I installed a Fire Fox browser on Win 7 and it got infected with malware from kat.cr when I tried to download a torrent. This malware ONLY AFFECTS Fire Fox, Chrome works fine and is not affected. I have completely removed and reinstalled FireFox but clearly some files are not being removed because the new invocation already has ghostery installed and it immediately goes back to the last site. That's where Linux gets involved.

The site that seems to trigger the malware to start all sorts of popups and ads is my local server running Linux Slackware 11 and an Apache HTTP server. I can go to other site with Fire Fox (e.g., google.com) without triggering the infection but when I go to my local server stuff starts happening. I have run 4 different virus/malware scanners on this Win 7 machine, all of which find a couple of dozen files that they remove but none of that gets at the seed that reloads all those. One thing it does is reset the "home page" on FireFox. It even does it while I'm on that page setting it, I set it resets.

I'm not sure but I think the same malware tried to attack FireFox on my Slackware64 14.1 machine but it doesn't take there. I closed the browser and reopened it and no more problem. None of these problems show up with the other browsers on Slack 14.1 either. It's only the FireFox on the windows machine, and esp when connecting to the Slack 11 server.

oops, an ad just popped up on the wikipedia site so it's not just my local server.

Create a new Firefox profile and check using the new profile.

Let us know.

Is your server accessible from internet? If it is the web pages it serves may be hacked.

Yes, it must be accessible because my logs show I was attacked like 200k times last year in attempted breakins. Based on the dictionary of user names that were thrown at it I would say that attack came from Italy. Sometimes I had as many as 12 attempts/second of guessing the root password (ssh). The thing is, I don't see any changes to the web pages. They're simple, < 100 lines, mostly menus which select and run .php routines (small simple ones which I wrote). If web pages are hacked, what would it look like? Added links, right?

I'm not sure what you mean by "create a new Firefox profile." However I did login as a different user and Firefox seems to be clean for that user. So it seems it is tied to the user and not the browser or the server? That doesn't sound so bad then.

terminal >
but using another user's environment/login/firefox is just as well.

You could clean out cache from the "infected" user's firefox?

Not at all.

2 members found this post helpful.

Deleting the Mozilla profile seems to have fixed it. Thanks.

Glad it worked out!