65 replies to this topic

[Detection]

There is a guide here for battling a redirect virus

http://malwaretips.c...redirect-virus/

You might want to scan for rootkits too if normal AVs / malware scanners can't find anything

I think Kaspersky has a rescue boot disk capable of finding rootkits


What was the file you downloaded and ran ?

Have you checked simple things like programs and features to see if there is some adware / spyware crap installed ?

[+BudMan]

Why would a virus do such a thing - makes NO sense.. Opening up sites that it wants, sure - opening sites to ads, ok..

But if you open a file and opens tabs with each word?? I highly doubt its redirecting anything, more like just seaching for the word or opening the domain what word matches up too. Sounds more like a bug with the file opening process to me.

So are you just clicking on these html files, or are you in firefox doing open file?

[Detection]

BudMan, on 14 February 2013 - 14:36, said:

Why would a virus do such a thing - makes NO sense.. Opening up sites that it wants, sure - opening sites to ads, ok..

But if you open a file and opens tabs with each word?? I highly doubt its redirecting anything, more like just seaching for the word or opening the domain what word matches up too. Sounds more like a bug with the file opening process to me.

So are you just clicking on these html files, or are you in firefox doing open file?

I'm just going from OPs post saying: "When ever i open a .HTML file from my computer, the Firefox opens some sites itself (cam sites, ebook sites etc.)"

[American Mafia]

okay, i followed everything on this page: http://malwaretips.c...redirect-virus/

but no luck

Also, this only happens when i open .html outside of browser. If i open any html file from file menu of browser then it opens normally. If i double click on any .html file than it opens in an unusual way redirecting and searching for file name words..

[Detection]

American Mafia, on 14 February 2013 - 15:17, said:

okay, i followed everything on this page: http://malwaretips.c...redirect-virus/

but no luck

Also, this only happens when i open .html outside of browser. If i open any html file from file menu of browser then it opens normally. If i double click on any .html file than it opens in an unusual way redirecting and searching for file name words..

Have you gone to the HTML files properties via right click and made sure Firefox is set as the default program to open them ?

[+primortal]

Does the same thing happen if you select IE as your default browser or right-click on the .html file and select IE? At least I would point to an OS issue vs. a Firefox one.

[LaP]

Open regedit and look for .html and .htm file extension shell options.

[+BudMan]

What OS are you running? Did you already post that? XP, Vista, 7, 8? Some other windows - linux?

If only happens when you click on it or use open with in explorer, then sure it could be something wrong in the way the file is passed to firefox.. I like the idea of the test of using different browser to open the file the same way. I assume you have done this already since you stated it doesn't happen with other browsers. So are you using open with, or just doubleclicking and its using firefox as default to open html files. What if you change the association of html files to different browser so that if you double click them its opened in IE or Chrome, Opera, etc. What happens then?

If we know what OS your using it will help us pinpoint where the issue might be.

curious what your HKEY_CLASSES_ROOT\FirefoxHTML\shell\open\command

is?

For example mine is
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1"

Do you happen to have maybe %2 %3 or something added to yours? Im going to edit mine to see if I can duplicate your issue. This is from a XP box btw.

[1941]

Remove Fx completely. Then do a thorough virus scan. Then re install Firefox. If you use system restore, delete all of your restore points as they will be infected.

[American Mafia]

okay, I tried making chrome and IE my default browsers, everything works normal in IE and Chrome. I changed associations and tried on both, chrome and IE, everything works normal.
then again associated or not, theres problem with firefox.

I am using Windows 8

[Nothing Here]

Ok, let's try this:

Delete everything in the following folders:
C:\Windows\Temp
C:\Windows\SoftwareDistribution\Download
C:\Windows\Prefetch
C:\Users\Froggy\AppData\Local\Mozilla\Firefox\Profiles\"FF default user".default
C:\Users\Froggy\AppData\Local\Temp


Now, re-dl Firefox. Uninstall Firefox. Make sure all Firefox entries are gone, then check:

C:\Users\Froggy\AppData\Roaming

Make sure the Mozilla folder is gone from there also. Run Ccleaner and make sure to use the regclean mode of Ccleaner. Reinstall Firefox and hopefully everything is good to go.

[LaP]

I might be wrong but imo there's a high probability that the problem is in the registry. Re-installing Firefox or removing any temp files wont change anything.

I don't know where the html/htm files shell open options are for firefox on your OS. But the problem is probably related to this entry in the registry. Follow Budman advice (post #23).

[+BudMan]

Yeah I am not sure if windows 8 changes that at all - but I would look there to see if something is odd in the string to open html.

I tried changing mine up a bit to see if I could try and duplicate the sort of issue, but as of yet no. I can break it opening But not opening up the different words in the file name as new tabs. It really looks like a parse issue with the file name to me.. What do you have in the key I posted?

[1941]

LaP, on 14 February 2013 - 16:26, said:

I might be wrong but imo there's a high probability that the problem is in the registry. Re-installing Firefox or removing any temp files wont change anything.

I don't know where the html/htm files shell open options are for firefox on your OS. But the problem is probably related to this entry in the registry. Follow Budman advice (post #23).

He can remove all references to Firefox in the registry.

[American Mafia]

Just Sal, on 14 February 2013 - 16:21, said:

Ok, let's try this:

Delete everything in the following folders:
C:\Windows\Temp
C:\Windows\SoftwareDistribution\Download
C:\Windows\Prefetch
C:\Users\Froggy\AppData\Local\Mozilla\Firefox\Profiles\"FF default user".default
C:\Users\Froggy\AppData\Local\Temp


Now, re-dl Firefox. Uninstall Firefox. Make sure all Firefox entries are gone, then check:

C:\Users\Froggy\AppData\Roaming

Make sure the Mozilla folder is gone from there also. Run Ccleaner and make sure to use the regclean mode of Ccleaner. Reinstall Firefox and hopefully everything is good to go.

Tried all this... No luck