Jump to content



Photo

Some Virus in FireFox Please Help


  • Please log in to reply
65 replies to this topic

#16 Detection

Detection

    Detecting stuff...

  • Joined: 30-October 10
  • Location: UK
  • OS: 7 SP1 x64

Posted 14 February 2013 - 14:31

There is a guide here for battling a redirect virus

http://malwaretips.c...redirect-virus/

You might want to scan for rootkits too if normal AVs / malware scanners can't find anything

I think Kaspersky has a rescue boot disk capable of finding rootkits


What was the file you downloaded and ran ?

Have you checked simple things like programs and features to see if there is some adware / spyware crap installed ?


#17 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 100
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 14 February 2013 - 14:36

Why would a virus do such a thing - makes NO sense.. Opening up sites that it wants, sure - opening sites to ads, ok..

But if you open a file and opens tabs with each word?? I highly doubt its redirecting anything, more like just seaching for the word or opening the domain what word matches up too. Sounds more like a bug with the file opening process to me.

So are you just clicking on these html files, or are you in firefox doing open file?

#18 Detection

Detection

    Detecting stuff...

  • Joined: 30-October 10
  • Location: UK
  • OS: 7 SP1 x64

Posted 14 February 2013 - 14:48

Why would a virus do such a thing - makes NO sense.. Opening up sites that it wants, sure - opening sites to ads, ok..

But if you open a file and opens tabs with each word?? I highly doubt its redirecting anything, more like just seaching for the word or opening the domain what word matches up too. Sounds more like a bug with the file opening process to me.

So are you just clicking on these html files, or are you in firefox doing open file?


I'm just going from OPs post saying: "When ever i open a .HTML file from my computer, the Firefox opens some sites itself (cam sites, ebook sites etc.)"

#19 OP badb0y

badb0y

    I'm Bad!

  • Tech Issues Solved: 1
  • Joined: 10-April 09
  • Location: NY

Posted 14 February 2013 - 15:17

okay, i followed everything on this page: http://malwaretips.c...redirect-virus/

but no luck

Also, this only happens when i open .html outside of browser. If i open any html file from file menu of browser then it opens normally. If i double click on any .html file than it opens in an unusual way redirecting and searching for file name words..

#20 Detection

Detection

    Detecting stuff...

  • Joined: 30-October 10
  • Location: UK
  • OS: 7 SP1 x64

Posted 14 February 2013 - 15:23

okay, i followed everything on this page: http://malwaretips.c...redirect-virus/

but no luck

Also, this only happens when i open .html outside of browser. If i open any html file from file menu of browser then it opens normally. If i double click on any .html file than it opens in an unusual way redirecting and searching for file name words..


Have you gone to the HTML files properties via right click and made sure Firefox is set as the default program to open them ?

#21 +primortal

primortal

    Why Does It Hurt!

  • Tech Issues Solved: 2
  • Joined: 18-October 01
  • Location: USA
  • OS: Windows 8
  • Phone: Nokia Lumia Icon (929)

Posted 14 February 2013 - 15:26

Does the same thing happen if you select IE as your default browser or right-click on the .html file and select IE? At least I would point to an OS issue vs. a Firefox one.

#22 LaP

LaP

    Forget about it

  • Tech Issues Solved: 4
  • Joined: 10-July 06
  • Location: Quebec City, Canada
  • OS: Windows 8.1 Pro Update 1

Posted 14 February 2013 - 15:28

Open regedit and look for .html and .htm file extension shell options.

#23 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 100
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 14 February 2013 - 15:57

What OS are you running? Did you already post that? XP, Vista, 7, 8? Some other windows - linux?

If only happens when you click on it or use open with in explorer, then sure it could be something wrong in the way the file is passed to firefox.. I like the idea of the test of using different browser to open the file the same way. I assume you have done this already since you stated it doesn't happen with other browsers. So are you using open with, or just doubleclicking and its using firefox as default to open html files. What if you change the association of html files to different browser so that if you double click them its opened in IE or Chrome, Opera, etc. What happens then?

If we know what OS your using it will help us pinpoint where the issue might be.

curious what your HKEY_CLASSES_ROOT\FirefoxHTML\shell\open\command

is?

For example mine is
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1"

Do you happen to have maybe %2 %3 or something added to yours? Im going to edit mine to see if I can duplicate your issue. This is from a XP box btw.

#24 1941

1941

    Banned

  • Joined: 17-July 06

Posted 14 February 2013 - 16:01

Remove Fx completely. Then do a thorough virus scan. Then re install Firefox. If you use system restore, delete all of your restore points as they will be infected.

#25 OP badb0y

badb0y

    I'm Bad!

  • Tech Issues Solved: 1
  • Joined: 10-April 09
  • Location: NY

Posted 14 February 2013 - 16:08

okay, I tried making chrome and IE my default browsers, everything works normal in IE and Chrome. I changed associations and tried on both, chrome and IE, everything works normal.
then again associated or not, theres problem with firefox.

I am using Windows 8

#26 Nothing Here

Nothing Here

    Neowinian Senior

  • Joined: 23-February 08
  • Location: California, U.S.A.
  • OS: Windows 8 Pro / Kororaa 17

Posted 14 February 2013 - 16:21

Ok, let's try this:

Delete everything in the following folders:
C:\Windows\Temp
C:\Windows\SoftwareDistribution\Download
C:\Windows\Prefetch
C:\Users\Froggy\AppData\Local\Mozilla\Firefox\Profiles\"FF default user".default
C:\Users\Froggy\AppData\Local\Temp


Now, re-dl Firefox. Uninstall Firefox. Make sure all Firefox entries are gone, then check:

C:\Users\Froggy\AppData\Roaming

Make sure the Mozilla folder is gone from there also. Run Ccleaner and make sure to use the regclean mode of Ccleaner. Reinstall Firefox and hopefully everything is good to go.

#27 LaP

LaP

    Forget about it

  • Tech Issues Solved: 4
  • Joined: 10-July 06
  • Location: Quebec City, Canada
  • OS: Windows 8.1 Pro Update 1

Posted 14 February 2013 - 16:26

I might be wrong but imo there's a high probability that the problem is in the registry. Re-installing Firefox or removing any temp files wont change anything.

I don't know where the html/htm files shell open options are for firefox on your OS. But the problem is probably related to this entry in the registry. Follow Budman advice (post #23).

#28 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 100
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 14 February 2013 - 16:29

Yeah I am not sure if windows 8 changes that at all - but I would look there to see if something is odd in the string to open html.

I tried changing mine up a bit to see if I could try and duplicate the sort of issue, but as of yet no. I can break it opening ;) But not opening up the different words in the file name as new tabs. It really looks like a parse issue with the file name to me.. What do you have in the key I posted?

#29 1941

1941

    Banned

  • Joined: 17-July 06

Posted 14 February 2013 - 16:31

I might be wrong but imo there's a high probability that the problem is in the registry. Re-installing Firefox or removing any temp files wont change anything.

I don't know where the html/htm files shell open options are for firefox on your OS. But the problem is probably related to this entry in the registry. Follow Budman advice (post #23).


He can remove all references to Firefox in the registry.

#30 OP badb0y

badb0y

    I'm Bad!

  • Tech Issues Solved: 1
  • Joined: 10-April 09
  • Location: NY

Posted 14 February 2013 - 16:32

Ok, let's try this:

Delete everything in the following folders:
C:\Windows\Temp
C:\Windows\SoftwareDistribution\Download
C:\Windows\Prefetch
C:\Users\Froggy\AppData\Local\Mozilla\Firefox\Profiles\"FF default user".default
C:\Users\Froggy\AppData\Local\Temp


Now, re-dl Firefox. Uninstall Firefox. Make sure all Firefox entries are gone, then check:

C:\Users\Froggy\AppData\Roaming

Make sure the Mozilla folder is gone from there also. Run Ccleaner and make sure to use the regclean mode of Ccleaner. Reinstall Firefox and hopefully everything is good to go.



Tried all this... No luck