Tabs open automatically with malware sites

User Help for Mozilla Firefox
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Tabs open automatically with malware sites

Post by oldyellr »

This just started about a week ago. Very often when I start Firefox one or 2 more tabs open with gambling, porn, phishing or other undesirable sites. I've run MS Security Essentials with nothing found, also Malwarebytes, which now flags the tabs, but apparently cannot prevent them opening, even when it's the same domain over and over again. This makes me wonder if it's something in Firefox or an add-on causing this. Any ideas how to stop it?

Firefox Quantum 61.0.1
Windows 7
User avatar
fixit7
Posts: 233
Joined: May 19th, 2015, 3:11 pm

Re: Tabs open automatyically with malware sites

Post by fixit7 »

The best thing is to use a host file. It will block those sites. If a site is not in there, you can add it.

You can get it here.

http://winhelp2002.mvps.org/hosts.htm
Brummelchen
Posts: 4480
Joined: March 19th, 2005, 10:51 am

Re: Tabs open automatyically with malware sites

Post by Brummelchen »

run adwcleaner and post log
https://www.malwarebytes.com/adwcleaner/

provide some information please (text, not raw)
https://support.mozilla.org/en-US/kb/us ... ix-firefox

maybe we find some malicious extension which has payload.
crappy sites dont load without reason - either you visit strange sites yourself or you have malware in your system or in firefox.
User avatar
jscher2000
Posts: 11742
Joined: December 19th, 2004, 12:26 am
Location: Silicon Valley, CA USA
Contact:

Re: Tabs open automatyically with malware sites

Post by jscher2000 »

Which video or MP3 downloader(s) are you using? Some have been compromised recently and are now gone from the Add-ons site, but not blocked in existing installations.
User avatar
James
Moderator
Posts: 27999
Joined: June 18th, 2003, 3:07 pm
Location: Made in Canada

Re: Tabs open automatyically with malware sites

Post by James »

Yes some downloader related and other extensions have been added to blocklist pretty recently. https://blocked.cdn.mozilla.net/
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Re: Tabs open automatyically with malware sites

Post by oldyellr »

Interesting. I recently got BlockSite because of this problem and I see it;s on the list. It doesn't do anything except say the site is blocked.
User avatar
therube
Posts: 21703
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: Tabs open automatyically with malware sites

Post by therube »

2 new tabs open all by themselves--why?


(You would think https://blocked.cdn.mozilla.net/ would use a fixed-width font for the dates ;-).)

jscher wrote:now gone from the Add-ons site, but not blocked in existing installations
Why would they do one but not the other?
If they're not on the blocklist, then users that already had the extensions are still vulnerable.
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
ronbo
Posts: 120
Joined: July 2nd, 2004, 3:52 pm
Location: North Idaho, USA

Re: Tabs open automatyically with malware sites

Post by ronbo »

oldyeller The previous shows a link to my thread here about tabs opening by themselves.

I really hope I'm not writing too soon, but I think I have fixed my problem, since it has not happened in a few days.

In both C:/Users/your user name/AppData/Local and Roaming, Mozilla/Firefox/Profiles I renamed the profile. I then copied the most recent backup profile that felt did not contain any highjacks/viruses to those folders. It has been error free since.

hth, Ron
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Re: Tabs open automatyically with malware sites

Post by oldyellr »

ronbo wrote:oldyeller The previous shows a link to my thread here about tabs opening by themselves.

I really hope I'm not writing too soon, but I think I have fixed my problem, since it has not happened in a few days.

In both C:/Users/your user name/AppData/Local and Roaming, Mozilla/Firefox/Profiles I renamed the profile. I then copied the most recent backup profile that felt did not contain any highjacks/viruses to those folders. It has been error free since.

hth, Ron
You say in that link,
I am using W7 Pro, FF v52.9.0, which I just recently updated to. I also updated Adobe Flash Player.
Since then after opening FF and looking at 1 or 2 of my 4 open tabs, 2 more tabs open--they do it by themselves--I'm not clicking on anything--just looking.
That's about what has been happening to me from about that time. One or 2 tabs open spontaneously with some undesirable or phishing site. You mention updating Adobe Flash Player. I've seen popups telling me to update, yet the last time I saw one I checked at tye Adobe site and it wasn't out of date. That makes me wonder if previously I might have fallen for one of these fake updates and picked up some malware. What bothers me is that MSE doesn't find any virus and Malwarebytes (soon to expire) only replaces the offending tabs with warnings but can't fix the problem.
ronbo
Posts: 120
Joined: July 2nd, 2004, 3:52 pm
Location: North Idaho, USA

Re: Tabs open automatyically with malware sites

Post by ronbo »

It is VERY possible I fell for one of those Adobe Flash Player update links. I'm usually very careful to uncheck the boxes which have extra stuff to install. Maybe I missed those too. I remember reading a page about Adobe stopping further updates to the Flash Player---maybe that was not even from Adobe and I got caught by a miner!

If you still have the extra tabs popping up, give it a try---replace your profile folders with a backup version you know did not have this highjacking.
Ron
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Re: Tabs open automatyically with malware sites

Post by oldyellr »

I should add that for the past week or two Windows has had a important update for MSE every single day. Usually I was prompted for Windows updates maybe every week or two and those for MSE were just "optional". Would Microsoft be fighting this same malware? But I'm only getting this in Firefox, not Chrome, which I seldom use.
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Re: Tabs open automatyically with malware sites

Post by oldyellr »

Just an update. Malwarebytes was about to expire, so I switched to the free version. I copied all the malware, PUP and phishing sites from the reports and added them to my Block Site add-on. Now I get blank tabs opening and popups notifications from Block Site instead. Usually 2 tabs when I first use Firefox, then a few random ones throughout the day. Results from running Malwarebytes and MSE are always clean. So the malware in FF isn't gone, but the blank tabs are less annoying.
User avatar
therube
Posts: 21703
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: Tabs open automatyically with malware sites

Post by therube »

So the malware in FF isn't gone
Agreed.

As a test, create a new, clean Profile.
See if that Profile does the same or over time, maybe even including reboots, does the same?
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
TheVisitor
Posts: 5469
Joined: May 13th, 2012, 10:43 am

Re: Tabs open automatyically with malware sites

Post by TheVisitor »

oldyellr wrote:Just an update. Malwarebytes was about to expire, so I switched to the free version. I copied all the malware, PUP and phishing sites from the reports and added them to my Block Site add-on. Now I get blank tabs opening and popups notifications from Block Site instead. Usually 2 tabs when I first use Firefox, then a few random ones throughout the day. Results from running Malwarebytes and MSE are always clean. So the malware in FF isn't gone, but the blank tabs are less annoying.

Have you tried the 1st two basic steps in troubleshooting such activities ?
1. Clear all cache and, 2 all cookies, restart the browser and test

Why in the world would you transfer 'all the malware, PUP and etc to the new free install instead of working and finding ways to eliminate them from the system entirely ? If they were found putting them in quarantine will not in most cases stop their activity.
oldyellr
Posts: 108
Joined: June 19th, 2006, 12:36 pm

Re: Tabs open automatyically with malware sites

Post by oldyellr »

TheVisitor wrote: Have you tried the 1st two basic steps in troubleshooting such activities ?
1. Clear all cache and, 2 all cookies, restart the browser and test

Why in the world would you transfer 'all the malware, PUP and etc to the new free install instead of working and finding ways to eliminate them from the system entirely ? If they were found putting them in quarantine will not in most cases stop their activity.
When I opened FF to this post another tab opened up which was blocked by Block Site. I then restarted Firefox and cleared the cache and all cookies and tried again. This time a second tab didn't open. I hope it's as simple as that.

What I did before was tell my Block Site add-on to block the malicious sites Malwarebytes had reported in the last 2 weeks, that's all. A blank tab is less annoying than a malicious site.
Post Reply