topic Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox in Discussions

Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Issue_Report — Sun, 17 Dec 2023 03:33:04 GMT

Multiple items quarentined by Microsoft Defender. It is reporting Trajon:HTML/Phish!pz is detected in Firefox cache. Some examples being:
C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\gd1w3gjx.default-release\cache2\entries\077D332D18D04002F4E4F2029C7BBDBD6075BBD8

C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\gd1w3gjx.default-release\cache2\entries\087BCF7C6435165AD81CEA178C340D8C71CA965E

C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\gd1w3gjx.default-release\cache2\entries\0DB91AB2260ACFD2290F3A56BDB862D6F2359779

C:\Users\UserName\Local\Mozilla\Firefox\Profiles\gd1w3gjx.default-release\cache2\entries\0E79D7DDB0575B34F6E2A2DC0D77F7B91117DABB

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

cannabisdoctor — Mon, 18 Dec 2023 14:02:20 GMT

I have the same issue!

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Nunes — Fri, 22 Dec 2023 11:52:49 GMT

Also have the same issue and noted that it appear after I run the Glarry Utillities software

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

PL2023 — Sat, 23 Dec 2023 00:55:59 GMT

Same here!! Started when updated Glary to version 6. Every scan i do on Glary, Microsoft Defender, alerts me!

What is going on?!

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

skysong — Sun, 24 Dec 2023 19:48:46 GMT

I'm also having this same issue whenever I do a 1-Click Maintenance on Glary Utilities 6. This has me very paranoid. Is it safe to ignore it?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

pauld57624msn — Tue, 26 Dec 2023 03:24:11 GMT

I am experiencing the same issue, too. It started on December 23 while running 1-click maintenance on Glary Utilities 6. I'm going to leave Firefox closed and use another browser until we get this fixed.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Mrdru — Tue, 26 Dec 2023 12:33:34 GMT

I also am experiencing this issue 12/26/23 and I do not have Glary. I have removed about 7 threats through Microsoft Defender after doing a quick scan and then a full scan. All these threats are located in file: C:\Users\name\AppData\Local\Mozilla\Firefox\Profiles\jqcnrc2w.default-release\cache2\entries\xxxxxxxxxxxxxxxxxxxxxxx.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

barbarawr — Tue, 26 Dec 2023 12:44:50 GMT

Same here - right after running Glary Utilities, except that I was on Chrome. Windows Defender beeped at me every few seconds but I couldn't get it to quarantine OR remove the threat. So I ran CCleaner and the beeping stopped. I ran Windows Defender again and it said there were no threats. Phew!

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

pixelpadre — Tue, 26 Dec 2023 16:59:45 GMT

Im getting the same thing but have not using glarry

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

nykerk — Tue, 26 Dec 2023 18:16:50 GMT

I'm getting it as well.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Moon2000 — Tue, 26 Dec 2023 22:31:59 GMT

Same problem without Glary since 26.Dec.2023 at 12:21 CEST. When I close Firefox, the ...\cache folder is completed deleted automatically. I checked some of the problematic files at https://www.virustotal.com/gui/home/upload . Result was no suspiction of malware. I also loaded some into an editor and they start with a JIF header.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Nerd3D — Tue, 26 Dec 2023 23:18:16 GMT

jotti.org reports no virus in the samples submitted. This is a false positive. Just add the FireFox cache folder to the exclusions list for Defender.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

pixelpadre — Wed, 27 Dec 2023 01:48:53 GMT

I emptied the folder and made it not writeable by desktop user...it worked.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

tomhummus — Wed, 27 Dec 2023 17:58:24 GMT

Same here after updating iMazing to Version 3

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

thealwaysultra — Wed, 27 Dec 2023 19:19:13 GMT

Same problem, not using iMazing, Glary or any other thing mentioned here. I guess this a false positive. I also have not used my PC for long - completely new build since a couple of days. In my case, this looks like a problem with the Windows Back Up Tool because the "trojan" is located in "ShadowCopy" somewhere, which seems to have something to do with the backup.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

kaiclavier — Wed, 27 Dec 2023 19:55:50 GMT

Exact same here, I don't have any of those other things mentioned, new PC build, and the message popped up when doing Backup and Restore (Windows 7), and the problem file is within a shadowcopy created by the backup.

Happened once before clearing my cache (all I visited before the message popped up were normal websites), then again with a different random cache file that was apparently created as I reblogged a picture of a cat on Tumblr. So probably a false positive? Clearing the cache and keeping firefox off allowed the backup to complete, but hopefully windows defender puts out some kind of update before I do another backup next week...

So either it's a windows defender false positive, or firefox itself is somehow creating a trojan out of random cache items...? False positive seems more likely...

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

jackb — Thu, 28 Dec 2023 00:36:26 GMT

Got a solution. Or at least it works for me. Windows 10 running Firefox 120.0 (64-bit) and Backup and Restore (Windows 7).

I noticed that the file that caused the failure was some variation on C:\Users\UserName\Local\Mozilla\Firefox\Profiles\<user>.default-release\cache2\*

Solution was to configure Firefox to clear the cache upon logonff, (https://support.mozilla.org/en-US/kb/how-clear-firefox-cache) for every user on the PC and then clear the disk shadow copy (https://www.ubackup.com/windows-10/how-to-delete-shadow-copies-windows-10-5740.html). And backup runs just fine because cache2 is no longer there.

This does require that Firefox not be running when backup is run.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

verytiredsysadm — Thu, 28 Dec 2023 03:49:48 GMT

So far on my PC these have all been verifiably false positives. I never take a vendor's word for it when they assure people that the alerts are false positives and their stuff is totally safe -- no crap, that's what a malicious source would say too. I tell Microsoft Defender to restore the file, then open the file in a programmer's hex editor program (that is, an editor that doesn't run macros out of the file, doesn't assume anything about the file contents, etc). Then I can look at the file myownself in a safe manner.

One of the "infected" files was a public certificate chain in RFC 7468 ("Base64 PEM") format. Not a credit card stealer executable, Microsoft.
The other three reports were all adblocker updates from uBlock Origin. One of them triggered the Trojan:HTML/Phish!pz alert, which is hilariously wrong.

All four are plain text files, although PEM format isn't really meant to be humanly readable, and the uBlock update/diff format is only slightly readable (and only if you know how to read classic software diff format).

I don't like the idea of specifying the browser cache as excluded from scans, but Microsoft Defender has suddenly started crapping the bed over the last few weeks with just blindingly obvious failures.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

pixelpadre — Thu, 28 Dec 2023 12:52:18 GMT

UBlock.....uh oh.....I have one of those......

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

thekzl — Thu, 28 Dec 2023 14:00:35 GMT

Great find! I was having a similar issue as the others. If I emptied cache and ran backup, no big deal. But as soon as FF started running, even with no activity, I'd get the "virus/phish found" that pointed at the FF cache2 directory. After a lot of searching I stumbled onto this, and with your help, I opted to temporarily disable ublock, flushed my cache, and now my backup is running JUST FINE with no errors or no new false positives.

Seems to me like maybe there's something that ublock is creating that's causing the false positive.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

kaiclavier — Thu, 28 Dec 2023 16:06:05 GMT

Will confirm I also have uBlock origin. But it's open-source so surely this must just be a random false positive still, right...? (Or possibly an intentional false-positive...??)

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Thu, 28 Dec 2023 17:17:10 GMT

I started having the same problems with Windows Backup and Windows Defender yesterday. I was able to narrow this down (repetable) to a Javascript from Amazon.com. This scrpit is abuout 60Kb in size. Here is the top few lines:

/**
* @author sumeet
*/
(function(module) {
if (module.isRegistered)
return;
/** Generic Utility **/
(function(WlpInjectable) {
// TODO - Replace it with underscore library later
var q = 0;
var utility = {
isFunction: function(fn) {
return typeof fn === 'function';
},
isObject: function(n) {
var t = typeof n;
return 'function' === t || 'object' === t && !!n;
},
defer: function(callback) {
setTimeout(callback, 0);

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Thu, 28 Dec 2023 19:56:15 GMT

This is good advice. But, if you use Thunderbird you will still have a problem with backup. You have to also set TBird to clear cache automatically as well in the General tab. Once done the problem is solved and backup runs perfectly. I have Everything software and use it to search cache2 which displays both Mozilla and Thunderbird folders. Specifically subfolder Entries which is where activity is listed.

I am Windows 10 Pro, AMD processor.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

smithgeorge550 — Sun, 31 Dec 2023 15:29:06 GMT

I am also facing this issues. I think that it appears when I use Glarry Utilities Software. Utility stores are also run by ehsaas program which is a social welfare program visit the website and share it so the eligible individual can get financial support. read more

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 17:14:49 GMT

This problem occurs without having Glary. I don't have it. It looks like this problem occurred with the last Firefox update. Up to Dec 25 my nightly backup worked fine. Later in the day on the 25th or early 26th I applied a Firefox update and my problems started. If I leave cache on backup will not complete. The same with my wife's system. Forget about Amazon. The fix above by JackB is the answer but make sure you do the same for Thunderbird if you use it.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Fri, 29 Dec 2023 17:37:20 GMT

same issue, first started when it was finding the Trojan:HTML/Phish!pz in the firefox cache of a local computer account I had not logged in to in several months. cleaned all that up, and now it's finding it in my cache. don't have glary or even know what it is.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 17:39:15 GMT

I agree with the statement about clearing the Mozilla cache and removing the backup snaphots (shadow copies) to complete the backups. That works, but that doesn’t address the root cause.

These files, which are being flagged by Windows Defender, get into Mozilla cache from the web sites you had visited. Now, they do no stay in the cache long. If you use shadow copies for Windows backup, then these transient files from cache, get stuck in your backup snapshots and they get flagged by Windows backup as infected. So, if you clear the cache and remove the snapshots, then your backup will complete, but we still don’t know if those files are actually infected or they are false positive.

i caught a couple of the cache entries flagged as infected. One was from Amazon, one was from American Express. The Trojan definition says that this is an HTML Phish trying to steal your passwords that you are entering on the web….

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

kaiclavier — Fri, 29 Dec 2023 17:46:09 GMT

So we know how to work around this if it is a false positive, what's next is determining if the file is actually malicious, and what's generating it. Since the issue seems to be reproducible (after clearing your cache, launch firefox, do about 5 minutes of browsing, and a backup will fail), has anyone tried seeing if the backup still fails with uBlock origin removed during this process...? I really doubt it's uBlock but multiple people did mention it

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

thekzl — Fri, 29 Dec 2023 17:54:51 GMT

If you clear cache, and disable uBO - backups will complete again.

My workflow right now is that I have a notification of a failed backup, I go into FF, disable uBO, clear cache, and then restart the backup. The backup completes successfully, and when it's done, I re-enable uBO and everything is back to normal. I'll even browse sites while the backup is happening, and it's still fine.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 18:01:21 GMT

I do not have uBlock. The issue seems to be reproducible. Indeed, we do not know if those cache entries are just the false positives or they are actually infected.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

tomhummus — Fri, 29 Dec 2023 18:12:32 GMT

I agree, but I am still wondering what the root cause is. I fixed the problem with the method that JackB described, but what was the original cause? I see four possible explanations:
1) It's a false positive,
1.1 caused by Windows Defenders wrong detection metrics
1.2 caused by Firefox (somehow)

2) It's a right positive, caused by
2.1 a malicious website/ad/whatever (but on several websites, since there seems not be a unique identifier
2.2 ublock version (I also have it installed,but some people with the issue seem to not have ublock)

How to find out now?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 18:18:19 GMT

I use uBlock but it makes no difference. Previous to having FF automatically clear the cache, if I cleared it manually and then did a backup - it worked fine. I did not disable uBlock, After having accessed the net (no Amazon or Amex,) if I performed a backup it failed to complete. Cache only had a few entries but the number doesn't seem to matter. Considering my issues did not start until I had processed a recent FF update I have to assume that the problem lies with FF and the way these web visits are compiled by FF. The same thing happens in Thunderbird.

My computer and my wife's computer have no problem now that FF and TBird automatically clear the cache.on closing.

This is the root cause. FF has caused Windows Defender to view some entries as trojans when they aren't. All we can do is react to the problem and what we have is a correction by automatically cleaning out cache. I also question why Mozilla thinks we need these reference points. To speed up a re-visit? Really?

BTW when I manually cleared my wife's cache entries there were 1800 entries in the file. Mine was much smaller.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 18:36:38 GMT

I have been wondering about what’s common between Amex and Amazon in my example. Upon close inspection of those two cache entries, I see two different Javascipts from Amazon and Amex respectively, but they both came through Amazon CloudFront, which seemingly add some binary portion to those JavaScripts. That binary portion seems to be identical. If those two files are, indeed, infected then, perhaps, the culprit is CloudFront. Many businesses use AWS and CloudFront to run their websites. If CloudFront somehow got infected and spreading this Trojan, then it could be a common denominator across various cache entries. This is just pure guess on my part, as I have no way to analyze and understand that binary portion in my cache entries.

i would truly prefer to be wrong about this and confirm that these are just the false positives and not harmful..,,

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 18:53:05 GMT

Entering Amazon or Amex is not the issue for my multiple backup failures so I have to assume these sites, in particular, are irrelevant. I don't know what/who CloudFront is.

I repeat, my problem did not arise until the 25th/26th after I had installed an FF update. Using the Windows security message details I even tried deleting the file it identified and then attempting backup again. It still would not complete and Windows just gave me detail of another cache entry and on and on.

To add, I was surprised my search for cache2 using the free software Everything, also identified cache2 in Thunderbird. If I set FF to perform an automatic deletion of cache2 but left TBird as it was, backup failed. So, even though Mozilla put TBird on it's own a number of years ago, FF updates are also be affecting TBird in some manner.

My proof of this is the fact my wife's computer (also on FF and TBird) running Windows 10 Pro, had EXACTLY the same issues after installing the FF update within minutes of me having installed same on my computer. Backup would not complete on her computer even after enabling automatic cache deletion in FF until I also set TBird to do the same.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

tomhummus — Fri, 29 Dec 2023 19:23:57 GMT

Sounds plausible! By the way, I also have the error on Windows 11, so it's not Windows 10 only.

Is there a way to escalate the issue to Mozilla? I haven't had a point of contact with Mozilla development regarding bugs and such, but I think the developers there might be able to take a look at this thread?

EDIT: I opened up a bug report on Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1872395

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 19:20:40 GMT

In the past I've attempted to contact Mozilla but it's too difficult and regimented and I gave up. FF has a field allowing reports to Mozilla so I assume they become aware of issues. BUT, the problem here is reported by Defender and not in FF so they probably won't know unless one of their people also experience the same issue on their own personal computer.

In the meantime we live with it and in any case I don't see a need to cache visit entries in FF or Tbird for a later revisit.

It dawned on me how TBird gets or has cache2 entries. If you get an email with a link and open it you are visiting the internet from TBird and the entry is logged in a TBird cache2 file. How an update from FF may have affected TBird is beyond me.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 19:25:43 GMT

Thanks, Tom! That is a good idea to ask Mozilla team to take a look at this….

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 19:28:34 GMT

Rob,

As I said, I would like you to be correct in this issue and attribute this weirdness to Firefox. The alternative idea with Amazon CloudFront being the source of infection is very unpleasant to even contemplate…

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 19:50:19 GMT

The only common thread in all of this is the fact FF has caused the problem resulting from a recent update. CloudFront is not relevant for me nor is uBlock, Gary, etc. If I can clear/delete cache2 and Defender has no further issue in performing a backup there is only one reason remaining for the process to have failed. Defender does not identify any other issue. Also of note is the fact that when I initially had this problem on the 26th I performed a Full Scan after I had cleared cache 2 and Defender found nothing. The same for Malwarebytes. BUT, at that time I had not cleared Thunderbird cache2 and backup still would not complete until I did so.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 20:11:46 GMT

Rob,

inspect the affected cache entries and see if they are signed by CloudFront. You’d be surprised to see how many web sites do use CloudFront.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

MrGreg — Fri, 29 Dec 2023 20:55:12 GMT

I just did this to my MECH-17, and the failure-to-complete-backup problem seems to be fixed. Will try the same fix on the old COMPAL NBLB3.

Thanks to you all.

greg

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 21:41:59 GMT

Perhaps but still irrelevant here. I had no problems until the 26th after processing an FF update. Within minutes of doing that I did my wife's computer as well. Afterwards our daily backup would not complete. All daily backups to the 25th had completed on both computers. The rest is history now.

If someone thinks it's a good idea to report this to Mozilla I encourage them to do that.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 21:47:48 GMT

What’s your Firefox version now? Let’s compare.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 22:08:21 GMT

Firefox 121.0 and Thunderbird 115.6.0. Both 64 bit.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

MrGreg — Fri, 29 Dec 2023 22:14:32 GMT

I'm also running Firefox 121.0 and Thunderbird 115.6.0. Both 64 bit.

Keeping them updated seems to be a good idea.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 22:18:01 GMT

Firefox Version 121.0, first offered to Release channel users on December 19, 2023 according to their web site. The very first post in this thread complained about this issue on 12-16-2023. So, if we assume that Firefox was the culprit, then this bug was introduced before 121.0 version was released. That doesn't jibe well with Rob's point on bug being introduced on 12-26-2023.

I have the same 121.0 64-bit version on Windows.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Fri, 29 Dec 2023 22:21:04 GMT

I am having this same issue.

Defender is detecting Trojan:HTML/Phish!pz in files in C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\73ivohp8.default-release\cache2\entries and quarantining and blocking them. I have not found any evidence of threats outside of this particular folder.

After doing both full online and offline scans with Defender, there are no further threats detected until I use firefox again, at which time the issue happens again. This behavior has reoccurred consistently with the same threats detected again soon after using firefox again.

Since others here mentioned cloudfront, I searched some of the quarantined cache files and found this line "x-cache: Miss from cloudfront" in all of them.

Same as others here have said, I really hope this is a false positive caused by firefox and this is just a coincidence because cloudfront is so widely used and not an actual threat spreading through cloudfront.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Fri, 29 Dec 2023 22:22:28 GMT

I have firefox 121 problem started 12-25-2023

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 22:29:41 GMT

Thanks, bballer! The plot thickens. CloudFront in each of the affected cache entries... Let's hope for the best. Hopefully this is some sort of Firefox bug. The alternative is scary...

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 22:32:53 GMT

Perhaps but I was ok until I updated. My invite to update did not occur prior to the 25th/26th. I do not allow an automatic update. So, if the issue existed before that I was not having any problems. How could that be? Everything hinges on the update change. Suggest a more likely culprit. I'm listening.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 22:52:48 GMT

How often do you run your backup? When was the last time you backed up before 12-26-2023?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 22:56:05 GMT

I run Backup on a regular schedule. Every night. My wife's the same. I do not allow it to perform an Image backup.

I have daily backups for the last month up to the 25th. No issues.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 23:03:15 GMT

Well, it does look like the update being a culprit in your case, Rob. I backup once a week and my backups ran fine on 12-20 and failed on 12-27.

So, I guess it would be fair to say we still don’t know what the root cause is here.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Fri, 29 Dec 2023 23:11:21 GMT

I assume you had updated FF prior to the backup attempt on the 27th - ?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Fri, 29 Dec 2023 23:11:28 GMT

My most recent successful backup completed at 3am on the 25th, and the threat was first detected by Defender at 1am on the 26th for me. I have auto updates on for firefox, and the log shows it successfully updated to 121.0 at 7am on the 20th. This would seem to indicate that at least in my case the issue was not caused by the 121.0 update but instead by some event occuring between 3am on the 25th and 1am on the 26th.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 23:19:37 GMT

I had the Firefox updated automatically to 121.0. I don’t know when that happened though. My first failed backup happened on 12-27.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Fri, 29 Dec 2023 23:23:27 GMT

That narrows the window down to 25-26th of December… Hmm…

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Fri, 29 Dec 2023 23:57:54 GMT

Only in my case though, remember this discussion was started on the 16th. I think the only thing we can say with certainty regarding the timing is that we know this issue has existed since at latest the 16th, and that there doesn't seem to be a clear correlation between the time that people installed the 121.0 update and when they first experienced this issue.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 01:04:55 GMT

Same problem.

None of the mentioned programs in earlier comments are on my system, so I wanted to check for that line, "x-cache: Miss from cloudfront". But I can't find any files in quarantine. When I filter on them there's nothing.

I have opened the files with the same names in the real time cache, and they are associated with sites I visit. Some of these files get refreshed every minute, like a weather page. And Defender finds nothing in the real time cache.

Only the fat parts vary per Defender alert, and I only get them making a backup:

file: \Device\HarddiskVolumeShadowCopy23\Users\username\AppData\Local\Mozilla\Firefox\Profiles\vk8k2xhg.default\cache2\entries\1254CDECF65EA9AB63367A13E628BD4DFE81BC7B

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 00:53:36 GMT

Yes, I agree with you. We’ve seen a case on the 16th before FF 121.0 was even released, then in your case 121.0 worked fine for 5 days after being upgraded. The only plausible explanation is that we all have got infected at the different times as the infection spread. Rob ‘s case can be just a coincidence of upgrading FF and getting infected on the same day.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 01:08:09 GMT

Erik,

We know that the files in the Mozilla cache a being constantly written and deleted. They are transient as the cache should be. Now, the same files would get stuck in the shadow copies since shadow copies are snapshots. You can copy those affected files out of your shadow copies and examine them. This way even if the file has been injected to your Mozilla cache and later deleted out of the cache, an intact copy of the original file is stuck in a shadow copy, as it was injected into your system. You can examine those files once they were copied out of the shadow copy.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 01:18:08 GMT

Thanks, so no quarantine.

I usually make no other use of the backup, how do I enter such shadow copy ?

Is that by putting files back in the context menu ?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 01:23:37 GMT

I had Nirsoft ShadowCooyView tool installed on my Windows system. I used it to access a shadow copy and copy the files out of it.

https://www.nirsoft.net/utils/shadow_copy_view.html

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 01:33:01 GMT

OK, I tried it via the context menu, and "Put back files..." (or similar entree), and found the file where Defender barked upon, opened it with notepad, but no 'cloudfront' found.

Tried another file from another bark to be sure, same result.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 01:44:51 GMT

If those are the text files, can you copy and paste one those files here? Not that I will be able to tell you much about the contents, but at least we all can take a look.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Sat, 30 Dec 2023 01:47:23 GMT

That does seem like a plausible explanation. Now my question becomes: should this be considered a real threat and if so what should be done?

Is it possible that we might see this same "infection spreading" behavior from a false positive? Would a false positive neccesarily start showing up at the same time for everyone?

I don't have the expertise to answer these questions with a useful degree of confidence.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 01:53:43 GMT

Knock yourself out, this is the smallest:

‹ µÕÁn„ €áwá¬2Œ’Tž¡Û&›ÞšXe•D)Ì¶Ùøîe×ziåPnê€üù.\‰žå Â§UD£ì¥;H{”Úðùé‘$èY=ŸÏ^"XQñ‰X3ÄáE÷aŒß?dTzã¬e|Ûæƒœm\‹€uÉ°ÄöQ €¸×=Mq:†`½ Ôº÷Ny¯ÍPv½©N‹VÆÝz*3ýÒøæbíç” ô¢N3½Á[D„jk»ÿ?ã¾‚ˆ×ë¯ÉL ßÖ.îÿƒò{ðZüUPCÆ‚R
rÔ)MNƒ&Å ÉiÐ¤ðœ<Å€ç4àûÏW€°o2 ¤°œ,Å€å4`)˜ÓàûYßÖ/…]ÖŒ" ÿ2VnÇø eH¤FeTŠeH´ ± O^partitionKey=%28https%2Cbuienradar.nl%29,a,:https://image-lite.buienradar.nl/3.0/metadata/RadarMapRain5mNL?history=12&forecast=0&skip=0&ak=3c4a3037-85e6-4d1e-ad6c-f3f6e4b75f2f strongly-framed 1 security-info FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAYkMIIGIDCCBQigAwIBAgIQBTV+QwgRKn704R9HCr3K2DANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBEaWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTAeFw0yMzA5MTQwMDAwMDBaFw0yNDA5MTMyMzU5NTlaMFoxCzAJBgNVBAYTAk5MMRIwEAYDVQQHEwlIaWx2ZXJzdW0xGzAZBgNVBAoTElJUTCBOZWRlcmxhbmQgQi5WLjEaMBgGA1UEAxMRd3d3LmJ1aWVucmFkYXIubmwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQgbUVB/rK+49+t9Qeet9pbU45YB5jF/LODJvX4LB/b8v0+UvmVYK7YhY+V/xttGpKcBd1lZHtm89L68Ki3ZN2bo4IDtjCCA7IwHwYDVR0jBBgwFoAUt2ui6qiqhIx56rTaD5iyxZV2ufQwHQYDVR0OBBYEFNzGGdHL0cqLikCE9nz506mRQJVeMFwGA1UdEQRVMFOCEXd3dy5idWllbnJhZGFyLm5sgg8qLmJ1aWVucmFkYXIuYmWCDyouYnVpZW5yYWRhci5ubIINYnVpZW5yYWRhci5iZYINYnVpZW5yYWRhci5ubDA+BgNVHSAENzA1MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBjwYDVR0fBIGHMIGEMECgPqA8hjpodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTQuY3JsMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTQuY3JsMH8GCCsGAQUFBwEBBHMwcTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEkGCCsGAQUFBzAChj1odHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTEuY3J0MAwGA1UdEwEB/wQCMAAwggGABgorBgEEAdZ5AgQCBIIBcASCAWwBagB3AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7WbAAABipMZ76MAAAQDAEgwRgIhAJ0pt3I9/Sz9KBzaOFEh6HImw/Q1EuuvuoJJugj4XuW4AiEAhFfCSLr/v8y90rrLVkF5/kL+eHJKkmlTJC55Vv42OoQAdgBIsONr2qZHNA/lagL6nTDrHFIBy1bdLIHZu7+rOdiEcwAAAYqTGe/jAAAEAwBHMEUCIQD6K49YfAGnK3DBrZzFU8inw8UHMeK4AssoWLE50EsK+QIgQhz+3VJtrkDvoyM1n0GLoM4SrfeDz8NtBhAot9brn+IAdwDatr9rP7W2Ip+bwrtca+hwkXFsu1GEhTS9pD0wSNf7qwAAAYqTGe+3AAAEAwBIMEYCIQCqaqoeJeYxHPgxPat3rm9CTE9YCrdGQLDo2v/on+nz8AIhAMiHJUsvFuLweYp6wja8HY7L2lR3n6ZCADCuNPBoUxumMA0GCSqGSIb3DQEBCwUAA4IBAQBkPUj2csUU2WEj/ltlkgedhkY/kfzavyq6FRUG2z1g7xMBhmJLypKHVNHbIsHmto638Cv74mWOm4o5F1gPIbYmto1XSAnIOUblZgL9HqMw8qie1q98kxTQ7AUBlO0X1mE0EUwNLAeEZWvzlkVnT7rhaOYpc1FKsK4QolD0ZoWf//wMB5V/qZIYj4sF8EfSn8ZPMF/AxXGpzhubUykaK4khEkEeweM3hrxJ8u4v0se7b+yqudCFmsRfGFLwOuPF+ThHnKe2wZljZ9lnmVF3FsXUA1FpMcx8E8bSKEbL3BKi9/S5a4Ry/R8q+jXxDhTZ88AbVD2MpQGIaryGWpte6+xuEwIABAAAAAAAAQEAAAAAAAAGeDI1NTE5AAAAEUVDRFNBLVAyNTYtU0hBMjU2AANmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAYkMIIGIDCCBQigAwIBAgIQBTV+QwgRKn704R9HCr3K2DANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBEaWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTAeFw0yMzA5MTQwMDAwMDBaFw0yNDA5MTMyMzU5NTlaMFoxCzAJBgNVBAYTAk5MMRIwEAYDVQQHEwlIaWx2ZXJzdW0xGzAZBgNVBAoTElJUTCBOZWRlcmxhbmQgQi5WLjEaMBgGA1UEAxMRd3d3LmJ1aWVucmFkYXIubmwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQgbUVB/rK+49+t9Qeet9pbU45YB5jF/LODJvX4LB/b8v0+UvmVYK7YhY+V/xttGpKcBd1lZHtm89L68Ki3ZN2bo4IDtjCCA7IwHwYDVR0jBBgwFoAUt2ui6qiqhIx56rTaD5iyxZV2ufQwHQYDVR0OBBYEFNzGGdHL0cqLikCE9nz506mRQJVeMFwGA1UdEQRVMFOCEXd3dy5idWllbnJhZGFyLm5sgg8qLmJ1aWVucmFkYXIuYmWCDyouYnVpZW5yYWRhci5ubIINYnVpZW5yYWRhci5iZYINYnVpZW5yYWRhci5ubDA+BgNVHSAENzA1MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBjwYDVR0fBIGHMIGEMECgPqA8hjpodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTQuY3JsMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTQuY3JsMH8GCCsGAQUFBwEBBHMwcTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEkGCCsGAQUFBzAChj1odHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUTFNSU0FTSEEyNTYyMDIwQ0ExLTEuY3J0MAwGA1UdEwEB/wQCMAAwggGABgorBgEEAdZ5AgQCBIIBcASCAWwBagB3AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7WbAAABipMZ76MAAAQDAEgwRgIhAJ0pt3I9/Sz9KBzaOFEh6HImw/Q1EuuvuoJJugj4XuW4AiEAhFfCSLr/v8y90rrLVkF5/kL+eHJKkmlTJC55Vv42OoQAdgBIsONr2qZHNA/lagL6nTDrHFIBy1bdLIHZu7+rOdiEcwAAAYqTGe/jAAAEAwBHMEUCIQD6K49YfAGnK3DBrZzFU8inw8UHMeK4AssoWLE50EsK+QIgQhz+3VJtrkDvoyM1n0GLoM4SrfeDz8NtBhAot9brn+IAdwDatr9rP7W2Ip+bwrtca+hwkXFsu1GEhTS9pD0wSNf7qwAAAYqTGe+3AAAEAwBIMEYCIQCqaqoeJeYxHPgxPat3rm9CTE9YCrdGQLDo2v/on+nz8AIhAMiHJUsvFuLweYp6wja8HY7L2lR3n6ZCADCuNPBoUxumMA0GCSqGSIb3DQEBCwUAA4IBAQBkPUj2csUU2WEj/ltlkgedhkY/kfzavyq6FRUG2z1g7xMBhmJLypKHVNHbIsHmto638Cv74mWOm4o5F1gPIbYmto1XSAnIOUblZgL9HqMw8qie1q98kxTQ7AUBlO0X1mE0EUwNLAeEZWvzlkVnT7rhaOYpc1FKsK4QolD0ZoWf//wMB5V/qZIYj4sF8EfSn8ZPMF/AxXGpzhubUykaK4khEkEeweM3hrxJ8u4v0se7b+yqudCFmsRfGFLwOuPF+ThHnKe2wZljZ9lnmVF3FsXUA1FpMcx8E8bSKEbL3BKi9/S5a4Ry/R8q+jXxDhTZ88AbVD2MpQGIaryGWpte6+xuZgoyJpFcT/u7IImFpjLfBb3Dl5pUIkzVhYlpa26W6oMAAAAAAAAEwjCCBL4wggOmoAMCAQICEAbY2QTVWENG9oovp1QifsQwDQYJKoZIhvcNAQELBQAwYTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEgMB4GA1UEAxMXRGlnaUNlcnQgR2xvYmFsIFJvb3QgQ0EwHhcNMjEwNDE0MDAwMDAwWhcNMzEwNDEzMjM1OTU5WjBPMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBEaWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFLs2VHcLzdT1jb7Jztw2blHzETVK1KZkYfLArsZAflLtzcuQog7d/jxNCemql6HYKI5RFW2x6fWMJR5yw0DS7SkuFWy/F5X7O7h8olA3uaUkFmEGBPVxNJ8Og3Z4Pf59NLZ0wiUabfDpkQ7VdRdCbifcfKYi4TG38jiCVTb8E0WACLhP/4vqdYSSJ7lq2iiJsVvKB83+lRqNWw7TfiNrSCS2K1SZrsx2fW4z7149YSXkTxv3FCfViEA4CxgQH6+coyu7SOJ4cnxSt01KjWl97DZPnKzlOiVrx4F45JAymu+0lPpBW5zvJcGVdta3mnK6InIBO10D1A0yEwB5PqmfUCAwEAAaOCAYIwggF+MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLdrouqoqoSMeeq02g+YssWVdrn0MB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcnQwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNybDA9BgNVHSAENjA0MAsGCWCGSAGG/WwCATAHBgVngQwBATAIBgZngQwBAgEwCAYGZ4EMAQICMAgGBmeBDAECAzANBgkqhkiG9w0BAQsFAAOCAQEAgDLOXgvdbloNCq/h1oTLwI76hXDt2l2zDPcrdUD+hQr68zF4t3BLGolYuoC982sd6X7PC7pYnFnUkNP9bP3QmG23cYJbz20LWgnQe97EQ9gqpN6eQSZfu4+Zy92u4ahvn4f+dLcfGyCrsU/G9WddXZs86f9p92Fs1tnz/TbGqwOIdtJLLnWG4/zYVX0mwhF33z4Ctnzzq3t6hjZvuPfYk3HPht9zMPp7q+0qWchChDsRFxpS88kOFH2iW3JnunHtV0dmxbgCSmU0XovQKjwgnFGZTOdSnvdrESsNkn4d6IrrNhZDh+oqY791P+vexAO7Cjz3MO/rr0z8izYQcz7zpGYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAA7MwggOvMIICl6ADAgECAhAIO+BWkEJGsaF1aslZkcdKMA0GCSqGSIb3DQEBBQUAMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowYTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEgMB4GA1UEAxMXRGlnaUNlcnQgR2xvYmFsIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDiO+ERct6opNOjV6pQoo8Ld5DJoqXuEs6WWwEJIMwBk6dOMLdT90PEaQBXneKNIt2HBkAAgQnOzhuDv9/NO3FG4tZmxwWzdicWj3ueHpV97rdIowja1q96DDkGZX9KXR+8F/irvu4o13R/eniZWYVoblwjMku/TsDoWm3jcL93EL/8AfaF2ahEEFgyqXUY1dGivkfiJ2r0mjP4SQhgi9RftDqEv6GqSkx9Ps9PX2x2XqBLN5Ge3CLmbc4UGo5qy/7NsxRkF8dbKZ4yv/Lu+tMLQtSrt0Ey2gzU7/iB1buNWD+1G+hJKKJw2jEE3feyFvJMCk4HqO1KPV61f6OQw68nAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQD3lA1VtFMu2bwo+IbG8OXsj3RVTAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3RVTANBgkqhkiG9w0BAQUFAAOCAQEAy5w3qkgTEgr63UScT1Kw9N+uBPV5eQijJBj8SyuEwC251cf+9MEfWMu4bZx6dOeYKasRteNwoKHNTIiZk4yRcOKrDxy+k6n/Y9XkB2DTo7+dWwnx1Y7jU/SOY/o/p9u0Zt9iZtbRbkGN8i216ndKn51Y4itZwEAj7S0ogkU+eVSSJpjggEioN+/w1nlgFt6s6A7NbqxEFzgvSdrhRT4quTZTzzpQBvcu6MRXSWxhIRjVBK14PCw6gGun668VFOnYicG5OGzikWyK/2S5dyVXMMAbJKPh3OnfR3y1tCQIBTDsLb0Lv0W/ULmp8+uYARKtyIjGmDRfjQo8xunVlZVt3gAAAAEAAAACaDIBAQAAAABdYW5vbjp0bHNmbGFnczB4MDAwMDAwMDA6aW1hZ2UtbGl0ZS5idWllbnJhZGFyLm5sOjQ0M15wYXJ0aXRpb25LZXk9JTI4aHR0cHMlMkNidWllbnJhZGFyLm5sJTI5AAA= request-method GET request-Accept-Encoding gzip, deflate, br response-head HTTP/2 200
content-type: application/json; charset=utf-8
server: Kestrel
content-encoding: gzip
content-length: 293
cache-control: public, max-age=18
date: Fri, 29 Dec 2023 22:30:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15768000
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept-Encoding
access-control-allow-methods: GET,POST,PUT,OPTIONS
access-control-allow-origin: *
X-Firefox-Spdy: h2
original-response-headers content-type: application/json; charset=utf-8
server: Kestrel
content-encoding: gzip
content-length: 293
cache-control: public, max-age=18
date: Fri, 29 Dec 2023 22:30:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15768000
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept-Encoding
access-control-allow-methods: GET,POST,PUT,OPTIONS
access-control-allow-origin: *
set-cookie: akaalb_image_buienradar=~op=~rv=30~m=~os=~id=6b0bfdc3a7ab45cf44a31454f1201883; path=/; HttpOnly; Secure; SameSite=None
X-Firefox-Spdy: h2
ctid 1 net-response-time-onstart 25 net-response-time-onstop 49 %

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 01:59:12 GMT

Those are really good questions!

1. We should assume that this is a real threat until it is proven that it is false positive based on the timeline of how it spread.

2. We do not know what to do about this if this a real infection.

3. A false positive, if caused by Firefox upgrade, should have started showing up at around the same time after the latest version of the Firefox was released, which was not the case here (the first mention on the 16th before FF 121 release).

Do you agree with these statements? I do not like where this is going…

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Jerryg50 — Sat, 30 Dec 2023 02:16:12 GMT

Microsoft Defender is reporting Trajon:HTML/Phish!pz is detected in Firefox cache.

Folder:
C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\gd1w3gjx.default-release\cache2\entries

Example of Cache File:
\077D332D18D04002F4E4F2029C7BBDBD6075BBD8

After deleting this cache file, scanning the complete system and also using Off Line Scanning had no viruses found. I also ran MRT ( MS Windows Malicious Software Removal Tool).

How I found this was when doing Windows Backup, I was getting failures. When investigating I found Defender was reporting Trajon:HTML/Phish!Pz. After closing Firefox and deleting the displayed cache file I was able to do the backup successfully.

After using Firefox again another cache file with a different set of codes showed up, and if the FF cache was scanned again I would get the malicious file warning again.

I saw in a posting the person removed uBlock and this issue disappeared for him. After removing it, so far I did not see this issue return. I keep manually scanning the entries folder and so-far no incidence.

I hope the author of uBlock becomes aware of this and fixes his software, if this is the case.

I am using Add Block Plus now.

--
From Google Search:

A false positive is another way of saying mistake. As applied to the field of anti-malware programs, a false positive occurs when the program mistakenly flags an innocent file as being infected.

The file detected by Defender may not be a genuine threat even though it was reported by Microsoft as one. These kinds of files are known as False Positives. One explanation for a false positive is that Microsoft Windows Defender may not have enough information about the file to determine that it is safe.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 02:23:29 GMT

I don't run uBlock, I run AdBlockPlus, still have this problem.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 02:28:17 GMT

And this file was flagged by Defender, right? You are correct there is no mentioning of the CloudFront.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Sat, 30 Dec 2023 02:29:19 GMT

1. I agree in general better safe than sorry. I want to be cautious here though not to devolve into fearmongering.

2. Obviously we can't address the root cause, but it seems to me like we don't currently have reason to believe there are any effects beyond interferring with backups, right? which is annoying but not particularly scary. It seems like if it is a real threat, defender is working properly and preventing it from doing any damage, no? Can we trust that when defender says it has quarantined or blocked a threat that it effectively protected us and everything is ok?

3. Could it be an update to defender rather than one to firefox? If so would it be any different? Are defender updates released the same to everyone at the same time?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 02:34:55 GMT

If this Phish is stealing the passwords to your banking sites, then who knows about the damage. Right? It manifested itself during the backups because it was being caught by backup snapshots.

I don’t honestly know. Fair enough?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

bballer — Sat, 30 Dec 2023 02:41:21 GMT

Fair, but it would need to have had the chance to get that info and then to also send it somewhere nefarious. Would defender quarantining/blocking it not have prevented it from doing those things?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 02:47:31 GMT

That’s how Phish works according to Microsoft web site. I found 5 pages long list of various HTML Phish sub variants on Microsoft site yesterday. Some of them were trying to still PayPal passwords, for instance. Look it up on Microsoft.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 02:54:51 GMT

One thing is not mentioned here yet:

some have the problem in the shadow copy, like me, but I don't get a flag on the normal real time cache. Others (like the TS "Issue_Report ") have Defender flagging on the real time cache, but I don't hear them about the Windows backup (which they probably don't use).

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

p4ppy — Sat, 30 Dec 2023 05:51:30 GMT

are you using any kind of adblocker software or the add on extensions from firefox

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 06:30:08 GMT

https://www.microsoft.com/en-us/wdsi/threats/threat-search?query=Trojan:HTML/Phish!&page=1

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Jerryg50 — Sat, 30 Dec 2023 09:04:45 GMT

I am puzzled. I am using Adblock Plus and no longer having this issue. I removed uBlock and it went away. I am very puzzled with this...

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Sat, 30 Dec 2023 09:07:26 GMT

All of you are forgetting this issue also occurs in Thunderbird. If cache2 is manually deleted in FF, backup still fails if TBird cache2 is not also cleared. Defender reports a TBird trojan location. uBlock for example is irrelevant to TBird. Also, I had the same failure after I deleted recovery/restore shadow copies but before the system could set a new restore point. Reason - TBird cache 2 was not cleared. It appears Windows will automatically set a restore point if all restore points have been deleted. I have no idea what the common thread is that gets logged in cache2 for both FF and TBird but I do know that for me and my wife's computer, the problem did not exist until the 26th at which time our scheduled daily backup failed. Maybe coincidental but we had upgraded FF prior to that happening which was after our backups of the 25th were successful. Since electing to have FF and TBird clear the cache when closing we have no problem. FF and TBird are/were both placing entries in cache 2 that Defender 'thinks' is a trojan. In my system Defender says it cannot remove the trojan from either cache file. I have tried to paste the Windows/Defender anitvirus report page but this site will not allow it. It says I do not have permission to upload images.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 11:21:54 GMT

More differences: you report the virus is found in

C:\Users\UserName\AppData\ etc....

For me and some others it is in (as Defender shows)

file: \Device\HarddiskVolumeShadowCopy23\Users\username\AppData\ etc...

Same path, but for us it is in the shadowcopy, the Windows backup. And it ONLY hits while making a backup while Firefox is running and using its cache, not while using only Firefox. The backup is aborted then. When you start the backup again, the fatty number in my path, as the filename, vary per Defender alert.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 12:47:39 GMT

Erik,

No, I am not reporting the different path. This happens in my backup shadow copies just like in yours. Perhaps, that c: drive location is coming from how ShadowCopyView tool reports the same shadow copy.

i am not sure in understand your last sentence about some fatty numbers…

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Sat, 30 Dec 2023 12:59:00 GMT

backup failed again last night, fails on one single file in cache.

scanning that file shows nothing. scanning the file pulled from the shadow copy shows nothing.

contents of offending file:

'use strict' class DisplayMode { constructor() { this.mode = 'night'; this.fontStyle = 'sans'; this.fontSize = 'default'; this.allowCookies = false; this.cookies = {}; this.ariaText = { 'day': 'Toggle Display Mode - Day Mode selected', 'night': 'Toggle Display Mode - Night Mode selected', 'serif': 'Font Style Serif', 'sans': 'Font Style Sans Serif', 'default': 'Default Font Size', 'large': 'Large Font Size', 'serif-sel': 'Font Style Serif - Selected', 'sans-sel': 'Font Style Sans Serif - Selected', 'default-sel': 'Default Font Size - Selected', 'large-sel': 'Large Font Size - Selected', }; this.guessSettings(); this.loadCookies(); this.loadSettings(); } bindButton( className, action ) { Array.from( document.getElementsByClassName( className ) ) .forEach((x) => { x.addEventListener('click', () => { action( this ); }); }); } guessSettings() { if( document.body.classList.contains('theme-night') ) { this.mode = 'night'; } else { this.mode = 'day'; } if( document.body.classList.contains('font-serif') ) { this.fontStyle = 'serif'; this.setSelectedButton('btn-serif', 'btn-sans-serif'); this.updateAriaText('font-sans-status', 'sans'); this.updateAriaText('font-serif-status', 'serif-sel'); } else { this.fontStyle = 'sans'; } if( document.body.classList.contains('font-large') ) { this.fontSize = 'large'; this.setSelectedButton('btn-font-large', 'btn-font-default'); this.updateAriaText('font-default-status', 'default'); this.updateAriaText('font-large-status', 'large-sel'); } else { this.fontSize = 'default'; } } loadCookies() { this.cookies = {}; let cookieList = document.cookie.split(';'); for( let cookie of cookieList ) { let cookieChunks = cookie.split('='); this.cookies[cookieChunks[0].trim()] = cookieChunks[1]; } } loadSettings() { if( 'cookies' in this.cookies ) { // Find out if we can store extra cookies. this.allowCookies = (this.cookies['cookies'] == 'allow'); } if( 'displayMode' in this.cookies ) { this.setMode( this.cookies['displayMode'], false ); } if( 'fontStyle' in this.cookies ) { this.setFontStyle( this.cookies['fontStyle'], false ); } if( 'fontSize' in this.cookies ) { this.setFontSize( this.cookies['fontSize'], false ); } } setMode( mode, saveChange=true ) { if( this.mode == mode ) return; let oldMode = this.mode; this.mode = mode; this.updateAriaText('display-mode-status', this.mode ); document.body.classList.remove( 'theme-' + oldMode ); document.body.classList.add( 'theme-' + mode ); if( saveChange ) { this.setCookie('displayMode', mode); } } setFontStyle( style, saveChange=true ) { if( this.fontStyle == style ) return; this.fontStyle = style; // TODO: Aria text update here if( this.fontStyle == 'serif' ) { document.body.classList.add('font-serif'); this.setSelectedButton('btn-serif', 'btn-sans-serif'); this.updateAriaText('font-sans-status', 'sans'); this.updateAriaText('font-serif-status', 'serif-sel'); } else { document.body.classList.remove('font-serif'); this.setSelectedButton('btn-sans-serif', 'btn-serif'); this.updateAriaText('font-sans-status', 'sans-sel'); this.updateAriaText('font-serif-status', 'serif'); } if( saveChange ) { this.setCookie('fontStyle', style ); } } setFontSize( size, saveChange=true ) { if( this.fontSize == size ) return; this.fontSize = size; // TODO: Aria text update here if( this.fontSize == 'large' ) { document.body.classList.add('font-large'); this.setSelectedButton('btn-font-large', 'btn-font-default'); this.updateAriaText('font-default-status', 'default'); this.updateAriaText('font-large-status', 'large-sel'); } else { document.body.classList.remove('font-large'); this.setSelectedButton('btn-font-default', 'btn-font-large'); this.updateAriaText('font-default-status', 'default-sel'); this.updateAriaText('font-large-status', 'large'); } if( saveChange ) { this.setCookie('fontSize', size ); } } updateAriaText( cssClass, textId ) { Array.from( document.getElementsByClassName( cssClass ) ). forEach((x) =>{ x.textContent = this.ariaText[textId]; }); } cycleMode() { switch( this.mode ) { case 'day': this.setMode('night'); break; case 'night': this.setMode('day'); break; } } validateMode( mode ) { if( mode == 'day' || mode == 'night' ) return true; return false; } setCookie( name, value ) { // Don't save the cookie if we're not allowed. Is this a required // cookie? I don't know. //if( this.allowCookies == false ) // return; document.cookie = name + '=' + value + '; Max-Age=2592000; Path=/'; } setSelectedButton( selectedClass, deselectedClass ) { Array.from( document.getElementsByClassName( selectedClass ) ). forEach((x) =>{ x.classList.add('selected'); }); Array.from( document.getElementsByClassName( deselectedClass ) ). forEach((x) =>{ x.classList.remove('selected'); }); } }; window.addEventListener('load', ()=>{ let mode = new DisplayMode(); mode.bindButton('btn-display-mode', ( dm ) => { dm.cycleMode(); }); mode.bindButton('btn-sans-serif', ( dm ) => { dm.setFontStyle('sans'); }); mode.bindButton('btn-serif', ( dm ) => { dm.setFontStyle('serif'); }); mode.bindButton('btn-font-default', ( dm ) => { dm.setFontSize('default'); }); mode.bindButton('btn-font-large', ( dm ) => { dm.setFontSize('large'); }); }); ¥ê¤í e#ãe#öFe;e˜^c j O^partitionKey=%28https%2Cpenny-arcade.com%29,:https://www.penny-arcade.com/js/displaymode.js?v=1648223347 strongly-framed 1 security-info FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAUGMIIFAjCCA+qgAwIBAgISBPtgOA2VbRP+6uH34D5W/14VMA0GCSqGSIb3DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzAeFw0yMzEyMDcyMTUxMTNaFw0yNDAzMDYyMTUxMTJaMB0xGzAZBgNVBAMMEioucGVubnktYXJjYWRlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOSC9NTlg4QpjkO5sqq66dHBTyI60RPYVDNNnX5cgO2ainO+9Wym3xfWsN5xr9llcICP8LfPvj4CBkQcIKSDn0iR7obCS84ylzW2ORwniHoA5m16CUXUPJoEYxQmirCcD8sE9TMjZ+6JN0uyrl14Z/j8HhtMIp793SeaA45vw59iPDB0y9BqhVnlgdy6oVAOLDNX+SucgjEdoIvynTHSQlDza3Fu8WejlJUP4htlL/0WKMYzncKX9GoXbx9a8mbpbsSg7sukXuoZaXCr/VGqpDCmlomopaMYXqyt9SyWLlBOwuE84jsS2XRFlMuiCuX1cSXUDPfnxt+Hv63G+gQLIZkCAwEAAaOCAiUwggIhMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQURQc6jdvJR99P5NiC4eE1n2gHQ0cwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8wLwYDVR0RBCgwJoISKi5wZW5ueS1hcmNhZGUuY29tghBwZW5ueS1hcmNhZGUuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHUASLDja9qmRzQP5WoC+p0w6xxSActW3SyB2bu/qznYhHMAAAGMRnpfPAAABAMARjBEAiBfRrc3QZAMG3H1GFGGbCU7AzEFZFFoN44vuXfPTwI+oQIgK6q+QCB9COHkAkt3lADQQ75YjA0rvei0wajMgsq4j3gAdgA7U3d1Pi25gE6LMFsG/kA7Z9hPw/THvQANLXJv4frUFwAAAYxGel83AAAEAwBHMEUCIQDWe+X/q1noTEL93uKdVX0UUtcRknxMOXsERKVKGMyHiAIgLAU3dps/NJ1BtYzIwwpRMRmq50JF7tU18tArlF7Vzz4wDQYJKoZIhvcNAQELBQADggEBAALLskQmlT2w7jt0zE4dqiy/1o439vSNSZqFFEbKM/XoJaBB0GBvgTxR+3tlnH8ei9KeeUZXXcdPG7D/v56LEdO9uTH1k0cEJg1PVkUsXuQZbndwpFdfUb2FTN1K+z/+o2QVokMnJzLFRIZJmW7tq6OWqKdWcHQeaoDsOHVWlF9lSLTRcLi2WfjMOdlxA4a6Vws9P1WT05b4/KEAWlLGKjRcv/6JtRpyjz7EbTvh2ZEnizvklLNKcXqcnqhxOKUnO0rRKN0u0T94MOMZok+WzjxL413zwDlnrnFOuHG1px8NBqxGylVxJIvCKmIXRW4RgCEt71IEZPnuq1AbcWLmMD8TAQAEAAAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYAA2YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAABQYwggUCMIID6qADAgECAhIE+2A4DZVtE/7q4ffgPlb/XhUwDQYJKoZIhvcNAQELBQAwMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMTAlIzMB4XDTIzMTIwNzIxNTExM1oXDTI0MDMwNjIxNTExMlowHTEbMBkGA1UEAwwSKi5wZW5ueS1hcmNhZGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5IL01OWDhCmOQ7myqrrp0cFPIjrRE9hUM02dflyA7ZqKc771bKbfF9aw3nGv2WVwgI/wt8++PgIGRBwgpIOfSJHuhsJLzjKXNbY5HCeIegDmbXoJRdQ8mgRjFCaKsJwPywT1MyNn7ok3S7KuXXhn+PweG0winv3dJ5oDjm/Dn2I8MHTL0GqFWeWB3LqhUA4sM1f5K5yCMR2gi/KdMdJCUPNrcW7xZ6OUlQ/iG2Uv/RYoxjOdwpf0ahdvH1ryZuluxKDuy6Re6hlpcKv9UaqkMKaWiailoxherK31LJYuUE7C4TziOxLZdEWUy6IK5fVxJdQM9+fG34e/rcb6BAshmQIDAQABo4ICJTCCAiEwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRFBzqN28lH30/k2ILh4TWfaAdDRzAfBgNVHSMEGDAWgBQULrMXt1hWy65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iub3JnLzAvBgNVHREEKDAmghIqLnBlbm55LWFyY2FkZS5jb22CEHBlbm55LWFyY2FkZS5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdQBIsONr2qZHNA/lagL6nTDrHFIBy1bdLIHZu7+rOdiEcwAAAYxGel88AAAEAwBGMEQCIF9GtzdBkAwbcfUYUYZsJTsDMQVkUWg3ji+5d89PAj6hAiArqr5AIH0I4eQCS3eUANBDvliMDSu96LTBqMyCyriPeAB2ADtTd3U+LbmAToswWwb+QDtn2E/D9Me9AA0tcm/h+tQXAAABjEZ6XzcAAAQDAEcwRQIhANZ75f+rWehMQv3e4p1VfRRS1xGSfEw5ewREpUoYzIeIAiAsBTd2mz80nUG1jMjDClExGarnQkXu1TXy0CuUXtXPPjANBgkqhkiG9w0BAQsFAAOCAQEAAsuyRCaVPbDuO3TMTh2qLL/Wjjf29I1JmoUURsoz9egloEHQYG+BPFH7e2Wcfx6L0p55Rlddx08bsP+/nosR0725MfWTRwQmDU9WRSxe5Blud3CkV19RvYVM3Ur7P/6jZBWiQycnMsVEhkmZbu2ro5aop1ZwdB5qgOw4dVaUX2VItNFwuLZZ+Mw52XEDhrpXCz0/VZPTlvj8oQBaUsYqNFy//om1GnKPPsRtO+HZkSeLO+SUs0pxepyeqHE4pSc7StEo3S7RP3gw4xmiT5bOPEvjXfPAOWeucU64cbWnHw0GrEbKVXEki8IqYhdFbhGAIS3vUgRk+e6rUBtxYuYwP2YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAABRowggUWMIIC/qADAgECAhEAkSsISs8MGKdT9tYuJadfWjANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yMDA5MDQwMDAwMDBaFw0yNTA5MTUxNjAwMDBaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALsCFSjM9qCU0w8S7I1VksP4gvGZpnpCiKddJqq1K7nFTLGvjmv5dcij1w9HlBRVNVeMnqiiORn1gjxCqU5u9TvDLtuNwLBc81k45+3PafBaCxu+wJQkJYf6N3GzE+ccrOGb79vkO0VSRZapwVPONMhS7rWu7Y/eYHDipVSrtm0Ol6VANGsr07xm62Y0fPpri49XKZn4MBddunJv+4HFrdKGWD0Xx+cJu/Er94bcwdpxXdRG48ytJcGIvGBndWaz8Rj3olzmU/86iLZHpf8TGOqYCXc/nVP5zwHl9aZwFxSvY6T/mbOTndxTpwb+SIUdoWmuJXW7E8xSA/XtUaGL2xUCAwEAAaOCAQgwggEEMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUFC6zF7dYVsuuUAlA5h+vnYsUwsYwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wIgYDVR0gBBswGTAIBgZngQwBAgEwDQYLKwYBBAGC3xMBAQEwDQYJKoZIhvcNAQELBQADggIBAIXKTkc+o/eFRIW81Wd4sphjrXVNHpY9M2VyVC2BoOrD7fggv1/Mt3AAt2479l6U3uQgn6bvi7ID56K1FjyRzrTtOQLnfCWKR+Zlbj9G9NnwzpQr7lTOEryMJ0u4wZgvoq/NcZFKCLfIuCN7BC0I+QhXPoPZBDMKRyF4CYInwyrIm7nOXPJkyMC+ecBPjm1EDF6Suy73ixDh6B1EKdtZIO1juSH4EiaUk1egHWUEwQoirhANQ5ehGB9+4OCGN7Vasb0wv4duKyr/IU4bBcP1GJfwXqzDpbhq8C68OzO57kvezPzkr4QLhj/AVUM29mjhNhdqjpnR/6VApzS3wNBjOTU5dW7yunbIkwLpqUtsF84MAtm9gfuft2jUBmWzgj13U/iOeQOtCjEHdSpD2FWXcsQpDvfEXU7IrkaEMNfyhV8YoXm7515wiwfhhpPDuY/cYXElKq/f7SVQUmiLktzl1rXj2n3Qh2yEITGugvX7uavIiRc94UzlOA72vSu9loEU69XbPSCnflnT4vhY+Vu4SM3+XE8WKf4eVSOvyBGwjep8k5AXL/2soglHRj/w6bC3/yhNaDLWZ14eaaOTuPWdiy8L0lJDpm8yV2VNMoHfOFOFXX5dZinquN3klbXNtVYSQs3ETsYlOERQbezOAFUY/ulJZNROypectFvAc6iruEfCZgoyJpFcT/u7IImFpjLfBb3Dl5pUIkzVhYlpa26W6oMAAAAAAAAFbzCCBWswggNToAMCAQICEQCCEM+w0kDjWURj4LtjgosAMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XCov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpLwYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+DLtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5ysR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZXmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBcSLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2qlPRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TNDTwIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIBAFUfWKm8sqhQ0Ayx2BppICcpCKxhdVyKbviC5Wkv1fZWS7m4cxBZ0yGXfudMcfuy0mCtOagL6hchVoXxUA5Z687gWem6yRXvhp2PhID25OmRkNwXm2IbRfBmldJ8b8LqO+8fz8vWrifxqbDIrv19fpr6IgTr/9l/6pErIrEXDo/yijRbWNj8AclUubgmzIqIM4lMLYQ8gt/ullcFuiy798S3x047gr4xyCJzc5LRwoCkOTkQMyOCTDyfhrJVmB2+KYaMIpue4ms7VzqCcE3cCceJywoHTWzoXY7J786rx7u1K05F1krQJszlcsoIaqWV4xWh96TtySxfpfv/rCgCLr7Xe7vjcXuQFtMHXkZTfDcHQozTxJac1Zm1KuCVGoBIrkw5B87MR6RSlSu6uPut0jNTfeUdTW3VobHHQm/mQCc1XKMotweN540zkOcjn/tQnHlsRtW0FbOWbn6bDJY6uFItP9Zb4fsIwoT+JKijidqsauEYKrGoQ2Fb0x/cO4128i3ojXXfFzNsPVP7e8tBX//cotBhOOGWuKxdizfXddUzwJkRrp1BwXJ1hL4CQUJfZyRIlNGbJ74HP7m4T4F0UeF6t+2dI+K+4NUoBBM8MQOe3Xpsj8YHGMZ/3keOPyieBAbPpVQ0d73siZvpF0PfW9tf/o4eV6LNQJ1+YiLa3hgnAAAAAQAAAAJoMwABAAAAABh3d3cucGVubnktYXJjYWRlLmNvbTo0NDMAAA== request-method GET response-head HTTP/3 200 server: nginx date: Fri, 29 Dec 2023 19:54:11 GMT content-type: application/javascript content-length: 6746 last-modified: Fri, 25 Mar 2022 15:49:07 GMT etag: "623de473-1a5a" accept-ranges: bytes via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 X-Firefox-Http3: h3 original-response-headers server: nginx date: Fri, 29 Dec 2023 19:54:11 GMT content-type: application/javascript content-length: 6746 last-modified: Fri, 25 Mar 2022 15:49:07 GMT etag: "623de473-1a5a" accept-ranges: bytes via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 ctid 2 uncompressed-len 0 net-response-time-onstart 100 net-response-time-onstop 102 Z

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

BarnStormer — Sat, 30 Dec 2023 12:59:23 GMT

I am having a similar issue also.

Defender is detecting Trojan:HTML/Phish!pz in files in C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\ xxxxxxxx.default-release\cache2\entries and quarantining and blocking them. So far, I have not found any evidence of threats outside of this particular folder.

After doing full scans with Microsoft Security Essentials (MSE), Housecall and Stinger , there are no other threats detected . After I run Firefox the issue is detected again by MSE when running Windows Backup . This behavior has reoccurred consistently with the threats being detected in the Firefox “cache2\entries” folder again.

Here are the Details:

Win7-64, running Firefox 115.6esr updated on 12/19/2023

Microsoft Security Essentials (MSE) definitions created and installed on 12/26/2023 before Windows Backup started. Security intelligence update version: 1.403.1150.0 Released on 12/26/2023 11:16:01 AM & Installed on 12/26/2023 07:12 AM

The issue occurred on 12/26/2023 at 7:01PM EST – 1 minute after my daily Windows Backup started.

Omitting “C:\Users\UserName\AppData\Local\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\cache2\entries” from the backup selection allows Windows Backup to complete without issue.

I have system restore enabled and now:

Every time MSE updates the Definitions a restore point is created. Displays as “Time: Windows Update: Critical Update” in the system restore selection window
Every time a Windows Backup is run a restore point is created. (cache2 omitted from backup) Displays as “Time: Automatic Restore Point: System” in the system restore selection window

The entries in system restore started on 12/26/2023 at 7:00:01PM which is 1 second after the system backup started on 12/26/2023 at 7:00:00PM

I am very concerned knowing that this is causing issues with system restore. Sure seems like Windows Defender or Microsoft Security Essentials (MSE) is at fault when running Windows System Backup.

Can someone with a similar setup check to see if restore points are being created on their system?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 13:01:29 GMT

Erik,

I think this is a great idea to check if we can run our backups with the shadow copies when Firefox is not running and not actively using cache. Perhaps, there is some weird new interaction, which didn’t get flagged before, between backups and cache if it is actively being used.

I typically used Firefox while running those backups….

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 13:01:00 GMT

Ah, you are viewing through that third party viewer, good one. I report what Defender shows.

Sorry, the correct English term is Bold 😅

file: \Device\HarddiskVolumeShadowCopy23\Users\username\AppData\Local\Mozilla\Firefox\Profiles\vk8k2xhg.default\cache2\entries\1254CDECF65EA9AB63367A13E628BD4DFE81BC7B

So the bold parts vary per Defender alert.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Sat, 30 Dec 2023 13:08:19 GMT

my backup runs at 22:00 with everything closed. running backup now with firefox open but cache cleared.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 13:19:32 GMT

On my system (W10) a restore point has been created every time I have started a backup, also when Defender stopped it. So I too have a few....

Remark: while looking at the restore points, I saw that on December 15th MS has done an update and made a restore point: "Installation Program for Windows modules". Just say this because the first that posted the problem did so on December 16th.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 14:34:26 GMT

@dvg

I tried with FF + TB closed, no luck. I tried with FF+TB closed, and the large FF cache cleared, no luck.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

BarnStormer — Sat, 30 Dec 2023 14:34:14 GMT

On my system, restore points have not been created since 06/2023 when I replaced the drive. That is until 12/26/2023 when Windows Backup was terminated by MSE. So in my case there has been no system updates other than MSE virus defs.

Has your system been creating the restore points since "December 15th MS has done an update" or did it start creating the restore points at a later time when you noticed the backup first failed?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 14:47:29 GMT

Both. Windows made a restore point just before (because) the update, and after that, Windows made a few just because it always does, and then after my weekly BU program schedule kicked in yesterday Dec 29th, and I retried 6 times to make that BU, it made a restore point before every of the 6 times.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Sat, 30 Dec 2023 15:06:36 GMT

did you delete the shadow copies?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

BarnStormer — Sat, 30 Dec 2023 15:12:50 GMT

I too retried the backup numerous times and each time a restore point was created.

Can you try manually updating your virus defs. and see if it creates a restore point?

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 15:34:25 GMT

No, why should I, as far as I know (...) there's nothing bad in there, some stated that the flagged files are exact as in the real time cache.

For now I think we should wait until we know more.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Sat, 30 Dec 2023 15:39:51 GMT

my experience is the backup will fail if there is an "infected" file in it. Even if the offending file is cleared from the computer.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

erikdenhouter — Sat, 30 Dec 2023 15:46:10 GMT

My definition files were (auto) updated at 15:01 GMT (today), and no restore point was created. Manual updating resulted in nothing new.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

Flinx — Sat, 30 Dec 2023 17:21:36 GMT

backup completed nothing stopped it.

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

davidrmoran — Sat, 30 Dec 2023 18:31:52 GMT

how about just deleting firefox? (sorry for naive query)

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

dvg — Sat, 30 Dec 2023 18:50:59 GMT

What a wonderful idea! Seriously though, has anyone had similar problems with the other web browsers?

I keep wondering what might be the root cause? This problem manifested itself first on 12-16-23 at least in this thread. The Firefox has released 121.0 on 12-19-23. Many people started noticing this issue around December 25-26-27th. Windows Defender updates itself quite regularly, so if we assume that Defender is the culprit, then

- we should be seeing the similar behavior with the other browsers since they also cache the web pages

- we should have started seeing this right after Defender’s update

Re: Microsoft Defender reporting Trojan:HTML/Phish!pz threat with Firefox

RobW — Sat, 30 Dec 2023 18:55:33 GMT

That would certainly do it. But instead just disable FF from maintaining cache2 file entries and you'll have no issues. If you use Thunderbird you need to do that as well.

My daily backup is working perfectly.