MozillaZine

Has my browser been hijacked?

User Help for Mozilla Firefox
Clueless in Seattle

User avatar
 
Posts: 429
Joined: March 27th, 2006, 11:58 am
Location: duh!

Post Posted January 9th, 2020, 2:07 pm

I'm running Firefox 68.4.1esr (32-bit) under Windows 7.

This morning I used a web site to convert a youtube video to an MP3: https: ytmp3.cc/en/

This website has always been sketchy because each time I would use it to convert a song, it would run a pop-up ad trying to get me to click on a supposed "PC Cleaner" or some such other click bait. But, up until today, as long as I didn't click on the pop-ups, I seemed to stay out of trouble.

But this morning, instead of a click-bait pop up, my browser was taken over by what purported to be a Firefox update dialogue box:

ImageBrowser Hijack 2020-0109 by Will Anderson, on Flickr

The cancel buttons and the "X" buttons were unresponsive, and I was unable to close the tabs that had been taken over by this "update" alert, or even access any of the other tabs. (Coincidentally, I did actually (but reluctantly) click on an actual Firefox update alert sometime in the previous 24 hours, but I found it hard to believe that this browser takeover was an actual update process).

What does this look like to you? Has my browser been hijacked? And if so, what to do now?
Last edited by LIMPET235 on January 11th, 2020, 4:04 am, edited 1 time in total.
Reason: Some slight text editing.
Will in Seattle
a.k.a. "Clueless"

DanRaisch
Moderator

User avatar
 
Posts: 122514
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Post Posted January 9th, 2020, 5:51 pm

It looks like an attempt to hijack the browser. Did you try using Windows Task Manager to shut down Firefox and then, after rebooting, relaunching the browser to see what happens?

Clueless in Seattle

User avatar
 
Posts: 429
Joined: March 27th, 2006, 11:58 am
Location: duh!

Post Posted January 9th, 2020, 7:06 pm

Hi Dan,

Yes! When I realized that even the "X" button in the upper right corner of the Firefox window had also been disabled, I ran Task Manager and used the "End Process" button to kill Firefox.

But when I ran FF again, it tried to reload the tabs that had been open just before I had killled it, so it loaded the same two tabs that had been opened by the presumptive hijacking attempt, and again, I lost all control of Firefox and had to kill it again with Task Manager.

Eventually, after terminating and re-running Firefox, instead of loading the suspicious tabs, I ended up at the "Oops, this is embarrassing" screen, which gave me the option to not reload my tabs. And it was from there that I was able to post my query here in this forum this afternoon.

After that, I shut down my PC, took a nap, went for a bike ride. And now, after booting up my PC, Firefox ran from my Startup folder as it usually does, and now seems to be back to normal. There's no sign of those pesky click-baited tabs.

But I can't help wondering if the damage may already have been done. So I suppose I should run some kind of PC cleaner program. In the meantime, though, I think I'll stay away from the MP3 conversion site.
Last edited by Clueless in Seattle on January 10th, 2020, 11:35 am, edited 1 time in total.
Will in Seattle
a.k.a. "Clueless"

mightyglydd

User avatar
 
Posts: 9672
Joined: November 4th, 2006, 7:07 pm
Location: Hollywood Ca.

Post Posted January 9th, 2020, 7:20 pm

If I were you I'd run this... https://www.malwarebytes.com/adwcleaner/
It's pretty good at cleaning browser invasions.. Quick too.
#KeepFightingMichael

LIMPET235
Moderator

User avatar
 
Posts: 39001
Joined: October 19th, 2007, 1:53 am
Location: The South Coast of N.S.W. Oz.

Post Posted January 10th, 2020, 2:55 am

Hi there Clueless,
If you want to "convert" any MP4/video file to MP3/audio...
then go here & D/L Audacity & the Lame for Windows.
Open Audacity > add your video file & play the video. ONLY the audio will play.
After checking &/or modifying the audio file, File > Export Audio as MP3 to wherever you want.

> https://www.audacityteam.org/download/windows/
> https://lame.buanzo.org/#lamewindl

From that page...
NB: "TO DOWNLOAD Lame and FFmpeg for Windows, click links BELOW:"
Lame is needed to convert & export the MP3 file.

So, stay away from that "other" on-line conversion site.
Ancient Amateur Astronomer
Win-7-HP/Intel® DualCore-2.0GHz/500G HDD/4 Gig Ram/550Watt PSU/350WattUPS/Firefox-20.0-62.0-70.0/T-bird-2.0.0.24/SnagIt-v10.0.1/MWP-7.12.
(Always choose the "Custom" Install.)

dickvl

User avatar
 
Posts: 53000
Joined: July 18th, 2005, 3:25 am

Post Posted January 10th, 2020, 9:55 am

You can set this pref to 0 (zero) on the about:config page to always show the Session Restore page in case of a crash or when you use the Task Manager to force a shutdown.

browser.sessionstore.max_resumed_crashes = 0

Tushman
 
Posts: 139
Joined: May 4th, 2005, 7:50 pm

Post Posted January 10th, 2020, 9:19 pm

mightyglydd wrote:If I were you I'd run this... https://www.malwarebytes.com/adwcleaner/
It's pretty good at cleaning browser invasions.. Quick too.


That's interesting. I have been a long-time user of MBAM's antispyware cleaner but I didn't know they had one specifically for Adware infections. Very good to know. Thanks.

@ OP:
In addition to what mightyglydd suggested above, I recommend that you do a thorough scan of your computer with Spybot S&D (Search & Destroy). It's been around for ages and I trust it. Every once in a while one cleaner/scanner will detect objects the other has failed to catch so it's a good idea to run both.

https://www.safer-networking.org/download/

Also, I highly recommend that you use Spyware Blaster. This is another program great program that I have been using for many years. I don't know exactly how it works or the technicalities of the program. All I know is that it innocculates your computer, so it thwarts infections from happening. Although no program is 100% fail proof, this little program has been doing an excellent job of protecting my system for years. They just released a minor update last month. You can get the free download here. http://www.brightfort.com/

LIMPET235
Moderator

User avatar
 
Posts: 39001
Joined: October 19th, 2007, 1:53 am
Location: The South Coast of N.S.W. Oz.

Post Posted January 11th, 2020, 3:44 am

PTN...
Just be careful when using AdwCleaner, as it can be/is a tad aggressive.
Check what it's going to quarantine or remove beforehand.

&....Always get the latest version from Malwarebytes dot com.

Spyware Blaster takes care of your tracking cookies & PUPS, plus a few other items. AFAIK.
Ancient Amateur Astronomer
Win-7-HP/Intel® DualCore-2.0GHz/500G HDD/4 Gig Ram/550Watt PSU/350WattUPS/Firefox-20.0-62.0-70.0/T-bird-2.0.0.24/SnagIt-v10.0.1/MWP-7.12.
(Always choose the "Custom" Install.)

therube

User avatar
 
Posts: 20180
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted January 11th, 2020, 10:24 am

I think (? it was), holding down the ESC (continuously), followed by Ctrl+W (to close the tab) would have gotten rid of that persistent prompt (without having to kill FF itself).

IMO...

nothing happened to you
possible that you would be prompted to install "something" (like an update ;-)), & so long as you did not respond to that prompt, still likely that nothing would have happened (though if you did respond, not sure?)
killing, is always a safe bet
restarting, & having the same nonsense pop back up, is a bit of a pain

As noted, that particular pref can be set to 0.
Or you could have done something like removed (renamed) the session restore files (& directory).

An adblocker may have helped.
NoScript certainly would (but is not for everyone).
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

Benjamin Markson

User avatar
 
Posts: 388
Joined: November 19th, 2011, 3:57 am
Location: en-GB

Post Posted January 11th, 2020, 11:21 am

I may be wrong but isn't it this: viewtopic.php?f=38&t=3056535

Ben.
XUL is dead. Long live the Google Chrome Clones.

LIMPET235
Moderator

User avatar
 
Posts: 39001
Joined: October 19th, 2007, 1:53 am
Location: The South Coast of N.S.W. Oz.

Post Posted January 11th, 2020, 12:25 pm

It looks very similar....Check the original posted image at askwoody dot com.
> https://www.askwoody.com/2019/firefox-u ... e-is-fake/
Ancient Amateur Astronomer
Win-7-HP/Intel® DualCore-2.0GHz/500G HDD/4 Gig Ram/550Watt PSU/350WattUPS/Firefox-20.0-62.0-70.0/T-bird-2.0.0.24/SnagIt-v10.0.1/MWP-7.12.
(Always choose the "Custom" Install.)

LoveMyFoxy

User avatar
 
Posts: 2312
Joined: December 11th, 2009, 11:23 am
Location: USA

Post Posted January 23rd, 2020, 2:49 pm

@Clueless in Seattle--
I've used Y2Mate.com for conversions too, always without problems. I believe the site itself has become infected, as I just checked and I've never seen porn ads or any ads there before. They even got through my UBlockOrigin.
So that's out now.

@Limpet--
1--I already have VLC, but I use it only as a player. Can I use that for conversions? The wiki always been daunting.

2--Is MB BrowserGuard just duplicating what my SpywareBlaster is doing? (And do you know there are 98 trackers on this site?) :mrgreen:

(Disclaimer: Neither I nor Clueless ever copy from copyrighted videos.)
2 Desktops--Win 7 Ult.SP1 x64/6GB RAM /Firefox 52.9ESR/Waterfox64 2019.10/Thunderbird 52.9ESR/Sticky Password/Verizon FIOS wired network

LIMPET235
Moderator

User avatar
 
Posts: 39001
Joined: October 19th, 2007, 1:53 am
Location: The South Coast of N.S.W. Oz.

Post Posted January 24th, 2020, 4:14 am

Hi LMFy,
What exactly are you wanting to convert?
The Info. I posted re; AUDACITY, only relates to "stripping" the audio from your video file & saving that as an .MP3.

There are lots of videos on YouTube on what VLC player can do & how to do it.
It has a H%&# of a lot of "hidden" features, so look at some of the YT videos.
It's much more that "just a player."

For ref; > https://www.youtube.com/results?search_query=vlc+player
Here's an oldie from 2014...
> https://www.youtube.com/watch?v=1jMuRnMSQoU

I don't know what the MB Browser is so cannot comment.

Have fun with VLC.
Ancient Amateur Astronomer
Win-7-HP/Intel® DualCore-2.0GHz/500G HDD/4 Gig Ram/550Watt PSU/350WattUPS/Firefox-20.0-62.0-70.0/T-bird-2.0.0.24/SnagIt-v10.0.1/MWP-7.12.
(Always choose the "Custom" Install.)

LoveMyFoxy

User avatar
 
Posts: 2312
Joined: December 11th, 2009, 11:23 am
Location: USA

Post Posted January 24th, 2020, 12:42 pm

Stripping the audio and making them into MP3's, same as the OP, otherwise I would have posted in a new thread.
Thanks for the references.

MB Browser Guard is a free feature now with MBAM. I'll do this in a separate thread, although it's tangentially connected to the OP's security problem.
2 Desktops--Win 7 Ult.SP1 x64/6GB RAM /Firefox 52.9ESR/Waterfox64 2019.10/Thunderbird 52.9ESR/Sticky Password/Verizon FIOS wired network

LIMPET235
Moderator

User avatar
 
Posts: 39001
Joined: October 19th, 2007, 1:53 am
Location: The South Coast of N.S.W. Oz.

Post Posted January 25th, 2020, 2:37 am

No probs.
You're welcome...

Image
Ancient Amateur Astronomer
Win-7-HP/Intel® DualCore-2.0GHz/500G HDD/4 Gig Ram/550Watt PSU/350WattUPS/Firefox-20.0-62.0-70.0/T-bird-2.0.0.24/SnagIt-v10.0.1/MWP-7.12.
(Always choose the "Custom" Install.)

Return to Firefox Support


Who is online

Users browsing this forum: Bing [Bot] and 7 guests