MozillaZine

Tabs open automatically with malware sites

User Help for Mozilla Firefox
oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 1st, 2018, 12:30 pm

This just started about a week ago. Very often when I start Firefox one or 2 more tabs open with gambling, porn, phishing or other undesirable sites. I've run MS Security Essentials with nothing found, also Malwarebytes, which now flags the tabs, but apparently cannot prevent them opening, even when it's the same domain over and over again. This makes me wonder if it's something in Firefox or an add-on causing this. Any ideas how to stop it?

Firefox Quantum 61.0.1
Windows 7

fixit7
 
Posts: 158
Joined: May 19th, 2015, 3:11 pm

Post Posted August 1st, 2018, 12:47 pm

The best thing is to use a host file. It will block those sites. If a site is not in there, you can add it.

You can get it here.

http://winhelp2002.mvps.org/hosts.htm

Brummelchen
 
Posts: 4616
Joined: March 19th, 2005, 10:51 am

Post Posted August 1st, 2018, 1:37 pm

run adwcleaner and post log
https://www.malwarebytes.com/adwcleaner/

provide some information please (text, not raw)
https://support.mozilla.org/en-US/kb/us ... ix-firefox

maybe we find some malicious extension which has payload.
crappy sites dont load without reason - either you visit strange sites yourself or you have malware in your system or in firefox.

jscher2000

User avatar
 
Posts: 10854
Joined: December 19th, 2004, 12:26 am
Location: Silicon Valley, CA USA

Post Posted August 2nd, 2018, 3:52 pm

Which video or MP3 downloader(s) are you using? Some have been compromised recently and are now gone from the Add-ons site, but not blocked in existing installations.

James
Moderator

User avatar
 
Posts: 27658
Joined: June 18th, 2003, 3:07 pm
Location: Made in Canada

Post Posted August 2nd, 2018, 4:05 pm

Yes some downloader related and other extensions have been added to blocklist pretty recently. https://blocked.cdn.mozilla.net/

oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 2nd, 2018, 4:15 pm

Interesting. I recently got BlockSite because of this problem and I see it;s on the list. It doesn't do anything except say the site is blocked.

therube

User avatar
 
Posts: 20266
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted August 3rd, 2018, 3:41 am

2 new tabs open all by themselves--why?


(You would think https://blocked.cdn.mozilla.net/ would use a fixed-width font for the dates ;-).)


jscher wrote:now gone from the Add-ons site, but not blocked in existing installations

Why would they do one but not the other?
If they're not on the blocklist, then users that already had the extensions are still vulnerable.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

ronbo
 
Posts: 116
Joined: July 2nd, 2004, 3:52 pm
Location: North Idaho, USA

Post Posted August 3rd, 2018, 10:33 am

oldyeller The previous shows a link to my thread here about tabs opening by themselves.

I really hope I'm not writing too soon, but I think I have fixed my problem, since it has not happened in a few days.

In both C:/Users/your user name/AppData/Local and Roaming, Mozilla/Firefox/Profiles I renamed the profile. I then copied the most recent backup profile that felt did not contain any highjacks/viruses to those folders. It has been error free since.

hth, Ron

oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 3rd, 2018, 11:50 am

ronbo wrote:oldyeller The previous shows a link to my thread here about tabs opening by themselves.

I really hope I'm not writing too soon, but I think I have fixed my problem, since it has not happened in a few days.

In both C:/Users/your user name/AppData/Local and Roaming, Mozilla/Firefox/Profiles I renamed the profile. I then copied the most recent backup profile that felt did not contain any highjacks/viruses to those folders. It has been error free since.

hth, Ron

You say in that link,
I am using W7 Pro, FF v52.9.0, which I just recently updated to. I also updated Adobe Flash Player.
Since then after opening FF and looking at 1 or 2 of my 4 open tabs, 2 more tabs open--they do it by themselves--I'm not clicking on anything--just looking.

That's about what has been happening to me from about that time. One or 2 tabs open spontaneously with some undesirable or phishing site. You mention updating Adobe Flash Player. I've seen popups telling me to update, yet the last time I saw one I checked at tye Adobe site and it wasn't out of date. That makes me wonder if previously I might have fallen for one of these fake updates and picked up some malware. What bothers me is that MSE doesn't find any virus and Malwarebytes (soon to expire) only replaces the offending tabs with warnings but can't fix the problem.

ronbo
 
Posts: 116
Joined: July 2nd, 2004, 3:52 pm
Location: North Idaho, USA

Post Posted August 3rd, 2018, 6:14 pm

It is VERY possible I fell for one of those Adobe Flash Player update links. I'm usually very careful to uncheck the boxes which have extra stuff to install. Maybe I missed those too. I remember reading a page about Adobe stopping further updates to the Flash Player---maybe that was not even from Adobe and I got caught by a miner!

If you still have the extra tabs popping up, give it a try---replace your profile folders with a backup version you know did not have this highjacking.
Ron

oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 4th, 2018, 6:33 am

I should add that for the past week or two Windows has had a important update for MSE every single day. Usually I was prompted for Windows updates maybe every week or two and those for MSE were just "optional". Would Microsoft be fighting this same malware? But I'm only getting this in Firefox, not Chrome, which I seldom use.

oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 7th, 2018, 6:44 am

Just an update. Malwarebytes was about to expire, so I switched to the free version. I copied all the malware, PUP and phishing sites from the reports and added them to my Block Site add-on. Now I get blank tabs opening and popups notifications from Block Site instead. Usually 2 tabs when I first use Firefox, then a few random ones throughout the day. Results from running Malwarebytes and MSE are always clean. So the malware in FF isn't gone, but the blank tabs are less annoying.

therube

User avatar
 
Posts: 20266
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted August 7th, 2018, 10:07 am

So the malware in FF isn't gone

Agreed.

As a test, create a new, clean Profile.
See if that Profile does the same or over time, maybe even including reboots, does the same?
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

TheVisitor
 
Posts: 5052
Joined: May 13th, 2012, 10:43 am

Post Posted August 7th, 2018, 12:38 pm

oldyellr wrote:Just an update. Malwarebytes was about to expire, so I switched to the free version. I copied all the malware, PUP and phishing sites from the reports and added them to my Block Site add-on. Now I get blank tabs opening and popups notifications from Block Site instead. Usually 2 tabs when I first use Firefox, then a few random ones throughout the day. Results from running Malwarebytes and MSE are always clean. So the malware in FF isn't gone, but the blank tabs are less annoying.



Have you tried the 1st two basic steps in troubleshooting such activities ?
1. Clear all cache and, 2 all cookies, restart the browser and test

Why in the world would you transfer 'all the malware, PUP and etc to the new free install instead of working and finding ways to eliminate them from the system entirely ? If they were found putting them in quarantine will not in most cases stop their activity.

oldyellr
 
Posts: 77
Joined: June 19th, 2006, 12:36 pm

Post Posted August 7th, 2018, 1:16 pm

TheVisitor wrote:Have you tried the 1st two basic steps in troubleshooting such activities ?
1. Clear all cache and, 2 all cookies, restart the browser and test

Why in the world would you transfer 'all the malware, PUP and etc to the new free install instead of working and finding ways to eliminate them from the system entirely ? If they were found putting them in quarantine will not in most cases stop their activity.


When I opened FF to this post another tab opened up which was blocked by Block Site. I then restarted Firefox and cleared the cache and all cookies and tried again. This time a second tab didn't open. I hope it's as simple as that.

What I did before was tell my Block Site add-on to block the malicious sites Malwarebytes had reported in the last 2 weeks, that's all. A blank tab is less annoying than a malicious site.

Return to Firefox Support


Who is online

Users browsing this forum: Bing [Bot] and 12 guests