LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   ActiveX FFox Hijack (https://www.linuxquestions.org/questions/linux-security-4/activex-ffox-hijack-609617/)

r00ster 12-28-2007 10:25 AM

ActiveX FFox Hijack
 
Deb Etch/KDE/Iceweasel
Stand alone DT

I've been unable to stop/interdict the following message in my Iceweasel Browser, even after restarts. I didn't get any warning that it might be an unsafe site: I was looking for instances of allergic responses to certain cosmetics. i.e., "Body Shop" scented oils for the bathroom.

"The page @ http://the moviesite.com says:
Video ActiveX Object Error. Your browser cannot play this image file. Click [OK] to download and install missing ActiveX Object".

It seems to be trying to access:
http://82.103.87.14/download/502/919/0/

How do I 'kill' this connection without downloading it?

The Icedove (Firefox) pid is 3951 "firefox-bin".
Do I just enter "# kill 3951" as root? Or is there a more appropriate command?

Happy trails,

r

win32sux 12-29-2007 03:22 AM

Quote:

Originally Posted by r00ster (Post 3003940)
I've been unable to stop/interdict the following message in my Iceweasel Browser, even after restarts. I didn't get any warning that it might be an unsafe site: I was looking for instances of allergic responses to certain cosmetics. i.e., "Body Shop" scented oils for the bathroom.

"The page @ http://the moviesite.com says:
Video ActiveX Object Error. Your browser cannot play this image file. Click [OK] to download and install missing ActiveX Object".

That themoviesite.com site looks to me like some wannabe-cybersquatter's site. You can sort of tell just by looking at it, but additionally - at the time of this post - Google doesn't show any links to it, and SiteAdvisor doesn't have it in its database. Also, the coding really sucks.

Quote:

The Icedove (Firefox) pid is 3951 "firefox-bin".
Do I just enter "# kill 3951" as root? Or is there a more appropriate command?
Yeah, if you browser froze or something, you could kill it. But you don't need to be root for this. Just issue the kill+PID command as the user which the browser is running as. I typically just do a:
Code:

killall firefox-bin
(I had to do this frequently when using older versions of the Flash plugin.)

PS: I didn't get any prompts like that when I went to the site, but I've got NoScript enabled and have no plans on disabling it for a site like that.

r00ster 12-29-2007 04:32 AM

Win32;

Thanks a bunch. That's the first time I've encountered this kind of installation imperative in linux. Some of the reading I did prior to posting suggests this is beginning to occur more frequently.

I'm not sure just which entry I clicked on in google, but the search involved "Allergic Reactions Doxycycline". Funny place to stick a tick; but then these goofs will do what they will.

Happy New Year;

r


All times are GMT -5. The time now is 03:49 AM.