Adobe Flash Player Update

No,  That is not legitimate.  FlahsPlayer.hta is not a valid Flash Player installer file name.

Can you please confirm the website, and provide the entire website URL (e.g. http://...)?  I tried going to the website you posted and got an error that the page cannot be displayed.

Can you please post a screenshot of the pop-up, and the website?

I recommend updating your virus/malware/adware/etc software and running a complete scan on your system.

unfortunately, I can't find information on that domain and when I try to navigate to it I get a server not found error.

It'd be great if you could provide a screenshot that I can forward to our fraud department for follow-up.

I have received the same message from this address: https://quibutonyluvgeraldine.org/1733338642150/f83e6d5a9f6905f9112ef7914491b91d.html

Screen shot...note the Adobe icons.

Thank you.  I have forwarded your post to our fraud department for follow-up.

Thank you for reporting.  I have forwarded your post to the fraud department for follow-up. This isn't Adobe doing this.  Adobe is in no way involved.  If you haven't done so completely scan your system for viruses/malware/adware/etc.

How do you access the internet?  Do you  use a router?  If so, which one (make/model)?

Linksys routers had an issue some time back where they were getting infected with a worm, but a Google search didn't return your particular model as being injected.  This was a long-shot, since it was some time ago.

Essentially, the browser is being hijacked to a malicious site.  This is something on your system, not Adobe related.  The page lists the file name as FlashPlayer.hta.  Searching for this returns an issue with pop-ups from a few years ago.  It's possible it's related and the method since you indicate yours isn't a pop-up, but a browser redirect (hijack).  Unfortunately, troubleshooting these sorts of issues on your computer is beyond the scope of these forums.  It's also been my personal experience that some anti-virus/malware/etc programs find things while others don't.  Malware Bytes is a solid program and usually catching many things.  You may want to try something else like AdWCleaner, HitManPro, and/or any myriad of other programs available.

I also get this, the site is https://voohohelloweba.org/5441673362743/9ab4ce05fb1d12224e51c6043a6ca498.html

Thank you.  I have forwarded the URL to the fraud department.

I got the same deal when I was reading this article: Apple is facing several big iPhone 7 problems | ZDNet

I clicked on this link in the article, and that's when I got the phony Flash Player offer: Rare reports of poor image quality on iPhone 7 Plus circulate, no root cause known

Here's the screenshot:

I got the same thing today when I tried to open at article on att.net while using Microsoft Edge.  Instead of the article, the page told me I had to update Adobe Flash.  I downloaded it, but did not install it.  I then ran Norton antivirus and Ccleaner, but it was not flagged as a virus or malware.  I don't recall the site now, but the file is FlashPlayer.hta

I decided to go to the Adobe site to make sure I have the most current version.  It wants to know if I have foxfire or Opera / Chromium.  I have Microsoft Edge open, so which do I pick?  When I tried it on my Google browser, I got a message that I already have the most current.  Thank you.

Hi,

To see which version you have, go to Flash Player Help and click the 'check now' button.  The widget will auto-detect the OS, browser, and Flash Player version installed (if any).  If you use multiple browsers you'll want to repeat as different browsers use different plugin types (e.g. IE/Edge use Flash Player ActiveX Control, Firefox uses NPAPI plugin, Chrome/Opera and Chromium-based browsers use PPAPI plugin).

--

Maria

I get:

What do you want to do with Flashplayer.hta?

from: iuyeeonline-red.com

Open or Save.

I tried to add a screen shot but your system would not allow that kind of image.

I think this is fraud.

Lori

Hi lorio81025281

Yes, this is a malicious Flash Player installer. If you have the entire URL to the page that has this installer, please private message it to me and I'll forward it to our fraud department.  To send a private message, click on my user name link and the on the 'Message' button link.

--

Maria

I have attached a screen shot but I do not have the entire URL at the top

of this image.

When it pops up again I will get it.

Lori

How do I get rid of it?

I have ran CCleaner and Malwarebytes.

Lori

Hi,

There is no screenshot attached.  If you're replying via email, the forums software blocks all email attachments.  Please try to get the entire URL.  From previous experience, the fraud team really does need this to follow-up properly and issue a cease and desist to take down the malicious installer.

Unfortunately, I can't provide information on how to stop this from happening as it could be any number of things, ranging from a malicious ad on a page to something more nefarious.  If you perform an internet search for FlashPlayer.hta it'll return many search results, so it's really hard to give you a proper solution.

--

Maria

who it is from does not help??

from: iuyeeonline-red.com

when I've sent just a domain, like you have provided, they've asked for the entire URL.  Going to that website actually returns a server/site not found error:

Thank you.

If it pops up again I will capture the url.

it happened again this is the full url

https://upahbapkusa.org/2331612911713/f72ab95a7f960f53ecdb0df0cb65bee3/44b010a87edefd82cd3 ee9dd58e1bba3.html

It happened again.  This is the full url

https://upahbapkusa.org/2331612911713/f72ab95a7f960f53ecdb0df0cb65bee3/44b010a87edefd82cd3 ee9dd58e1bba3.html

Hi lorio81025281

Thank you for the URL.  I've forwarded it to the fraud team for follow-up.  Your post is currently being moderated and the URL may be removed by the moderator, considering it's pointing to a malicious installer.  In the future, you can forward these URLs directly to phishing@adobe.com or private message them to me.

--

Maria

I get that same screen ALL the time, Your Flash Player May Be Out Of Date, but it ONLY happens when I'm logged into and checking my Yahoo Email. It only happens once and not every single day. I know it's garbage and never click on it, but I CAN'T figure out why it keeps happening? 

Yes.  I believe it has to do with Yahoo email and IE.  I went to Adobe to see if my flash player needed to be updated.  There was a "test" button to see if it was working.  Mine worked fine so I do not believe I need to be updated.  I think I have some sort of spam/virus on my computer.  I do not select it but it is annoying.  I would like to know how to remove it.  Ive tried ccleaner and Malwarebytes.

Please post a screenshot of the update notification window, including the ENTIRE website address that is displaying the update notification.

Thank you.

https://peburdirectory-access.com/7621196508952/312cea28506f68caeec56289e85077a0/6b34f9bb9 8901f24e345edf87c739608.html

Thank you, lorio81025281

is the update notification you're seeing similar to the ones in the screenshots posted to this discussion topic in posts 5, 7, & 14?

It's exactly the same. In fact, it JUST happened when I logged in. I used the snipping tool to show you:

yes.  like 14.  each time it seems to be from a different website.  I have not written them all down.

@Limber Log

Thanks for the screenshot and confirming.  Do you have the complete URL for the site?

@lorio81025281

Thanks for confirming. I'll forward the URL to the fraud team.

Searching the internet for FlashPlayer.hta indicates this is a 'redirect virus' or a malicious browser extension.  I found a few sites that claim to have fixes to remove this from your system, but I can't claim their efficacy, as such, am not posting links to the site.  You can perform an internet search and find the same results.

A few things to begin with:

• Task Manager: look for FlashPlayer.hta process, if it's present terminate it.
  • You may need to select to view processes for all users
• Control Panel > List of installed programs: check to see if there's an entry for FlashPlayer.hta or other suspiciously named software that you don't recall install installing (e.g. some search toolbar, etc).
• Browser plugins: same as above, look for a FlashPlayer.hta or other suspiciously named plugins that you don't recall installing

I did find references to FlashPlayer.hta on the MalwareBytes sites and their forums, so they are aware of this.  If you have the latest definitions installed I suspect it would detect this on your system. 

today I got the fake Adobe update, I immediately took a printscreen then used task manager to end the internet which closed the fake site and update popup. Heres the snapshot.

After opening a new tab for a site from a bing search I was redirected from that site to the one shown(agaiktexalyser.org), as you can see the left arrow is highlighted blue. Yesterday I also had a redirect so ran Malwarebytes, adwcleaner, avast browser cleanup, Hitman, tdskiller, rkill, and Zemana Antimalware. Nothing was found on any of these programs. If I have something its hiding real good.

Hi,

Thanks for reporting the issue. I will forward the url to the phishing team.

Thanks!

I also get this pop up when I am on ebay Canada.