Adobe Flash Player out of date malware message
When accessing Thunderbird in the mail and newsgroups window, I get a malware ad in the pane just below the email message window where normally the contents of a highlighted email is displayed (see attached image).
The ad says "Adobe Flash Player" is out of date and presents buttons with options to update now or later.
As soon as I click on an email, the content is shown in the pane and the malware ad disappears. It reappears whenever I re-open or start Thunderbird. I am sure it is malware because I inadvertently clicked on it once and it installed a number of programs that promised to "clean" my Mac but are known as shams.
I have tried to search for a way to remove this annoyance from Thunderbird but Googling turns up suggestions on how to remove add-ons from Firefox. I have found nothing for Thunderbird specifically. Can someone help with this?
Bewurke troch James S. op
Keazen oplossing
That isn't the point. You said there is no Flash on that computer, and sure enough, Flash is installed. Get rid of it entirely, then see if you still get the Flash update prompt.
Dit antwurd yn kontekst lêze 👍 0Alle antwurden (12)
(see attached image)
There is no screenshot.
Here is the screen shot.
Do you have Flash installed on your computer? If so, which version?
No. I do not. This is not about Flash. It's a scam that installs a bunch of other crap on the computer if you click on OK or install now.
Please post your Troubleshooting Information.
At the top right of the Thunderbird window, click the menu button 
, then select Help > Troubleshooting Information.
Press the "Copy text to clipboard button" and paste the information into your reply.
Application Basics
Name: Thunderbird Version: 52.9.1 User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 Profile Folder: Show in Finder Application Build ID: 20180709124824 Enabled Plugins: about:plugins Build Configuration: about:buildconfig Memory Use: about:memory Profiles: about:profiles
Mail and News Accounts
account1:
INCOMING: account1, , (pop3) pop.att.yahoo.com:995, SSL, passwordCleartext
OUTGOING: , smtp.att.yahoo.com:465, SSL, passwordCleartext, true
account3:
INCOMING: account3, , (none) Local Folders, plain, passwordCleartext
account8:
INCOMING: account8, , (pop3) pop.gmail.com:995, SSL, passwordCleartext
OUTGOING: , smtp.gmail.com:465, SSL, passwordCleartext, true
account10:
INCOMING: account10, , (exquilla) outlook.office365.com:443, SSL, passwordCleartext
OUTGOING: , null, plain, passwordCleartext, true
account11:
INCOMING: account11, , (pop3) pop.gmail.com:995, SSL, passwordCleartext
OUTGOING: , smtp.gmail.com:465, SSL, passwordCleartext, true
Crash Reports https://crash-stats.mozilla.com/report/index/bp-58609cf5-7224-481c-b72b-5b07e0171114 (11/14/17) https://crash-stats.mozilla.com/report/index/bp-94f68536-a042-41b2-a778-e9ed80170713 (7/13/17) https://crash-stats.mozilla.com/report/index/bp-7a5ad190-d542-4cf1-85c0-9a8022120928 (9/28/12) https://crash-stats.mozilla.com/report/index/bp-c0ef9d52-00c0-4f41-94f4-c1fd02120928 (9/28/12)
Extensions ExQuilla for Microsoft Exchange, 60.0, true, [email protected] Lightning, 5.4.9.1, true, {e2fda1a4-762b-4020-b5ad-a41df1933103} Contacts Sidebar, 0.7.1, false, {4dce973c-25a5-4657-8e37-6c2a85c24a7e} Google Search for Thunderbird, 1.0, false, [email protected] Mail Merge, 4.12.0, false, [email protected] Remove Duplicate Messages, 0.1.14, false, {12345678-1234-1234-1234-123456789abc} ThunderBrowse, 3.82, false, [email protected] Toolbar Buttons, 1.1.1-signed.1-signed, false, {03B08592-E5B4-45ff-A0BE-C1D975458688}
Important Modified Preferences
Name: Value
accessibility.typeaheadfind.flashBar: 0
browser.cache.disk.capacity: 358400
browser.cache.disk.filesystem_reported: 1
browser.cache.disk.smart_size_cached_value: 358400
browser.cache.disk.smart_size.first_run: false
browser.cache.disk.smart_size.use_old_max: false
extensions.lastAppVersion: 52.9.1
font.internaluseonly.changed: false
font.name.serif.x-western: Arial
mail.openMessageBehavior.version: 1
mail.spotlight.firstRunDone: true
mailnews.database.global.datastore.id: dd7ccce3-3057-3149-9d78-b101f936e20
mailnews.database.global.indexer.enabled: false
mailnews.database.global.views.global.columns: {"threadCol":{"visible":true,"ordinal":"1"},"flaggedCol":{"visible":true,"ordinal":"3"},"attachmentCol":{"visible":false…
media.gmp.storage.version.observed: 1
media.webrtc.debug.log_file: /var/folders/9_/20ltnwqd2wv2br9lg_50xmph0000gn/T/WebRTC.log
network.auth.force-generic-ntlm-v1: true
network.automatic-ntlm-auth.trusted-uris: https://outlook.office365.com
network.cookie.prefsMigrated: true
network.predictor.cleaned-up: true
places.database.lastMaintenance: 1534635480
places.history.expiration.transient_current_max_pages: 84079
plugin.importedState: true
plugin.state.adobepdfviewernpapi: 0
plugin.state.amazonmp3downloaderplugin: 0
plugin.state.browserplus: 0
plugin.state.couponprinter-firefox_v: 0
plugin.state.fbplugin: 0
plugin.state.flash: 0
plugin.state.flip4mac wmv plugin: 0
plugin.state.iphotophotocast: 0
plugin.state.officelivebrowserplugin: 0
plugin.state.ovshelper: 0
plugin.state.pdf browser plugin: 0
plugin.state.picasa: 0
plugin.state.quicktime plugin: 0
plugin.state.realplayer plugin: 0
plugin.state.silverlight: 0
plugin.state.webex: 0
print.macosx.pagesetup-2: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VO…
security.disable_button.openCertManager: false
security.sandbox.content.tempDirSuffix: {3ec9042c-6bed-2141-95df-afc325461202}
Graphics
GPU #1
Vendor ID: 0x8086
Device ID: 0x5927
Features
WebGL Renderer: Intel Inc. -- Intel(R) Iris(TM) Graphics 650 -- 2.1 INTEL-10.36.19
AzureCanvasBackend: skia
AzureCanvasAccelerated: 0
AzureFallbackCanvasBackend: none
AzureContentBackend: skia
TileHeight: 1024
TileWidth: 1024
JavaScript
Incremental GC: 1
Accessibility
Activated: 0 Prevent Accessibility: 0
Library Versions
Expected minimum version
Version in use
NSPR
4.13.1
4.13.1
NSS
3.28.6
3.28.6
NSS Util
3.28.6
3.28.6
NSS SSL
3.28.6
3.28.6
NSS S/MIME
3.28.6
3.28.6
Find the line 'Enabled Plugins' in the Troubleshooting Information and click about:plugins. What's shown there?
Shockwave Flash
File: Flash Player.plugin Path: /Library/Internet Plug-Ins/Flash Player.plugin Version: 30.0.0.154 State: Disabled Shockwave Flash 30.0 r0
MIME Type Description Suffixes application/x-shockwave-flash Shockwave Flash swf application/futuresplash FutureSplash Player spl
From the looks of this, the Flash plugin should be disabled.
Keazen oplossing
That isn't the point. You said there is no Flash on that computer, and sure enough, Flash is installed. Get rid of it entirely, then see if you still get the Flash update prompt.
So I removed those files (shockwave flash and futuresplash player), quit and restarted Thunderbird, spam ad still there in the content pane.
I believe that version of Flash got installed when I stupidly clicked on that ad. The malware then installs Flash as well as other programs that infect your Mac or PC.
I think the cause of the problem is described here, generally: https://malwaretips.com/blogs/remove-adobe-flash-player-is-out-of-date-popup/
The question is, how to remove that message from Thunderbird. I will ignore it so I don't think it can do any harm, but I just want it gone and without having to purchase some other program to remove the adware, which is what I now think this is.
Bewurke troch James S. op
The question is, how to remove that message from Thunderbird.
You posted a link to an article above. Did you read the article? Did you follow the instructions to remove the “Adobe Flash Player is out of date” Pop-up Scam as described in the article?