LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 11-30-2012, 06:01 PM   #1
mazinoz
Member
 
Registered: Mar 2003
Location: Mansfield Queensland Australia
Distribution: Debian Squeeze. Various live CD's Win7
Posts: 359

Rep: Reputation: 32
Firefox problems "already running, please close process .." Hacked Desktop


After almost two years without a problem, a laptop with a direct internet connection running Linux lubuntu was hacked and I got message along the lines "Can't open firefox, another instance is already running, close this process or reboot"

Found a .mozilla file on the DESKTOP. Once removed the browser behaviour improved. Zeroed drive and upgraded to Linux Mint 14. [I was just trialling an old CD installation with updates, to see if I liked it or not].

What I would like to know is if anyone has had this happen or not. My suspicion is with a truly sick bastard former business associate, running a persistent BF and DOS attack. However my ISP had been having DNS server problems discussed on forums for ages, and recently requests were being sent to akamai servers instead.

But has anyone else found this file on their desktop? Also when I clicked to bring up lower panel menu I saw something weird going on with scripts being written. Then + - and box buttons disappeared from the firefox browser and other windows of apps I opened. I bailed at this stage and lost very little if any data.
 
Old 11-30-2012, 06:24 PM   #2
amani
Senior Member
 
Registered: Jul 2006
Location: Kolkata, India
Distribution: 64-bit GNU/Linux, Kubuntu64, Fedora QA, Slackware,
Posts: 2,758

Rep: Reputation: Disabled
That is not the way to do forensics.
Use stat on important directories and check from a live cd/usb
 
Old 11-30-2012, 09:15 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,699
Blog Entries: 54

Rep: Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962Reputation: 2962
Quote:
Originally Posted by mazinoz View Post
After almost two years without a problem
Yeah, it's been a while since we saw you around...


Quote:
Originally Posted by mazinoz View Post
a laptop with a direct internet connection running Linux lubuntu (..) got message along the lines "Can't open firefox, another instance is already running, close this process or reboot"
When Firefox is running you will find two items in your Firefox profile directory: a symbolic link called "lock" and an empty file called ".parentlock". When Firefox wasn't closed properly it did not clean up the two items and that is why you get the message. When Firefox is not running delete both items. When restarting Firefox the message should not appear again.


Quote:
Originally Posted by mazinoz View Post
Zeroed drive and upgraded to Linux Mint 14. (..) What I would like to know is (..) Also when I clicked to bring up lower panel menu I saw something weird going on with scripts being written. Then + - and box buttons disappeared from the firefox browser and other windows of apps I opened. I bailed at this stage (..)
After zeroing out a drive all "evidence" is gone, meaning there's nothing left for us to check and verify. Also it's not been the first time this occurred and I had hoped you would have learned from past experiences. So next time please contact us as things happen and without doing the things you usually do. It really does not help us help you.
 
Old 12-03-2012, 10:03 AM   #4
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Ubuntu 10.10, Slackware 64-current
Posts: 2,124

Rep: Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776
I've seen this error message occasionally where I close Firefox and then I try to restart it, perhaps too quickly, but it still has a process running. I typically end up doing a ps | grep firefox and then killing the process, which allows for a restart. In my case, I am certain that the problem is not a machine 'hack'.
 
Old 12-03-2012, 10:14 AM   #5
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Hanover, Germany
Distribution: Main: Gentoo Others: What fits the task
Posts: 15,652
Blog Entries: 2

Rep: Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095Reputation: 4095
Quote:
Originally Posted by Noway2 View Post
I've seen this error message occasionally where I close Firefox and then I try to restart it, perhaps too quickly, but it still has a process running. I typically end up doing a ps | grep firefox and then killing the process, which allows for a restart.
The days I used firefox I had the same thing many times, for some reason Firefox didn't shut down correctly, so that I had to kill it.

Quote:
Originally Posted by mazinoz View Post
Also when I clicked to bring up lower panel menu I saw something weird going on with scripts being written. Then + - and box buttons disappeared from the firefox browser and other windows of apps I opened. I bailed at this stage and lost very little if any data.
So you suddenly have problems with Firefox and your window manager, although it worked fine for 2 years. in that case I would rather assume a hardware problem than anything else, especially if you have already made a clean re-install.

Last edited by TobiSGD; 12-03-2012 at 10:17 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
"Keep laptop running on lid close?" + "ssh via crossover cable?" FatalKeystroke Linux - Laptop and Netbook 7 03-11-2011 08:53 AM
Getting "SIOCADDRT: No such process" when running "service network restart" cmlorentz Linux - Networking 1 11-26-2010 02:06 PM
Need solution to "failed to fork PTY" and "error creating the child process" problems Gnusboy Linux - Newbie 4 01-02-2010 08:54 AM
Can I close the process "ath5k_pci" ? pppaaarrrkkk Linux - Newbie 6 11-13-2008 08:33 PM
User "list" running process "python" TroelsSmit Linux - Newbie 2 02-22-2005 05:55 AM


All times are GMT -5. The time now is 07:52 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration