6

I'm coming across a malicious pop up to update my flash player. The message in the pop up:

Warning! Your Adobe Flash Player version is outdated. Security risks. Please update now.

enter image description here

I've seen this pop up across multiple browsers (chrome, safari, firefox) and occurs on all OSX machines on the local network. I've attempted to disable on plugins and extensions in chrome but the problem remains. Clicking ok takes me to a website that appears to be an official adobe website but the link to download the update is clearly wrong. enter image description here

This problem just happened today across three machines simultaneously and I'm stumped as how to proceed. What's the best way to remove these pop ups?

Improve this question
14
  • This is a still burning question I asked a while ago: apple.stackexchange.com/q/110456/22003 . I'm still waiting a decent answer. 3 millions dead accounts is a low starting point to build trust.
    – dan
    Dec 30, 2013 at 15:49
  • 1
    fplayer.adobe.com doesn't exist at Adobe and on the Internet. Could you please provide the output of the following Terminal commands: whois fplayer.adobe.com ; host fplayer.adobe.com?
    – dan
    Dec 30, 2013 at 16:03
  • 3
    You'll also notice that the indicated system in your screen grab is "Windows 64-bit" which is impossible given that you're posting from Firefox on OS X. This is a phishing attempt.
    – da4
    Dec 30, 2013 at 16:30
  • 1
    Could you find which common action you had on 3 Mac just before you got these phishing popups? A same received E-mail, a same flash content to display, a same web server truck loaded of advertising…?
    – dan
    Dec 30, 2013 at 16:53
  • 1
    Each machine was used by a different person (mother and girlfriend) so I have no idea what we all did to get this. I think this may be a problem with my network or isp. The same popup shows up on iPhones when using the local wifi, but not when using data plans. I'm using an asus rt-n16 router for wifi behind an at&t u-verse modem. I can only change the dns on the router, and that doesn't fix it. Connecting directly to the modem doesn't fix the problem either.
    – Cezary Wojtkowski
    Dec 30, 2013 at 19:12

4 Answers 4

Reset to default
1

When weird things happen on my clients' Macs, the first thing I do is run the free Malwarebytes' Anti-Malware (MBAM, formerly AdwareMedic software to see if any of the known "bad guys" is active on the system. As often as not, they are.

Also, have a look at your /etc/hosts file through Terminal:

  1. Open Utilities > Terminal (or use Spotlight)
  2. more /etc/hosts (press space bar to scroll a screen at a time)

See if fplayer.adobe.com is listed there. If so, we'll discuss how to remove it.

Try that and report back. Then we'll try step two.

Improve this answer
0

You are either visiting a website that is not credible or a system on the network has gotten a bad DNS so that it is talking with bad server and getting the pop-ups that way. Daniel's terminal commands are there to help figure out what your system points do with that domain thereby looking for the culprit.

Looking at the screenshot you attached something with location4.biz is the page hosting fplayer... Might need some intense triage on your systems for any unauthorised apps that have taken seed.

Hope this helps paint a picture....

Improve this answer
3
  • This appears to be affecting iPhones using the local network as well, but not on their mobile connections. I've tried changing the dns server on each machine, on the router, connecting directly to the modem, resetting everything. Still seeing the same pop up.
    – Cezary Wojtkowski
    Dec 30, 2013 at 19:20
  • Do the "infected" machines still show this when they access the internet from a different router? Do machines that you know to not be infected appear to be infected when used on your network? I suspect it is your router that is infected.
    – AllInOne
    Dec 30, 2013 at 22:48
  • Is it possible for the problem to be with the 3801HGV router/modem at&t provides? I've bypassed my asus router and connected wirelessly and wired to it and still encounter the problem. I contacted at&t and they recommended to power off the modem for 10 minutes to reset the ip. Still no dice.
    – Cezary Wojtkowski
    Dec 30, 2013 at 22:59
-1

Removing all Safari's .plist files in ~/Library/Preferences did the trick for removing the PopUp.

Improve this answer
1
  • this is using a hammer for a job that calls for a spoon.
    – AllInOne
    Jun 16, 2015 at 22:33
-2

Try delete your IP from OpenDNS if you are using this Open Source.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .