Jump to content

Question regarding Firefox installing Vosteran?

Recommended Posts


I apologize for the length of the post but I thought to much info was probably better than to little.


What Happened:

Recently I downloaded Mozilla firefox and ended up with both vosteran and Optimizer Pro being installed at the same time. This was on a system running windows 7 home pro from a striped 500gb ssd C: drive with an internal second 1Tb drive, and two usb WD My Book external drives .  At the time I also had two usb sticks with various Flight Sim (FSX) scenery packages with installers plugged in.


What I did:

I had MSE running but It did not catch anything even with a full scan after I realized what had happened.  I immediately updated and ran Malwarebytes free which detected about 970 vosteran files, folders and registry entries plus the Optimizer Pro files!  I selected to quarantine all the files, then deleted the quarantine.  At this point mbam requested a reboot which I selected.  The system seemed to hang on the "shutting down" screen for a few minutes then blue screened and finally gave me the "Windows did not shut down properly..." message.  I chose to restart normally and the system came up seemingly fine.  Then I noticed I had no internet connection.  When I attempted to reconnect I got a strange message box stating it needed my network security code.


I certainly was not about to do that, so I closed it and looked around some. I noticed that all the vosteran stuff seemed to be removed but Optimizer Pro was still there.  I googled it and, using a suggestion from various forums, I simply uninstalled it.



A reboot worked fine, both vosteran & OP seem to be gone, my network connection automatically re-established and is working.



Even though I thought I had gotten the firefox download from the official Mozilla.org site did I get "redirected" at some point in the download process?  I did have to go through several pages to identify what package to download (i.e. 32 bit or 64 bit & win version).


Is mbam alone, capable of completely removing vosteran as it appears to have done?


Should I uninstall firefox before using it, then go back to the mozilla site and, carefully, download and install firefox again?


I greatly appreciate your help and advice!

Link to post
Share on other sites

  • Staff

They call me TwinHeadedEagle around here, and I'll be working with you.
Before we start please read and note the following:

  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

:excl: I can't foresee everything, so if anything unexpected happens, please stop and inform me!
:excl: There are no silly questions. Never be afraid to ask if in doubt!
  warning.gif Rules and policies
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Is mbam alone, capable of completely removing vosteran as it appears to have done?

At some point it is, but bear in mind that malware emerge and advance on a daily basic. Sometimes it is not possible to catch them all. MalwareBytes team is constantly adding new threats to their "black book".
Let's check your PC for possible infection:
Please download Farbar Recovery Scan Tool and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Link to post
Share on other sites

  • Staff

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif
icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

adwcleaner_new.png Fix with AdwCleaner
Please download AdwCleaner by Xplode and save the file to your Desktop.

  • Right-click on adwcleaner_new.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait until the database is updated.
  • Accept the Terms of use and click Scan.
  • When finished, please click Clean.
  • Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.
Note: Reports will be saved in your system partition, usually at C:\Adwcleaner


Link to post
Share on other sites

Hi, I'm not sure if this will affect the setup of the fix tools so before I run them I wanted to check in with you. Also, I wanted to present the info as a warning in case a new user was reading this post.

When I was going to check in with the board, since my last post, I opened Firefox (by habit), this was the last program that I installed before the infection. It continually redirected me to a donation page so I immediately UNINSTALLED FIREFOX. This is the only change I have made and I apologize if it complicates anything. Should I go ahead and run with the fix tools as posted or does a change need to be made?

For others that may be reading this thread:

I thought I was downloading from the official Mozilla site but apparently I got fooled! I am not a newbie nor have I ever been infected with anything in the past. SO EVERYONE NEEDS TO BE VIGILANT WHEN DOWNLOADING NEW SOFTWARE. MAKE CERTAIN THAT THE URL IS CORRECT!

So, after opening Firefox I was presented with what appeared to be a normal FF page, asking for a donation. It looked very convincing with all the things one would expect to see on a page from them with a box which had a polite request for a donation. It included buttons for different amounts to donate such as $10, $20, and $25. I am not giving any sensitive data on this machine until I KNOW it is clean so I simply hit the Home button. This did not take me home, rather it simply reposted the donation page in a different color. Just as a test I tried hitting the Home as well as other links on my bookmark toolbar and all continued to just post the same page in a different color.

THIS IS A SCHEME TO GET CREDIT CARD INFORMATION. You may not even realize for quite a while that you are being ripped off! Something like this happened to a close relative of mine. THE THIEVES SIMPLY MADE SMALL WITHDRAWALS ($20 - $30)

Link to post
Share on other sites

OOPS, accidentally hit post before I was finished. TO CONTINUE WITH THE ABOVE POST: This person, LIKE SO MANY OTHERS, did not check his bank statement closely until a charge of $200+ was made to the card from a foreign country and his bank thought it was suspicious so they canceled that card and called him.

LESSON: His card had been being used for 7 months with a total of $1400+ stolen! COULD YOU AFFORD TO GIVE THAT TYPE OF MONEY TO A STRANGER?

I know all of this info is posted and this type of warning is all over the internet but some people just don't get it or really just don't think it could happen to them. THIS IS FOR YOU! DON'T BE THE ### N E X T ### VICTIM!

Though I didn't get taken in by the bigger fraud "I did get fooled into downloading this piece of ThiefWare, And I NEVER THOUGHT IT COULD HAPPEN TO ME".

Link to post
Share on other sites

Everything seems fine and no software is reporting to find anything. Thank you very much. I will now go download the real Firefox -- right after I turn my VPN on for this system so I can donate a case of beer to you.

If a friend came over and helped me clean this mess up, buying him or her a case is the least I would do. Cheers!

Link to post
Share on other sites

  • Staff

Thank you :)
Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself :)

Recommended reading:

icon_exclaim.gifMUST READ - security tips:

icon_exclaim.gifMUST READ - general maintenance:

The Importance of Software Updating:


In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.
Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

icon_arrow.gifTFC - to clean unneeded temporary files.
icon_arrow.gifMalwarebytes' Anti-Malware - to scan your system from time to time in search for malware.
icon_arrow.gifMalwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
icon_arrow.gifMcShield - to prevent infections spread by removable media.
icon_arrow.gifUnchecky - to prevent from installing additional foistware, implemented in legitimate installations.
icon_arrow.gifAdblock - to surf the web without annoying ads! 

Post-cleanup procedures:


Download DelFix by Xplode and save it to your desktop.

  • Run the tool by right click on the 51a5ce45263de-delfix.png icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings
  • Push Run.
  • The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning. 

My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation: 


Thank you!

Stay safe,
TwinHeadedEagle   :)

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Yes Sir,

Thank you for jumping back in with me.  As I said in my pm:  Everything looked good and I had failed to check in with the forum as I thought we were finished.  I went back to mozilla.org, this time making certain that all urls were correct at each page, and downloaded and installed Firefox again.


It seemed to work just fine while setting it up however, the first time I re-opened FF I was faced with a barrage of adverts all over the page,  They were popping up and closing quickly and included video ads for auto's etc. 


I closed the browser, and did what any normal person would do: slapped the monitor so hard my hand was tingling for hours, threw my hat in the general direction of the cat (didn't want to hit him) used approximately 953 expletives in 2.6 seconds, started to kick my computer - but couldn't because I'm a quadriplegic without the use of my legs so I called for my wife to kick the computer for me... which she refused to do. 


Then we went to her machine and found something that said check your add-ons. So I did and I found an "add-on" in FF called "Hold Page".  I disabled it and removed it from FF and haven't seemed to have a problem since,  I also checked ie but it was clean.  I'm wondering if I have something lurking about waiting to hook into another install?


Also, as soon as I deleted "Hold Page" I came back to the thread and discovered the last post, of which I have now followed completely.


Once again, thanks for your quick response, I greatly appreciate it.


Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.