profile is messed up.

Back up your bookmarks and list of open tabs ...then clear out the browser installation and user profile. Then reinstall.

 

[DrB0b]

Damn that is a terrible pic. Didn't realize. But yea, you got the gist of it, they are prompting to save the html files. I haven't had the issue resurface with the addition of noscript but as soon as it happens again I will nuke FF and its user info and reinstall.
Thanks guys!

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

 

[kjv1611]

Did the reinstall sort this out? I hand't check in for a while.

"But thanks be to God, which giveth us the victory through our Lord Jesus Christ." 1 Corinthians 15:57

 

[DrB0b]

It still has not resurfaced with Noscript and Ublock enabled so I have not reinstalled yet. If it does show back up, that will be my next step and will report back on it.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

 

[Edward Cramer]

I am looking forward to it.