Firefox Hacked??
 

I went trolling to find a manual for an older piece of stereo equipment, and found a link purporting to offer a downloadable pdf (I've done this often); as soon as the site opened I realized it was flakey as it offered all sorts of questionable "deals" with no mention of any equipment manuals so I immediately closed it, but the damage had apparently already been done.

The symptom is that *almost* each time I open Firefox a number of little pop up boxes appear sequentially on the desktop (not within the Firefox window itself) with offers for Virus protection and internet speedup software, hot dates in my area, hangover cures, and so forth. Each remains displayed for less than a minute or so and is then replaced with another similar "offer." Things then settle down, as if whatever nefarious actor supplying the ads ran out of offers, and no more popups appear until the next time I open Firefox.

This sequence ONLY happens immediately after starting Firefox, but I can't locate anything in Firefox's settings or add-ons that I didn't know about, so I'm stumped. I do have popups blocked in Firefox, or at least I've always thought I did. And ClamAV doesn't report anything amiss when I run it. So I THINK it's just an annoyance (at least for the moment), but certainly want to get rid of whatever it is.

I'm running Linux Mint 19.1 Cinnamon 4.0.10 and the 4.15.0-50 kernel; the Firefox version is 66.0.5. My user .mozilla directory is so full of obscure files with date/time stamps that seem to be continuously updating as I use it, so I can't tell if anything has been added that doesn't belong. Firefox support wants a one-line description, so that didn't seem like a useful avenue.

Does anyone have any suggestions as to what I might look for? Thanks.

First, go to /home/[user] and rename .mozilla to .mozilla-old then launch firefox which will generate a new .mozilla folder. If the problem goes away then delete the old .mozilla folder and start with the new one. Keep in mind you will also lose your bookmarks, history etc... Do you have a clean backup where you could delete .mozilla and replace it with the backup?

There's more parts than $HOME/.mozilla now. Some things in .cache/ and .config/ and other places. Alternatively just setup a new user and use that to clear the cache / start a fresh session with no cache. And update your system so that any known flaws that were fixed will be on your system.

If you're running Mint then you should be running TimeShift. Use it to restore your system to a snapshot that was taken before the issue occurred.

AFAIK firefox still does not use either ~/.config or ~/.local/share (and I'm not sure what "other places" you might be refering to).
Simply deleting ~/.cache/mozilla/firefox might have been a good first step, though, but I suspect that won't be enough and ChuangTzu's recommend is the way to go.

In the future:
Use some sort of javascript blocking addon; that way you can see at least some of any site (*) before deciding to trust it or not, without running the risk of it already doing harm to your FF profile.

(*) there's a few sites that won't display anything at all without javascript; I'd like to say that these sites are malicious by default but unfortunately that's not true - often it's just web developer stupidity. using some BS "framework" to create their site.

$HOME/.mozilla can contain far more than one Firefox profile. My .mozilla/ contains 25 subdirectories covering 21 different Firefox and SeaMonkey profile directories. If you have more than one app using .mozilla then you can lose a lot more than one profile. .mozilla/firefox/profiles.ini contains locations and names of firefox profiles that can be used to be more selective in what to hide, rename or delete.

Very true, which is why one should always take advice and learn (dig deeper) not just copy paste commands. If we went through every possible use case each answer would be several pages for each scenario. Do you use X then do Y, do you use YZ then revert back to A, unless you use C then choose option B.... ;)