Updated Firefox, got a nasty extension
-
- Guest
Re: Updated Firefox, got a nasty extension
whatever the "source" of this is, it's keeps reinfecting me. I've followed the steps outlined and re-scanned with mwb's anti-malware but after restarting firefox, i always get the "new phantom add on" box. I've resorted to manually editing the XUL file to declaw it. this sticks.
-
- Guest
Re: Updated Firefox, got a nasty extension
I'd like to add that this has nothing to do with updating firefox; it hit my 2.0.0.17 install too. No idea where it came from, as I noticed google searches acting funny for about a week and I haven't downloaded/installed anything new in the last week.
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
Yeah, in hindsight, it probably had nothing to do with the update. It was just odd how Firefox notified me about the updated version (which I confirmed on the site when I checked the release notes), and the "new add-on installed" box popped up directly after I restarted FF for the update. Bizarre timing there.
-
- Guest
Re: Updated Firefox, got a nasty extension
Are there other pertinent threads on this message board that deal with the same issue?
Is there a definite fix for the redirection.goored issue yet?
Is there a definite fix for the redirection.goored issue yet?
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
I have no idea if there's other threads on here about it - I don't keep up with the forum, only this thread (through email notification).
If what you have is the same thing as what I had, the fix I posted should work for you.
If what you have is the same thing as what I had, the fix I posted should work for you.
-
- Posts: 5
- Joined: December 11th, 2008, 11:50 am
Re: Updated Firefox, got a nasty extension
It's back!!! I thought I had taken cae of this by deleting the registry entry but I am now re-infected. I would be willing to work with someone from Mozilla or an anti-virus provider to help identify the root cause.
Unfortunately, since people often come to me for help with their computer problems becuase I am a software developer, I will have to tell them to uninstall Firefox if they show symptoms of this virus. Avast and McAfee have failed at preventing this. My IE browser is also showing symptoms of infection. Safari seems to be immmune so far.
If you see a panic email telling you to uninstall Firefox it will probably be from someone who I advised spreading the message to their friends about this threat. I apologize in advance.
Unfortunately, since people often come to me for help with their computer problems becuase I am a software developer, I will have to tell them to uninstall Firefox if they show symptoms of this virus. Avast and McAfee have failed at preventing this. My IE browser is also showing symptoms of infection. Safari seems to be immmune so far.
If you see a panic email telling you to uninstall Firefox it will probably be from someone who I advised spreading the message to their friends about this threat. I apologize in advance.
- steviex
- Moderator
- Posts: 28902
- Joined: August 12th, 2006, 8:27 am
- Location: Middle England
Re: Updated Firefox, got a nasty extension
It is also possible that you might have a spyware infection on your machine. Install and run these programs.
SuperAntispyware
AdAware
Spybot Search & Destroy
Malwarebytes' Anti-Malware
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/
(Thanks to Daifne for the list)
SuperAntispyware
AdAware
Spybot Search & Destroy
Malwarebytes' Anti-Malware
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/
(Thanks to Daifne for the list)
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. -Albert Einstein
Please DO NOT PM me for support... Lets keep it on the board, so we can all learn.
Please DO NOT PM me for support... Lets keep it on the board, so we can all learn.
-
- Posts: 5
- Joined: December 11th, 2008, 11:50 am
Re: Updated Firefox, got a nasty extension
I user Malwarebytes and it found 25 infections. After rebooting I discovered I am still goored.
I will post to the malware help sites to see if I can get help. I will post to this forum if I find anything useful.
I will post to the malware help sites to see if I can get help. I will post to this forum if I find anything useful.
-
- Posts: 159
- Joined: May 1st, 2004, 6:44 am
Re: Updated Firefox, got a nasty extension
Did you manually delete the files that I mentioned?
-
- Posts: 5
- Joined: December 11th, 2008, 11:50 am
Re: Updated Firefox, got a nasty extension
I deleted the registry entry again, ran Spybot Search and Destroy (found 2 new trojans) and then rebooted. tested google in Firefox and the problem no longer exists.
I have added the NoScript extension to see if I can catch where the problem is coming from and improve security.
I strongly recommend that you use all of the spyware programs recommended by steviex becuase scan results vary.
I have added the NoScript extension to see if I can catch where the problem is coming from and improve security.
I strongly recommend that you use all of the spyware programs recommended by steviex becuase scan results vary.
-
- Guest
Re: Updated Firefox, got a nasty extension
RE: "Is there a definite fix for this issue yet?"
See this topic for instructions on using GooredFix - a tool designed specifically to detect and remove this infection.
http://www.247fixes.com/forums/index.php?showtopic=2710
(registration required, but its free)
Released within the last two weeks, GooredFix has still got a 100% detection rate and no False Positives, so I suggest anyone suffering this infection check it out to save you the hassle of poking around in your registry or hunting down folders manually.
Cheers,
-jpshortstuff
See this topic for instructions on using GooredFix - a tool designed specifically to detect and remove this infection.
http://www.247fixes.com/forums/index.php?showtopic=2710
(registration required, but its free)
Released within the last two weeks, GooredFix has still got a 100% detection rate and no False Positives, so I suggest anyone suffering this infection check it out to save you the hassle of poking around in your registry or hunting down folders manually.
Cheers,
-jpshortstuff
-
- Guest
Re: Updated Firefox, got a nasty extension
Hi, I think I may have found the problem!
I've deleted the registry file and the file in FF application data, some of you were talking about a file that re - installs the mal-ware/ the infected files even after they have been deleted. I was searching around C:/Program files/mozilla firefox/components and came across 2 .dll files called:
Browserdirprovider.dll and brwsrcmp.dll, they seem to be connected and were both created yesterday, which was when i first have the goored problem.
So hopefully deleting these will stop the files reinstalling and fix the problem.
Henry
I've deleted the registry file and the file in FF application data, some of you were talking about a file that re - installs the mal-ware/ the infected files even after they have been deleted. I was searching around C:/Program files/mozilla firefox/components and came across 2 .dll files called:
Browserdirprovider.dll and brwsrcmp.dll, they seem to be connected and were both created yesterday, which was when i first have the goored problem.
So hopefully deleting these will stop the files reinstalling and fix the problem.
Henry
- dfoulkes
- Posts: 22525
- Joined: June 28th, 2008, 10:31 pm
- Location: Mesquite, Nevada
Re: Updated Firefox, got a nasty extension
Guest wrote:Hi, I think I may have found the problem! .....
I was searching around C:/Program files/mozilla firefox/components and came across 2 .dll files called:
Browserdirprovider.dll and brwsrcmp.dll, they seem to be connected and were both created yesterday, which was when i first have the goored problem.
So hopefully deleting these will stop the files reinstalling and fix the problem.
Henry
Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.
As you can see she's (The CAT) always alert and on the prowl for Meoware !!
-
- Posts: 13808
- Joined: November 7th, 2005, 11:26 am
Re: Updated Firefox, got a nasty extension
dfoulkes wrote:Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.
Maybe the files were part of a beta version. They are not part of my copy, so I don't think it hurts to get rid of them. If they were indeed created yesterday, as the Guest wrote, they are probably phony.
- dfoulkes
- Posts: 22525
- Joined: June 28th, 2008, 10:31 pm
- Location: Mesquite, Nevada
Re: Updated Firefox, got a nasty extension
VanillaMozilla wrote:dfoulkes wrote:Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.
Maybe the files were part of a beta version. They are not part of my copy, so I don't think it hurts to get rid of them. If they were indeed created yesterday, as the Guest wrote, they are probably phony.
I once had beta but performed a very clean uninstall of it performing the normal Windows uninstall and deleting all directories found in user/local and user/appdata plus Windows programs...mozilla...did a fresh install of 3.05 on 12/12/08 and then restored my FEBE backup. I also have those two files and their install date show 12/12/08 with times matching (within seconds) the other gazillion files loaded for Firefox 3.05...the only diff. is that those two files have a modified date of 12/16/08 and perhaps they are from some extension? In addition to those two files there are others in this screen shot that have the same mod dates....So, could some of the many addons I'm using use these files?...Hmmmmm? Also, I'm having no problems with my pc.
As you can see she's (The CAT) always alert and on the prowl for Meoware !!