Updated Firefox, got a nasty extension

User Help for Mozilla Firefox
GeorgeFive
Posts: 159
Joined: May 1st, 2004, 6:44 am

Re: Updated Firefox, got a nasty extension

Post by GeorgeFive »

Delete the folder and registry entry that I mentioned.

That worked for me (even after a reboot), but Malwarebytes' Anti-Malware (linked above) picked up a trojan that may have been related.

Just out of curiosity, which extensions do you have installed?
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

Here's an example. I typed "Cookbook" into google search. Clicking on the first result ended up going toward this page, which I stopped in order to get the url.

http : //redirection.goored.com/i.php?url=http%3A%2F%2Fen.wikibooks.org%2Fwiki%2FCookbook&p=0
(I added a space after the http and the : so the link wouldn't work here. Couldn't figure out how else to "break" the link.)

I'm running Windows XP with the latest updates. I keep my system clean with regular scans and updates. This is really :evil:ing me off!

Thanks for any help or ideas!
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

Thanks, GeorgeFive. I just tried taking the folder and that registry entry out again. Rebooted and back it came. Arggg! So, I'll give the Malwarebyte program a try. I'll post back to let you and anyone else who may have this problem know what I found out.

Thanks, again.
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

Amen and hallelujah! Malwarebyte found 8 trojan type items and removed them. No more problems. Sheez! I thought keeping McAfee and AdAware up to date and run scans with them weekly was keeping me clean, but I was wrong. :roll: Thanks for the advice, GeorgeFive. I really appreciate it!

John.
GeorgeFive
Posts: 159
Joined: May 1st, 2004, 6:44 am

Re: Updated Firefox, got a nasty extension

Post by GeorgeFive »

I know the feeling... I use ClamWin, COMODO, Adblock, and I do regular checks for spyware, so I was shocked to see something get past them, especially considering I never open IE and rarely download anything. Just goes to show that everyone can get burnt from time to time.

I'm curious... did it happen to you immediately after you updated and restarted Firefox as well, or was it some time after?
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

Yep, if I remember right, it was the same as you said. When FF restarted, it said that 1 new extension had been installed, but I couldn't figure out what it was. And, frankly, I didn't even think much about it. Then, sometime later, I noticed a weird result when I clicked on a google search result, and kind of went, "hmmm." I guess I don't often choose the first result in google, because I really didn't notice it much after that until yesterday when I was doing a bunch of searching. Then I said, oh nuts, maybe I've got a problem here. But McAfee had just run it's weekly scan on Friday, so I updated and scanned with adaware. Nothing. Then updated and ran mcafee again thinking that maybe it was something new and surely they'd be on it by then. Well, you know the rest of the story from here.

So, thanks again, GeorgeFive! I really appreciate you taking the time to post here and help out a stranger. :-)

John.
GeorgeFive
Posts: 159
Joined: May 1st, 2004, 6:44 am

Re: Updated Firefox, got a nasty extension

Post by GeorgeFive »

Not a problem, glad I could help.

I'm actually really interested in getting to the root of this, but this post kinda threw me - we don't share any extensions, so it has to be either Firefox itself or something else entirely. I saw a similar post on here, but if it was indeed Firefox, I'd imagine that this would be huge news... and it's not, so I assume it's something else entirely.

Sounding like a piece of malware that piggybacks on Firefox's connection to download their crap... since everyone who uses Firefox has it set to "Allow to connect to the internet" in their firewall of choice, it uses this rule to connect to whatever and download its own garbage when Firefox releases an update. Just a guess, I'm no expert in this field, but sounds reasonable.

Now the question..... where did we get this in the first place? Ugh, no clue.
User avatar
the-edmeister
Posts: 32249
Joined: February 25th, 2003, 12:51 am
Location: Chicago, IL, USA

Re: Updated Firefox, got a nasty extension

Post by the-edmeister »

Firefox updates are supposed to be secure, so I doubt if that crap came with the Firefox program update. And Firefox 3 has a new feature that requires addon updates are delivered thru secure servers or the addon won't even install to begin with, so I doubt if that crap "tagged along" with an extension update. That leaves something being installed that was included in some other piece of software that you installed or updated recently. I started a thread in the Firefox General forum that attempted to come up with a decent solution to that type of "exploit" of Firefox users - as far as stuff getting installed into Firefox thru other software "dumping" crap into Firefox while it is not even running and subsequently becoming installed when Firefox is launched.


Ed
A mind is a terrible thing to waste. Mine has wandered off and I'm out looking for it.
User avatar
Alice
Posts: 2628
Joined: April 23rd, 2003, 11:47 am

Re: Updated Firefox, got a nasty extension

Post by Alice »

steviex wrote:... post in one of these forums for specialized malware removal help:
<snip>
http://forums.spywareinfo.com/ Edited to remove bad link

SpywareInfo forums has moved to:
http://www.spywareinfoforum.com/
Last edited by Alice on December 15th, 2008, 1:03 pm, edited 1 time in total.
Alice Wyman
GeorgeFive
Posts: 159
Joined: May 1st, 2004, 6:44 am

Re: Updated Firefox, got a nasty extension

Post by GeorgeFive »

the-edmeister wrote:Firefox updates are supposed to be secure, so I doubt if that crap came with the Firefox program update. And Firefox 3 has a new feature that requires addon updates are delivered thru secure servers or the addon won't even install to begin with, so I doubt if that crap "tagged along" with an extension update. That leaves something being installed that was included in some other piece of software that you installed or updated recently. I started a thread in the Firefox General forum that attempted to come up with a decent solution to that type of "exploit" of Firefox users - as far as stuff getting installed into Firefox thru other software "dumping" crap into Firefox while it is not even running and subsequently becoming installed when Firefox is launched.


Ed


That's the thing though... with the exception of Silverlight (which I got from the official source) I hadn't installed any new software prior to updating Firefox (and hadn't in months). I downloaded FireGPG through the official plugin repository a couple of weeks ago, but other than that, I haven't added any new extensions in ages either.

As far as updates... I've done Windows updates, ClamWin updates, and a single FileZilla (popular FTP program) update.

Another quirk that may or may not be relevant... this extension wasn't installed to the proper directory.

Normal extensions go to:
C:\Documents and Settings\[name]\Application Data\Mozilla\Firefox\Profiles\[profile]\extensions

...but this one went to:
C:\Documents and Settings\[name]\Local Settings\Application Data\{33238016-EFEB-43AA-8BCE-3CA12861EE79}
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

i've had the same problem, search for pizza, get the results, click and get some messed up pizza link in the US. anyways thanks for the help everyone. malwarebyte worked great. back to firefox, no more safari!

Tyler
Guest
Guest

Re: Updated Firefox, got a nasty extension

Post by Guest »

I've got the same malware/virus thing. My I noticed one of my addons updated a few dates ago then yesterday. But soon after I started noticing the redirects.

I started up in safemode. Deleted the entry in the registry location:
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]

Also Deleted the folder: C:\Documents and Settings\USERNAME\Local Settings\Application Data\{385E83C1-7EFE-491C-B303-2F462B11E491}

Restarted computer normally, opened FireFox and the window came up saying one add-on has been update. Doh. Not gone.

I started back over. Deleted folder and registry entry. But before restarting removed all my addons and themes. Uninstalled them all through FireFox.

Also found with HiJackThis (which this might be unrelated) several files in my windows folder:
awokurur.dll
execodeneq.dll
Aduwad.dll
ipipucovot.dll

I couldn't find what they belonged to So I deleted them: In HijackThis and in the folder. I think one belonged to an AIM 6 plugin. Oh well. Haven't had any problems.


I just installed another addon into FireFox. No virus. Restarted FireFox and my computer twice just to double check.
User avatar
daTerminehtor
Posts: 379
Joined: November 9th, 2004, 12:11 pm
Location: Great White North

Re: Updated Firefox, got a nasty extension

Post by daTerminehtor »

95% of all pc related issues are as a result of I.F.O.K. errors... In Front Of Keyboard.

Things do NOT get 'automatically' installed and certainly not because of an update from within Firefox itself.
Further, NOTHING gets installed withOUT user interaction, and user permission.

Your machine must have been infected prior to this 'update'.

Follow the advice given above people, and take responsibility for what goes on your pc.

It may not be easy, but yes, it really is that simple.
GeorgeFive
Posts: 159
Joined: May 1st, 2004, 6:44 am

Re: Updated Firefox, got a nasty extension

Post by GeorgeFive »

With all due respect, I've been online since 14.4 modems were cutting edge, so I have a little bit of experience in keeping my PC clean. I haven't had a virus or trojan in the last fourteen years, and that one only came about due to a friend being an idiot on my computer (lesson learned).

I can't speak for anyone else here, but yes, something happened with this one that...

1) My virus scanner did not initially pick up
2) Spybot did not pick up
3) AdAware did not pick up
4) I did not confirm or authorize
and most importantly
5) Did not require me going to porn / warez sites, downloading an attachment from a stranger, or any of the other obvious ways to get infected.
fahpev
Guest

Re: Updated Firefox, got a nasty extension

Post by fahpev »

Some viruses may be able to get through automatically if you do not keep all your plugins and your windows security updates up to date. Do you have windows automatic updates on? Are your acrobat reader, flash, java, quicktime, and realplayer (if installed) all up to date?
Locked