[SOLVED] Linux Mint 19.3/Firefox browser hacked

[hepme]

Wow! BUGGER! Thought Linux was fairly secure..

I had spent the day tinkering with VirtualBox to stumble through setting it up with VB to allow me to run a program on video filing I had purchased a couple years ago to directly access it on the Linux which I use on an entertainment computer running a big screen.

I had studied a lot of websites all from VB searches and started to finally get things to work with my old W-7 Ultimate loaded into the VB (sorta) when the browser locked up and I was presented with a message all decorated with the Microsoft 7 logo: SUPPORT WINDOWS.COM/ WINDOWS WARNING ALERT/ MALICIOUS <violates forum rules> SOFTWARE-RISKWARE DETECTED/ ERROR#0x80092ee9. Pretty obvious it was a malicious PIA unless VirtualBox is pornographic in nature

The browser was running with the Linux Host. Anyone else experiencing this..maybe because Windows-7 is now End Of Life and the 'ner-do-wells' smell blood?

[Hoser Rob]

Haven't seen that but have seen similar. Anyone who thinks Linux makes you immune to browser hacks is seriously mistaken.

[Pjotr]

No worries, mate. It's just another popup scam:
https://www.google.com/search?q=SUPPORT ... 0x80092ee9

[Flemur]

my old W-7 Ultimate loaded into the VB (sorta) when the browser locked up

Is this linux firefox or a Win-7 firefox in VB?
If linux, just close the tab, and what does VB have to do with it?
If VB, what does linux have to do with it? Did it mess up your linux OS or $HOME?

(It "locks up" by supposedly using a lot of CPU.)

[hepme]

Firstly; remember I am new to Linux so slowly learning. (VERY subject-dumb)

I found the web search for remedies but all appeared to be geared to WINDOWS not LINUX. There was a plethora of 'click here's' but was shy about clicking anything at this point. After a couple hours, got PD'd and just timeshifted to old image which fixed it. Tried to take Firefox off, clean it and reload it but was still there. Loaded Chromium (which I dislike[google])and it worked, but at that point timeshifted back and the firefox that was already on it worked fine and the BS was gone.

Nothing was accessed via the Guest (W-7) and was all done on the Host (Linux Mint 19.3). The VB was still being configured (trying to be figured out) so it was only mentioned to give details if it makes any difference. So, in my humble-newbie mind I would respond that the Linux OS had some crap seeded by the intruder that screwed-up the then-current and re-loaded Firefox browser loadings.

Again, I would guess that any windows remedy antivirus programs would be unusable on linux-correct?

This was posted purely as informational, as for me I TIMESHIFTED back to a uncontaminated system copy- Thanks

[kukamuumuka]

Open Terminal and run

Code: Select all

killall firefox
mv .mozilla .mozilla.bad
rm -rf $HOME/.cache

[hepme]

Thanks for the code Kukamuumuka, I'll remember it if I again get the 'bug'. The timeshifted pre-infection copy seems to be OK. Thanks

[Moem]

It wasn't a bug and it wasn't a virus. It was browser malware. And yes, browsers are vulnerable to that, even on Linux.

You're right: Windows antivirus software won't run on Linux. It's a good thing that Windows viruses don't run on Linux either.

[Flemur]

Thanks for the code Kukamuumuka, I'll remember it if I again get the 'bug'. The timeshifted pre-infection copy seems to be OK. Thanks

Keep in minds that this:

Code: Select all

mv .mozilla .mozilla.bad

will lose all your bookmarks, addons and saved passwords, just like in windows ('tho they are still in .bad directory). Try the other first.

[hepme]

" It was browser malware." I'll remember that.
Thanks to all

..it would have been helpful to know IF such can be remove from Linux and how to go about it- for future reference..

[Schultz]

If it infects the profile, it's as simple as deleting the current default profile and creating a new one.

[decrepit]

In that case should we back up our firefox profile?

[Schultz]

decrepit wrote:
In that case should we back up our firefox profile?

That's always a good idea. Sometimes profiles get borked even without a browser malware.

[kukamuumuka]

In that case should we back up our firefox profile?

Have you noticed, that an old profile is backupped?
viewtopic.php?p=1745498#p1745498

[decrepit]

Have you noticed, that an old profile is backupped?
viewtopic.php?p=1745498#p1745498

No, but I see it's 6 months old, I'll update it now. Thanks