Updated Firefox, got a nasty extension

[carle]

whatever the "source" of this is, it's keeps reinfecting me. I've followed the steps outlined and re-scanned with mwb's anti-malware but after restarting firefox, i always get the "new phantom add on" box. I've resorted to manually editing the XUL file to declaw it. this sticks.

[chrisrf]

I'd like to add that this has nothing to do with updating firefox; it hit my 2.0.0.17 install too. No idea where it came from, as I noticed google searches acting funny for about a week and I haven't downloaded/installed anything new in the last week.

[GeorgeFive]

Yeah, in hindsight, it probably had nothing to do with the update. It was just odd how Firefox notified me about the updated version (which I confirmed on the site when I checked the release notes), and the "new add-on installed" box popped up directly after I restarted FF for the update. Bizarre timing there.

[I got GOORED]

Are there other pertinent threads on this message board that deal with the same issue?

Is there a definite fix for the redirection.goored issue yet?

[GeorgeFive]

I have no idea if there's other threads on here about it - I don't keep up with the forum, only this thread (through email notification).

If what you have is the same thing as what I had, the fix I posted should work for you.

[ElvisCostello]

It's back!!! I thought I had taken cae of this by deleting the registry entry but I am now re-infected. I would be willing to work with someone from Mozilla or an anti-virus provider to help identify the root cause.

Unfortunately, since people often come to me for help with their computer problems becuase I am a software developer, I will have to tell them to uninstall Firefox if they show symptoms of this virus. Avast and McAfee have failed at preventing this. My IE browser is also showing symptoms of infection. Safari seems to be immmune so far.

If you see a panic email telling you to uninstall Firefox it will probably be from someone who I advised spreading the message to their friends about this threat. I apologize in advance.

[steviex]

It is also possible that you might have a spyware infection on your machine. Install and run these programs.
SuperAntispyware
AdAware
Spybot Search & Destroy
Malwarebytes' Anti-Malware


If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/

(Thanks to Daifne for the list)

[ElvisCostello]

I user Malwarebytes and it found 25 infections. After rebooting I discovered I am still goored.

I will post to the malware help sites to see if I can get help. I will post to this forum if I find anything useful.

[GeorgeFive]

Did you manually delete the files that I mentioned?

[ElvisCostello]

I deleted the registry entry again, ran Spybot Search and Destroy (found 2 new trojans) and then rebooted. tested google in Firefox and the problem no longer exists.

I have added the NoScript extension to see if I can catch where the problem is coming from and improve security.

I strongly recommend that you use all of the spyware programs recommended by steviex becuase scan results vary.

[jpshortstuff]

RE: "Is there a definite fix for this issue yet?"

See this topic for instructions on using GooredFix - a tool designed specifically to detect and remove this infection.
http://www.247fixes.com/forums/index.php?showtopic=2710
(registration required, but its free)

Released within the last two weeks, GooredFix has still got a 100% detection rate and no False Positives, so I suggest anyone suffering this infection check it out to save you the hassle of poking around in your registry or hunting down folders manually.

Cheers,

-jpshortstuff

[Guest]

Hi, I think I may have found the problem!
I've deleted the registry file and the file in FF application data, some of you were talking about a file that re - installs the mal-ware/ the infected files even after they have been deleted. I was searching around C:/Program files/mozilla firefox/components and came across 2 .dll files called:
Browserdirprovider.dll and brwsrcmp.dll, they seem to be connected and were both created yesterday, which was when i first have the goored problem.
So hopefully deleting these will stop the files reinstalling and fix the problem.

Henry

[dfoulkes]

Hi, I think I may have found the problem! .....
I was searching around C:/Program files/mozilla firefox/components and came across 2 .dll files called:
Browserdirprovider.dll and brwsrcmp.dll, they seem to be connected and were both created yesterday, which was when i first have the goored problem.
So hopefully deleting these will stop the files reinstalling and fix the problem.

Henry

Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.

[VanillaMozilla]

Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.

Maybe the files were part of a beta version. They are not part of my copy, so I don't think it hurts to get rid of them. If they were indeed created yesterday, as the Guest wrote, they are probably phony.

[dfoulkes]

Everything I've read on the internet says that those two dll's are legit and are part of the Firefox program set.

Maybe the files were part of a beta version. They are not part of my copy, so I don't think it hurts to get rid of them. If they were indeed created yesterday, as the Guest wrote, they are probably phony.

I once had beta but performed a very clean uninstall of it performing the normal Windows uninstall and deleting all directories found in user/local and user/appdata plus Windows programs...mozilla...did a fresh install of 3.05 on 12/12/08 and then restored my FEBE backup. I also have those two files and their install date show 12/12/08 with times matching (within seconds) the other gazillion files loaded for Firefox 3.05...the only diff. is that those two files have a modified date of 12/16/08 and perhaps they are from some extension? In addition to those two files there are others in this screen shot that have the same mod dates....So, could some of the many addons I'm using use these files?...Hmmmmm? Also, I'm having no problems with my pc.