Hi Aulemar, thank you for the report. You're absolutely right that those are fake patches.

These malware distribution sites seem to be using coded links that can't be viewed by support volunteers (we get a blank page).

Can you figure out from your history which site that tab might have launched from? One theory is that it comes from a bad ad in a page but it would be helpful to "name names" (or paste links) to the sites that are causing it.

And if you have never installed any add-ons to block ads, you might want to consider one. These are popular (Note: you would only want to use one at a time):

• https://addons.mozilla.org/firefox/addon/adblock-plus/
• https://addons.mozilla.org/firefox/addon/ublock-origin/

This seems to be another site along the same thing

https://ohchukentvideo.org/6451067054713/f06a0a773d6ee171675eafcd7df55bff.html

We are seeing one or two new sites like that are coming almost everyday. Like playing "whack a mole" when trying to shut crap like that down!

What would be useful is tracking down the ads that may be behind this. jscher2000 #answer-895204 suggested looking for your History for clues. (Thee could be some delay between visiting a site and any ad or popup appearing).

Anyone able to reliably reproduce the situation where these ads or popups are seen ? (Other than clicking on a direct personalised link such as https://ierairosihanari.org/8801281637044/0f0b6cf1aecfe432c462b4883e6b5c34.html )

If you do find an ad then please follow these instructions. A lot of posts seem to suggest these just pop up the orange screens. If you could just confirm what site these originate from it will help. personally I have tried the newsites etc mentioned but have not yet seen this myself.

{#c16}If ... affected users) could tell us what the ad URLs are, that would be helpful.
They would need to right-click on the ad image, choose "This Frame -> View Frame Info", and copy/paste the following info:
General tab: Address (URL)
Media tab: Location (URL) of each item in the list of media in that frame.
This will help us isolate the affected ad networks so we can contact them and inform them of the malware.
Thanks!

If you see the orange splash screen Do NOT run, open, or click on any downloaded file. Please use keyboard Shortcut Ctrl + U to display the source code of the Orange Splash Screen. Please then save that. It may possibly hold some clues. if you are able to find steps to reproduce the display of this page other than using its link please let us know. I am not aware that anyone trying to study this has actually been able to see one of these orange screens recently.

Anyone who has run the downloaded fake update please post for instructions on what to do, you may have malware including the dangerous fileless kovter trojan.