Firefox Virus

[M8WHRR]

Evening. Been using mint for a few years now, great so far. I tried downloading a couple games the other day and ever since I've had q_search jumping in on my Firefox. I search through the address bar, which is set for yahoo and it jumps to an address which is oll3.xyz

I've installed ClamAv and ClamTk, but I have no idea where to start. I've searched usr/bin and usr/bin/Firefox. Any help would be much appreciated.

[sleeper12]

Go to Firefox settings, Add-ons, Extensions & remove any suspicious extensions. Others can advise if you need to do more.

[MrGrimm]

first i'd uninstall those games. sounds like one either had something it shouldn't hidden in it,or you missed a box to uncheck to not add it's 3rd party crapware. then i would fix my firefox.

[Pjotr]

Delete your current .mozilla profile and start with a new, clean profile. You'll lose all of your bookmarks and all of your stored website passwords, though.

Code: Select all

rm -r -v ~/.mozilla && rm -r -v ~/.cache/mozilla

[MrGrimm]

Delete your current .mozilla profile and start with a new, clean profile. You'll lose all of your bookmarks and all of your stored website passwords, though.

Code: Select all

rm -r -v ~/.mozilla && rm -r -v ~/.cache/mozilla

simply NO! really no need to lope off one's own head to simply remove a zit.

[Pjotr]

Delete your current .mozilla profile and start with a new, clean profile. You'll lose all of your bookmarks and all of your stored website passwords, though.

Code: Select all

rm -r -v ~/.mozilla && rm -r -v ~/.cache/mozilla

simply NO! really no need to lope off one's own head to simply remove a zit.

I had no idea that your head was in your .mozilla profile.

Look, when there's clearly a contamination by malware in the .mozilla profile, there's no telling how deeply it has infiltrated into it and how widely it has spread in it. Better safe than sorry.

Losing the bookmarks is not too difficult to recover from. And the stored website passwords need to be changed now, anyway.

@OP: after the cleanup I advise to run your Firefox in a sandbox, like this:
https://easylinuxtipsproject.blogspot.c ... ndbox.html

[Schultz]

If you want to get rid of that nastyware, follow Pjotr's advice.

[all41]

If you want to get rid of that nastyware, follow Pjotr's advice.

+1
and also +1 for using Firejail sandbox to thwart further corruptions like this

[MrGrimm]

Delete your current .mozilla profile and start with a new, clean profile. You'll lose all of your bookmarks and all of your stored website passwords, though.

Code: Select all

rm -r -v ~/.mozilla && rm -r -v ~/.cache/mozilla

simply NO! really no need to lope off one's own head to simply remove a zit.

I had no idea that your head was in your .mozilla profile.

Look, when there's clearly a contamination by malware in the .mozilla profile, there's no telling how deeply it has infiltrated into it and how widely it has spread in it. Better safe than sorry.

Losing the bookmarks is not too difficult to recover from. And the stored website passwords need to be changed now, anyway.

@OP: after the cleanup I advise to run your Firefox in a sandbox, like this:
https://easylinuxtipsproject.blogspot.c ... ndbox.html

humorous you're not. that said you're ASSuming that it's something that can't be simply removed from the addons. my roommate is a good one for forgetting to uncheck and i end up having to fix the problem he created. more times than not where the browser is concerned it's a simple matter of uninstalling something from the os and or removing a addon that was added without permission. do the checks to see if the profile can be saved first.

[philotux]

@ M8WHRR

Perhaps a less drastic option would be to refresh your Firefox:

If you're having problems with Firefox, refreshing it can help. The refresh feature fixes many issues by restoring Firefox to its default state while saving your essential information like bookmarks, passwords, and open tabs.

Please refer to: https://support.mozilla.org/en-US/kb/re ... d-settings

[MrGrimm]

@ M8WHRR

Perhaps a less drastic option would be to refresh your Firefox:

If you're having problems with Firefox, refreshing it can help. The refresh feature fixes many issues by restoring Firefox to its default state while saving your essential information like bookmarks, passwords, and open tabs.

Please refer to: https://support.mozilla.org/en-US/kb/re ... d-settings

+1

[Pierre]

you should still be able to export & save your current Bookmarks List though:
- - Bookmarks - Show all Bookmarks - - Import & backup - - Backup ( to a *.JSON file )
then use that mentioned Reset Function - - Help - Troubleshooting Information.

or - just follow Pjotr's advice on restoring your .mozilla profile.

[Pjotr]

humorous you're not. that said you're ASSuming

And you're not good at hiding donkeys. It takes one to know one, I suppose. Heehaw, brother!

Now let the following sink in. There's a difference between acting like a sloppy "whatever, man" teenager and acting like a responsible man who cares about a potential leak of his stored website passwords.

There's no way of knowing for sure, that a clearly infected .mozilla profile didn't also leak its stored website passwords to the creator of the malware. So changing those immediately, each and every one of them, should be first priority. Which means that losing them all by creating a shiny clean new .mozilla profile, isn't a true loss anyway.

As to the bookmarks: Pierre's suggestion should make the loss of those even easier to overcome.

[philotux]

There's no way of knowing for sure, that a clearly infected .mozilla profile didn't also

... infect other parts of the home directory. Is it safe to assume that the malware stays contained within the .mozilla folder?

[Pjotr]

There's no way of knowing for sure, that a clearly infected .mozilla profile didn't also

... infects other parts of the home directory. Is it safe to assume that the malware stays contained within the .mozilla folder?

No, but that's why I advise to run your web browser in a sandbox:
https://easylinuxtipsproject.blogspot.c ... ndbox.html

[philotux]

Yes, that's a must! Maybe it should be a sticky somewhere in the forums:

Sandbox your browser!

at the very least.

[MrGrimm]

as stated do not delete your profile unless there is no other choice.

[Pjotr]

as stated do not delete your profile unless there is no other choice.

Simply repeating debunked bad advice without giving new arguments, doesn't make it any more valid.

[MrGrimm]

first it's not debunked advice, second it's not bad advice and you know it. you damn well know you only use the nuclear option if there is no other choice.

[Pjotr]

first it's not debunked advice, second it's not bad advice and you know it. you damn well know you only use the nuclear option if there is no other choice.

Deleting the current .mozilla profile isn't the nuclear option. The nuclear option, which would indeed be exaggerated, would be to delete all the contents of the personal user folder. The rest of your message is just, again, repetition of your debunked bad advice....

Peace!
https://www.youtube.com/watch?v=qfTdCYl-c70