Firefox - ComObject Fake Virus

HawnGrd

I wrote this Thread a complete hour, but this stupid CloudFlare sayd "Sry we blocked you" so I uploaded the text somewhere else:

 

https://pastebin.com/KZzWjE1j

HawnGrd

1. 
   
   
   First, I'm German and not from America or England, so I do not speak perfectly English.
   
   
   
2. 
   
   
    
   
   
   
3. 
   
   
   Let's start, every time I started my computer there opened up a program with Firefox logo but not exactly the Firefox logo just a little different.
   
   
   
4. 
   
   
   The last times I noticed that it had a name containing only names and numbers and it was over 100 
   
   
   
5. 
   
   
   characters long.
   
   
   
6. 
   
   
    
   
   
   
7. 
   
   
   So I made a complete-scan NOTHING was found, then I uploaded the file that I found called “update.exe” in a folder named “ComObject” in %appdata% to virustotal, but no scanner detected it, but the users rated the file already as #goodware and much more to see here: https://www.virustotal.com/#/file/fb9045b74615a339fcdc3016f899aec5b8afbdacde5421d94d777c709295c2fd/community
   
   
   
8. 
   
   
   I decided to contact the support, but I could not use the website, so I called them (Germany) as I can say, they were not helpful.
   
   
   
9. 
   
   
   So I will upload the files on a hoster and link them here so you can look at them, its just a modified version of Firefox that opens tabs in background and clicks on random elements to generate money for the developers of this stupid fake. 
   
   
   
10. 
    
    
    And every time you try to “pull the window in foreground” it closes the explorer and hides on the taskbar.
    
    
    
11. 
    
    
     
    
    
    
12. 
    
    
    File on Workupload.com: https://workupload.com/file/qQ5vKZD  <---
    
    
    
13. 
    
    
     
    
    
    
14. 
    
    
    Problems with something on this Thread? Contact me!
    
    
    
15. 
    
    
     
    
    
    
16. 
    
    
    At next I will look with Wireshark where the software calls during the run.
    
    
    
17. 
    
    
     
    
    
    
18. 
    
    
    Greets,
    
    
    
19. 
    
    
    Marius