Uncertain Firefox dialog

My son in Kent gets an occasional dialog box when running Fire fox.

Opening pdj
You have chosen to open:

pdj

which is: application/octet-stream
from: http[colon]//pixel.fetchback.com

What should Firefox do with this file?

etc.

He clicks the Cancel button but is wondering why it's happening?

Googling seems to suggest pixel.fetchback is some sort of advertising but I can't find anything else.

Any thoughts?

Edit: He's just emailed me witrh another. This time it's

You have chosen to open:

search

which is: application/octet-stream
from: http[colon]//www.wowhd.co.uk

Clearly he's got something on his PC which may be adware, or it may be more malicious.

Edited by cheshire_man (Fri 16-Jan-15 08:19:22)

It might be an idea for him to run Malwarebytes. Followed by a full system scan by his IS Security, whatever it is.

Edited by RobertoS (Fri 16-Jan-15 18:02:45)

Yes, I've already suggested that, and SuperAntispyware.

By IS Security I assume you mean his AV?

Yes. AV + Firewall (from the same company) = Internet Security Suite. I tend to prefer that arrangement to AV from one and firewall from another.

He's running Win 7 & MSE. So both firewall and AV from MS.

I need to talk to him when he gets home from work as the sites that seem to be popping up relate to music, DJ, etc. and that is something he has a great interest in.

Hopefully I'll have a Teamviewer session later and can have a look around his FF setup, add ons, whatever.

Good idea to run Malwarebyeds as well SAS.

I've had a Teamviewer session for 45 minutes: Malwarebytes ran clean; SAS quick scan ran clean. Full SAS scan now under way, that'll take several hours so I'll leave it overnight.

I doubt if it will find anything.

I went looking around for single-pixel malware, as it was talked about a lot a year or so ago. Once I discounted the Pixel virus, in the end I came across a forum discussion somewhere where this link was posted.

I think that is what he is observing.

Hmm. Apart from using the likes of Ghostery not sure if there's anything he can do - apart from keep away from such sites.

The full SAS didn't find anything of significance (just 4 'normal' tracking cookies). The odd thing was the SAS failed when trying to update the definitions. I uploaded them from my PC to sort that.

I decided to un-install and re-install Firefox. Save the Bookmarks and used Revo to completely clean of FF leftovers. Reinstalled FF - and it couldn't access the internet! Evidently Internet Options were set to use a proxy server. Changed it to normal settings, no proxy. FF worked fine, and SAS was able to update.

So wondering whether something somewhere changed the proxy server setting. FWIW the settings were:
Use proxy
HTTP 127,0,0,1 Port 49164
Secure 127,0,0,1 Port 49164
Exceptions <-loopback>;*.local

I've no whether this may be significant (though 127,0,0,1 is for local machine)

Anyway we'll see over the coming days whether it's any better.