Trouble removing adware from firefox (Linux Mint 18.3)

smackeral · 05-08-2018, 09:18 PM

Sorry if this double posts...it appears to have failed to post on the first attempt

I'm looking for adware removal software for linux. My firefox browser is infected. I get a popup message in the top right corner when I open my browser: https://imgur.com/V6ebkVp

Basically a dating service. When my VPN is turned off it's in english.

I have not visited any porn sites, piracy sites, or any otherwise "shady" sites that would be likely to secretly install anything on my browser. (This is a fresh install of linux just a few days old)
I have uninstalled and reinstalled firefox twice
I have not installed any plugins, extensions or themes to firefox

How do I get rid of this thing?

coralfang · 05-10-2018, 05:15 PM

That's unusual... i would suggest first trying to clean out your existing firefox profile, and see if the problem persists.

Code:

$ mv ~/mozilla/firefox ~/mozilla/firefox-backup

Once you've moved the existing profile aside, try launching firefox again.
If this popup goes away, then you most likely have some kind of add-on that is causing these popups.

hydrurga · 05-10-2018, 05:34 PM

What other software have you installed during the last few days (since the initial install) from anywhere not in the Mint/Ubuntu repos?

As an aide-memoire, if you've installed stuff using apt, you can see your history at /var/log/apt/history.log, but you may have installed software by other means such as dpkg, PPAs, third-party repos, install.sh, etc.

frankbell · 05-10-2018, 08:15 PM

The adware may not be in your Firefox.

Do you have Noscript or a similar add-on installed?

I'm not sure that it applies to the particular pop-up you asked about, but I use a hosts file that blocks many popups by redirecting them to localhost. I've used it for years; it has saved me much irritation.

I do not put in place unedited; rather, I append its contents to my existing /etc/hosts file.

dave@burn-it.co.uk · 05-11-2018, 10:18 AM

That very much looks like a generic browser overlay to me as it is very badly positioned.
I would suggest you clear your browser cache, all temporary files, and check your add-ons.
If those don't work, try a temporary virus scanner and see if that finds anything.

Habitual · 05-11-2018, 11:15 AM

Quote:

Originally Posted by smackeral

I have uninstalled and reinstalled firefox twice

de- and re-installing Firefox won't do jack-all about until you do a

Code:

mv ~/mozilla/firefox ~/mozilla/firefox-backup

Installed from where?
And WHAT VERSION of Firefox?

Code:

sudo apt-get install -yqq clamscan < enter>

...
(back at the prompt as yourself)

Code:

clamscan -ir ~/ <enter>

Nice summary at the end.

Either way, I'd create a new user (non-admin) and login as them and see what pops up, literally

Let us know..

axdoomer · 05-14-2018, 12:02 AM

Make sure you are using the right DNS. Sometimes malicious online scanners are scanning vulnerable routers and replacing their DNS servers address using exploits. They can use this to inject things in your browser, such as popups or redirecting you to malicious websites.

If you do 'cat /etc/resolv.conf' it should give you two IPs. If they are from your ISP or something that you've set by yourself, then there's no problem. In my case I had an IP from a server that wasn't in my country.

-----------

If it's not this, then go into your notification settings. There's a place where you can see a list of website that you have allowed to send you notifications. This will help you: https://support.mozilla.org/en-US/kb...ations-firefox