That worked for me (even after a reboot), but Malwarebytes' Anti-Malware (linked above) picked up a trojan that may have been related.
Updated Firefox, got a nasty extension
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
Delete the folder and registry entry that I mentioned.
That worked for me (even after a reboot), but Malwarebytes' Anti-Malware (linked above) picked up a trojan that may have been related.
Just out of curiosity, which extensions do you have installed?
That worked for me (even after a reboot), but Malwarebytes' Anti-Malware (linked above) picked up a trojan that may have been related.
-
- Guest
Re: Updated Firefox, got a nasty extension
Here's an example. I typed "Cookbook" into google search. Clicking on the first result ended up going toward this page, which I stopped in order to get the url.
http : //redirection.goored.com/i.php?url=http%3A%2F%2Fen.wikibooks.org%2Fwiki%2FCookbook&p=0
(I added a space after the http and the : so the link wouldn't work here. Couldn't figure out how else to "break" the link.)
I'm running Windows XP with the latest updates. I keep my system clean with regular scans and updates. This is really ing me off!
Thanks for any help or ideas!
http : //redirection.goored.com/i.php?url=http%3A%2F%2Fen.wikibooks.org%2Fwiki%2FCookbook&p=0
(I added a space after the http and the : so the link wouldn't work here. Couldn't figure out how else to "break" the link.)
I'm running Windows XP with the latest updates. I keep my system clean with regular scans and updates. This is really ing me off!
Thanks for any help or ideas!
-
- Guest
Re: Updated Firefox, got a nasty extension
Thanks, GeorgeFive. I just tried taking the folder and that registry entry out again. Rebooted and back it came. Arggg! So, I'll give the Malwarebyte program a try. I'll post back to let you and anyone else who may have this problem know what I found out.
Thanks, again.
Thanks, again.
-
- Guest
Re: Updated Firefox, got a nasty extension
Amen and hallelujah! Malwarebyte found 8 trojan type items and removed them. No more problems. Sheez! I thought keeping McAfee and AdAware up to date and run scans with them weekly was keeping me clean, but I was wrong. Thanks for the advice, GeorgeFive. I really appreciate it!
John.
John.
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
I know the feeling... I use ClamWin, COMODO, Adblock, and I do regular checks for spyware, so I was shocked to see something get past them, especially considering I never open IE and rarely download anything. Just goes to show that everyone can get burnt from time to time.
I'm curious... did it happen to you immediately after you updated and restarted Firefox as well, or was it some time after?
I'm curious... did it happen to you immediately after you updated and restarted Firefox as well, or was it some time after?
-
- Guest
Re: Updated Firefox, got a nasty extension
Yep, if I remember right, it was the same as you said. When FF restarted, it said that 1 new extension had been installed, but I couldn't figure out what it was. And, frankly, I didn't even think much about it. Then, sometime later, I noticed a weird result when I clicked on a google search result, and kind of went, "hmmm." I guess I don't often choose the first result in google, because I really didn't notice it much after that until yesterday when I was doing a bunch of searching. Then I said, oh nuts, maybe I've got a problem here. But McAfee had just run it's weekly scan on Friday, so I updated and scanned with adaware. Nothing. Then updated and ran mcafee again thinking that maybe it was something new and surely they'd be on it by then. Well, you know the rest of the story from here.
So, thanks again, GeorgeFive! I really appreciate you taking the time to post here and help out a stranger.
John.
So, thanks again, GeorgeFive! I really appreciate you taking the time to post here and help out a stranger.
John.
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
Not a problem, glad I could help.
I'm actually really interested in getting to the root of this, but this post kinda threw me - we don't share any extensions, so it has to be either Firefox itself or something else entirely. I saw a similar post on here, but if it was indeed Firefox, I'd imagine that this would be huge news... and it's not, so I assume it's something else entirely.
Sounding like a piece of malware that piggybacks on Firefox's connection to download their crap... since everyone who uses Firefox has it set to "Allow to connect to the internet" in their firewall of choice, it uses this rule to connect to whatever and download its own garbage when Firefox releases an update. Just a guess, I'm no expert in this field, but sounds reasonable.
Now the question..... where did we get this in the first place? Ugh, no clue.
I'm actually really interested in getting to the root of this, but this post kinda threw me - we don't share any extensions, so it has to be either Firefox itself or something else entirely. I saw a similar post on here, but if it was indeed Firefox, I'd imagine that this would be huge news... and it's not, so I assume it's something else entirely.
Sounding like a piece of malware that piggybacks on Firefox's connection to download their crap... since everyone who uses Firefox has it set to "Allow to connect to the internet" in their firewall of choice, it uses this rule to connect to whatever and download its own garbage when Firefox releases an update. Just a guess, I'm no expert in this field, but sounds reasonable.
Now the question..... where did we get this in the first place? Ugh, no clue.
- the-edmeister
- Posts: 32249
- Joined: February 25th, 2003, 12:51 am
- Location: Chicago, IL, USA
Re: Updated Firefox, got a nasty extension
Firefox updates are supposed to be secure, so I doubt if that crap came with the Firefox program update. And Firefox 3 has a new feature that requires addon updates are delivered thru secure servers or the addon won't even install to begin with, so I doubt if that crap "tagged along" with an extension update. That leaves something being installed that was included in some other piece of software that you installed or updated recently. I started a thread in the Firefox General forum that attempted to come up with a decent solution to that type of "exploit" of Firefox users - as far as stuff getting installed into Firefox thru other software "dumping" crap into Firefox while it is not even running and subsequently becoming installed when Firefox is launched.
Ed
Ed
A mind is a terrible thing to waste. Mine has wandered off and I'm out looking for it.
- Alice
- Posts: 2628
- Joined: April 23rd, 2003, 11:47 am
Re: Updated Firefox, got a nasty extension
steviex wrote:... post in one of these forums for specialized malware removal help:
<snip>http://forums.spywareinfo.com/Edited to remove bad link
SpywareInfo forums has moved to:
http://www.spywareinfoforum.com/
Last edited by Alice on December 15th, 2008, 1:03 pm, edited 1 time in total.
Alice Wyman
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
the-edmeister wrote:Firefox updates are supposed to be secure, so I doubt if that crap came with the Firefox program update. And Firefox 3 has a new feature that requires addon updates are delivered thru secure servers or the addon won't even install to begin with, so I doubt if that crap "tagged along" with an extension update. That leaves something being installed that was included in some other piece of software that you installed or updated recently. I started a thread in the Firefox General forum that attempted to come up with a decent solution to that type of "exploit" of Firefox users - as far as stuff getting installed into Firefox thru other software "dumping" crap into Firefox while it is not even running and subsequently becoming installed when Firefox is launched.
Ed
That's the thing though... with the exception of Silverlight (which I got from the official source) I hadn't installed any new software prior to updating Firefox (and hadn't in months). I downloaded FireGPG through the official plugin repository a couple of weeks ago, but other than that, I haven't added any new extensions in ages either.
As far as updates... I've done Windows updates, ClamWin updates, and a single FileZilla (popular FTP program) update.
Another quirk that may or may not be relevant... this extension wasn't installed to the proper directory.
Normal extensions go to:
C:\Documents and Settings\[name]\Application Data\Mozilla\Firefox\Profiles\[profile]\extensions
...but this one went to:
C:\Documents and Settings\[name]\Local Settings\Application Data\{33238016-EFEB-43AA-8BCE-3CA12861EE79}
-
- Guest
Re: Updated Firefox, got a nasty extension
i've had the same problem, search for pizza, get the results, click and get some messed up pizza link in the US. anyways thanks for the help everyone. malwarebyte worked great. back to firefox, no more safari!
Tyler
Tyler
-
- Guest
Re: Updated Firefox, got a nasty extension
I've got the same malware/virus thing. My I noticed one of my addons updated a few dates ago then yesterday. But soon after I started noticing the redirects.
I started up in safemode. Deleted the entry in the registry location:
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]
Also Deleted the folder: C:\Documents and Settings\USERNAME\Local Settings\Application Data\{385E83C1-7EFE-491C-B303-2F462B11E491}
Restarted computer normally, opened FireFox and the window came up saying one add-on has been update. Doh. Not gone.
I started back over. Deleted folder and registry entry. But before restarting removed all my addons and themes. Uninstalled them all through FireFox.
Also found with HiJackThis (which this might be unrelated) several files in my windows folder:
awokurur.dll
execodeneq.dll
Aduwad.dll
ipipucovot.dll
I couldn't find what they belonged to So I deleted them: In HijackThis and in the folder. I think one belonged to an AIM 6 plugin. Oh well. Haven't had any problems.
I just installed another addon into FireFox. No virus. Restarted FireFox and my computer twice just to double check.
I started up in safemode. Deleted the entry in the registry location:
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]
Also Deleted the folder: C:\Documents and Settings\USERNAME\Local Settings\Application Data\{385E83C1-7EFE-491C-B303-2F462B11E491}
Restarted computer normally, opened FireFox and the window came up saying one add-on has been update. Doh. Not gone.
I started back over. Deleted folder and registry entry. But before restarting removed all my addons and themes. Uninstalled them all through FireFox.
Also found with HiJackThis (which this might be unrelated) several files in my windows folder:
awokurur.dll
execodeneq.dll
Aduwad.dll
ipipucovot.dll
I couldn't find what they belonged to So I deleted them: In HijackThis and in the folder. I think one belonged to an AIM 6 plugin. Oh well. Haven't had any problems.
I just installed another addon into FireFox. No virus. Restarted FireFox and my computer twice just to double check.
- daTerminehtor
- Posts: 379
- Joined: November 9th, 2004, 12:11 pm
- Location: Great White North
Re: Updated Firefox, got a nasty extension
95% of all pc related issues are as a result of I.F.O.K. errors... In Front Of Keyboard.
Things do NOT get 'automatically' installed and certainly not because of an update from within Firefox itself.
Further, NOTHING gets installed withOUT user interaction, and user permission.
Your machine must have been infected prior to this 'update'.
Follow the advice given above people, and take responsibility for what goes on your pc.
It may not be easy, but yes, it really is that simple.
Things do NOT get 'automatically' installed and certainly not because of an update from within Firefox itself.
Further, NOTHING gets installed withOUT user interaction, and user permission.
Your machine must have been infected prior to this 'update'.
Follow the advice given above people, and take responsibility for what goes on your pc.
It may not be easy, but yes, it really is that simple.
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
With all due respect, I've been online since 14.4 modems were cutting edge, so I have a little bit of experience in keeping my PC clean. I haven't had a virus or trojan in the last fourteen years, and that one only came about due to a friend being an idiot on my computer (lesson learned).
I can't speak for anyone else here, but yes, something happened with this one that...
1) My virus scanner did not initially pick up
2) Spybot did not pick up
3) AdAware did not pick up
4) I did not confirm or authorize
and most importantly
5) Did not require me going to porn / warez sites, downloading an attachment from a stranger, or any of the other obvious ways to get infected.
I can't speak for anyone else here, but yes, something happened with this one that...
1) My virus scanner did not initially pick up
2) Spybot did not pick up
3) AdAware did not pick up
4) I did not confirm or authorize
and most importantly
5) Did not require me going to porn / warez sites, downloading an attachment from a stranger, or any of the other obvious ways to get infected.
-
- Guest
Re: Updated Firefox, got a nasty extension
Some viruses may be able to get through automatically if you do not keep all your plugins and your windows security updates up to date. Do you have windows automatic updates on? Are your acrobat reader, flash, java, quicktime, and realplayer (if installed) all up to date?