Fake Flash Player Redirect

NKTechGuy · 01 May 2014

For the past several weeks, I've been having problems when I go to lots of website (e.g. weather.com). This window comes up as soon as I press enter to go to the webpage. (The downloads at the bottom of the page were automatically downloaded as soon as I clicked OK to be able to close the tab). I've tried booting in safe mode and running a virus scan (quick and full). I tried my regular antivirus (avast free), and I also tried Malwarbytes. Neither one came up with anything. I have looked all over on Google and can't seem to find anyone with a similar problem. Any insight on this problem would be GREATLY appreciated!

derekimo · 01 May 2014

What version of Chrome are you using?

NKTechGuy · 01 May 2014

version of chrome is 34.0.1847.131 m
(says it's up to date)

derekimo · 01 May 2014

It was just a guess, same version as mine.

I'm not getting that on weather.com or amazon.

I'll let the security experts advise.

cottonball · 01 May 2014

NKTechGuy,

It does look fake. Adobe`s official site has version 13.xxxx vs. 12.xxxx

Please use the tool Zoek.exe:
Download > Download zoek.exe version 5.0.0.0

When the Zoek.exe download appears, save to the Desktop.
On the Desktop, right-click Zoek.exe and select: Run as Administrator
Give it a few seconds to appear.
Please disable your AntiVirus and AntiSpyware programs, so they don't interfere with the running of Zoek.exe.
You can find instructions how to disable your security applications here:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

At the program console, click the Options button and place a checkmark only on the following options:

Do a Deep Scan
Installed Programs

Now...
Close any open programs.
Click the Run script button, and wait.
It takes a few minutes to run.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please post the zoek-results.log in your reply.

UsernameIssues · 02 May 2014

cottonball said:

NKTechGuy,

It does look fake. Adobe`s official site has version 13.xxxx vs. 12.xxxx
~~~

Minor comments - then back to lurking.

For Chrome, that website should not show a version. It should tell the user that Flash is built in to Chrome. See the screenshot below. Even if you delete PepperFlash from Chrome, the website will look the same.

OP's image is definitely from a fake website:

1) the middle panel never says that
(It is always an install offer - even if you already have the offer.)

2) the wording/grammar is wrong in the middle panel
(Adobe Inc. strickly recommend to update)
*strongly
*recommends
But the syntax is still wrong.

3) info at the bottom of the first panel is wrong
(It should not be there for Chrome.)
(It is a modified version of what you might see in other browsers, but not Chrome.)
(When is is supposed to be there, it always tells you the OS & 32bit or 64bit)

4) copyright info across the bottom is missing

5) install button is wrong in the right panel.

With IE11:

Fake Flash Player Redirect-chrome-flash-ie.png

With Chrome:

Fake Flash Player Redirect-chrome-flash-1.png

I wonder what the OP would see while visiting here:
https://www.adobe.com/software/flash/about/
With Chrome or most any browser:

Fake Flash Player Redirect-chrome-flash-2.png

cottonball · 02 May 2014

OP's image is definitely from a fake website...

There is no doubt about that now!!

I only asked one of my dachshunds, Trooper, to sniff it out.

All kidding aside, thanks for the info, UNI.

NKTechGuy · 02 May 2014

I did the scan that was recommended by cottonball. I'll upload the log file, but if nobody feels comfortable opening it, I'll take screenshots of it (it would be like 10 screenshots even with a 3840x1080 resolution)

cottonball · 20 May 2014

Well, I blew this one!! My apology...

..your post got lost in my shrinking memory.

If you need further assistance, post back with an update of where the issue stands.