Has my browser been hijacked?

[Clueless in Seattle]

I'm running Firefox 68.4.1esr (32-bit) under Windows 7.

This morning I used a web site to convert a youtube video to an MP3: https: ytmp3.cc/en/

This website has always been sketchy because each time I would use it to convert a song, it would run a pop-up ad trying to get me to click on a supposed "PC Cleaner" or some such other click bait. But, up until today, as long as I didn't click on the pop-ups, I seemed to stay out of trouble.

But this morning, instead of a click-bait pop up, my browser was taken over by what purported to be a Firefox update dialogue box:

Browser Hijack 2020-0109 by Will Anderson, on Flickr

The cancel buttons and the "X" buttons were unresponsive, and I was unable to close the tabs that had been taken over by this "update" alert, or even access any of the other tabs. (Coincidentally, I did actually (but reluctantly) click on an actual Firefox update alert sometime in the previous 24 hours, but I found it hard to believe that this browser takeover was an actual update process).

What does this look like to you? Has my browser been hijacked? And if so, what to do now?

[DanRaisch]

It looks like an attempt to hijack the browser. Did you try using Windows Task Manager to shut down Firefox and then, after rebooting, relaunching the browser to see what happens?

[Clueless in Seattle]

Hi Dan,

Yes! When I realized that even the "X" button in the upper right corner of the Firefox window had also been disabled, I ran Task Manager and used the "End Process" button to kill Firefox.

But when I ran FF again, it tried to reload the tabs that had been open just before I had killled it, so it loaded the same two tabs that had been opened by the presumptive hijacking attempt, and again, I lost all control of Firefox and had to kill it again with Task Manager.

Eventually, after terminating and re-running Firefox, instead of loading the suspicious tabs, I ended up at the "Oops, this is embarrassing" screen, which gave me the option to not reload my tabs. And it was from there that I was able to post my query here in this forum this afternoon.

After that, I shut down my PC, took a nap, went for a bike ride. And now, after booting up my PC, Firefox ran from my Startup folder as it usually does, and now seems to be back to normal. There's no sign of those pesky click-baited tabs.

But I can't help wondering if the damage may already have been done. So I suppose I should run some kind of PC cleaner program. In the meantime, though, I think I'll stay away from the MP3 conversion site.

[mightyglydd]

If I were you I'd run this... https://www.malwarebytes.com/adwcleaner/
It's pretty good at cleaning browser invasions.. Quick too.

[LIMPET235]

Hi there Clueless,
If you want to "convert" any MP4/video file to MP3/audio...
then go here & D/L Audacity & the Lame for Windows.
Open Audacity > add your video file & play the video. ONLY the audio will play.
After checking &/or modifying the audio file, File > Export Audio as MP3 to wherever you want.

> https://www.audacityteam.org/download/windows/
> https://lame.buanzo.org/#lamewindl

From that page...
NB: "TO DOWNLOAD Lame and FFmpeg for Windows, click links BELOW:"
Lame is needed to convert & export the MP3 file.

So, stay away from that "other" on-line conversion site.

[dickvl]

You can set this pref to 0 (zero) on the about:config page to always show the Session Restore page in case of a crash or when you use the Task Manager to force a shutdown.

browser.sessionstore.max_resumed_crashes = 0

[Tushman]

If I were you I'd run this... https://www.malwarebytes.com/adwcleaner/
It's pretty good at cleaning browser invasions.. Quick too.

That's interesting. I have been a long-time user of MBAM's antispyware cleaner but I didn't know they had one specifically for Adware infections. Very good to know. Thanks.

@ OP:
In addition to what mightyglydd suggested above, I recommend that you do a thorough scan of your computer with Spybot S&D (Search & Destroy). It's been around for ages and I trust it. Every once in a while one cleaner/scanner will detect objects the other has failed to catch so it's a good idea to run both.

https://www.safer-networking.org/download/

Also, I highly recommend that you use Spyware Blaster. This is another program great program that I have been using for many years. I don't know exactly how it works or the technicalities of the program. All I know is that it innocculates your computer, so it thwarts infections from happening. Although no program is 100% fail proof, this little program has been doing an excellent job of protecting my system for years. They just released a minor update last month. You can get the free download here. http://www.brightfort.com/

[LIMPET235]

PTN...
Just be careful when using AdwCleaner, as it can be/is a tad aggressive.
Check what it's going to quarantine or remove beforehand.

&....Always get the latest version from Malwarebytes dot com.

Spyware Blaster takes care of your tracking cookies & PUPS, plus a few other items. AFAIK.

[therube]

I think (? it was), holding down the ESC (continuously), followed by Ctrl+W (to close the tab) would have gotten rid of that persistent prompt (without having to kill FF itself).

IMO...

nothing happened to you
possible that you would be prompted to install "something" (like an update ), & so long as you did not respond to that prompt, still likely that nothing would have happened (though if you did respond, not sure?)
killing, is always a safe bet
restarting, & having the same nonsense pop back up, is a bit of a pain

As noted, that particular pref can be set to 0.
Or you could have done something like removed (renamed) the session restore files (& directory).

An adblocker may have helped.
NoScript certainly would (but is not for everyone).

[Benjamin Markson]

I may be wrong but isn't it this: http://forums.mozillazine.org/viewtopic ... &t=3056535

Ben.

[LIMPET235]

It looks very similar....Check the original posted image at askwoody dot com.
> https://www.askwoody.com/2019/firefox-u ... e-is-fake/

[lovemyfoxy]

@Clueless in Seattle--
I've used Y2Mate.com for conversions too, always without problems. I believe the site itself has become infected, as I just checked and I've never seen porn ads or any ads there before. They even got through my UBlockOrigin.
So that's out now.

@Limpet--
1--I already have VLC, but I use it only as a player. Can I use that for conversions? The wiki always been daunting.

2--Is MB BrowserGuard just duplicating what my SpywareBlaster is doing? (And do you know there are 98 trackers on this site?)

(Disclaimer: Neither I nor Clueless ever copy from copyrighted videos.)

[LIMPET235]

Hi LMFy,
What exactly are you wanting to convert?
The Info. I posted re; AUDACITY, only relates to "stripping" the audio from your video file & saving that as an .MP3.

There are lots of videos on YouTube on what VLC player can do & how to do it.
It has a H%&# of a lot of "hidden" features, so look at some of the YT videos.
It's much more that "just a player."

For ref; > https://www.youtube.com/results?search_query=vlc+player
Here's an oldie from 2014...
> https://www.youtube.com/watch?v=1jMuRnMSQoU

I don't know what the MB Browser is so cannot comment.

Have fun with VLC.

[lovemyfoxy]

Stripping the audio and making them into MP3's, same as the OP, otherwise I would have posted in a new thread.
Thanks for the references.

MB Browser Guard is a free feature now with MBAM. I'll do this in a separate thread, although it's tangentially connected to the OP's security problem.

[LIMPET235]

No probs.
You're welcome...