LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 05-18-2019, 03:12 PM   #1
CVAlkan
Member
 
Registered: Nov 2012
Location: Northwest suburbs of Chicago
Distribution: Ubuntu & Mint LTS, Manjaro Rolling; Android
Posts: 242

Rep: Reputation: Disabled
Firefox Hacked??


I went trolling to find a manual for an older piece of stereo equipment, and found a link purporting to offer a downloadable pdf (I've done this often); as soon as the site opened I realized it was flakey as it offered all sorts of questionable "deals" with no mention of any equipment manuals so I immediately closed it, but the damage had apparently already been done.

The symptom is that *almost* each time I open Firefox a number of little pop up boxes appear sequentially on the desktop (not within the Firefox window itself) with offers for Virus protection and internet speedup software, hot dates in my area, hangover cures, and so forth. Each remains displayed for less than a minute or so and is then replaced with another similar "offer." Things then settle down, as if whatever nefarious actor supplying the ads ran out of offers, and no more popups appear until the next time I open Firefox.

This sequence ONLY happens immediately after starting Firefox, but I can't locate anything in Firefox's settings or add-ons that I didn't know about, so I'm stumped. I do have popups blocked in Firefox, or at least I've always thought I did. And ClamAV doesn't report anything amiss when I run it. So I THINK it's just an annoyance (at least for the moment), but certainly want to get rid of whatever it is.

I'm running Linux Mint 19.1 Cinnamon 4.0.10 and the 4.15.0-50 kernel; the Firefox version is 66.0.5. My user .mozilla directory is so full of obscure files with date/time stamps that seem to be continuously updating as I use it, so I can't tell if anything has been added that doesn't belong. Firefox support wants a one-line description, so that didn't seem like a useful avenue.

Does anyone have any suggestions as to what I might look for? Thanks.
 
Old 05-18-2019, 03:45 PM   #2
ChuangTzu
Senior Member
 
Registered: May 2015
Location: Where ever needed
Distribution: Slackware/Salix while testing others
Posts: 1,718

Rep: Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857
First, go to /home/[user] and rename .mozilla to .mozilla-old then launch firefox which will generate a new .mozilla folder. If the problem goes away then delete the old .mozilla folder and start with the new one. Keep in mind you will also lose your bookmarks, history etc... Do you have a clean backup where you could delete .mozilla and replace it with the backup?
 
Old 05-18-2019, 04:47 PM   #3
Shadow_7
Senior Member
 
Registered: Feb 2003
Distribution: debian
Posts: 4,137
Blog Entries: 1

Rep: Reputation: 874Reputation: 874Reputation: 874Reputation: 874Reputation: 874Reputation: 874Reputation: 874
There's more parts than $HOME/.mozilla now. Some things in .cache/ and .config/ and other places. Alternatively just setup a new user and use that to clear the cache / start a fresh session with no cache. And update your system so that any known flaws that were fixed will be on your system.
 
Old 05-18-2019, 05:25 PM   #4
hydrurga
LQ Guru
 
Registered: Nov 2008
Location: Pictland
Distribution: Linux Mint 21 MATE
Posts: 8,048
Blog Entries: 5

Rep: Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925Reputation: 2925
If you're running Mint then you should be running TimeShift. Use it to restore your system to a snapshot that was taken before the issue occurred.
 
Old 05-19-2019, 01:43 AM   #5
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
Quote:
Originally Posted by Shadow_7 View Post
There's more parts than $HOME/.mozilla now. Some things in .cache/ and .config/ and other places.
AFAIK firefox still does not use either ~/.config or ~/.local/share (and I'm not sure what "other places" you might be refering to).
Simply deleting ~/.cache/mozilla/firefox might have been a good first step, though, but I suspect that won't be enough and ChuangTzu's recommend is the way to go.

In the future:
Use some sort of javascript blocking addon; that way you can see at least some of any site (*) before deciding to trust it or not, without running the risk of it already doing harm to your FF profile.

(*) there's a few sites that won't display anything at all without javascript; I'd like to say that these sites are malicious by default but unfortunately that's not true - often it's just web developer stupidity. using some BS "framework" to create their site.
 
Old 05-19-2019, 03:44 AM   #6
mrmazda
LQ Guru
 
Registered: Aug 2016
Location: SE USA
Distribution: openSUSE 24/7; Debian, Knoppix, Mageia, Fedora, others
Posts: 5,788
Blog Entries: 1

Rep: Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065Reputation: 2065
Quote:
Originally Posted by ChuangTzu View Post
First, go to /home/[user] and rename .mozilla to .mozilla-old then launch firefox which will generate a new .mozilla folder. If the problem goes away then delete the old .mozilla folder and start with the new one.
$HOME/.mozilla can contain far more than one Firefox profile. My .mozilla/ contains 25 subdirectories covering 21 different Firefox and SeaMonkey profile directories. If you have more than one app using .mozilla then you can lose a lot more than one profile. .mozilla/firefox/profiles.ini contains locations and names of firefox profiles that can be used to be more selective in what to hide, rename or delete.
 
Old 05-19-2019, 02:30 PM   #7
ChuangTzu
Senior Member
 
Registered: May 2015
Location: Where ever needed
Distribution: Slackware/Salix while testing others
Posts: 1,718

Rep: Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857
Quote:
Originally Posted by mrmazda View Post
$HOME/.mozilla can contain far more than one Firefox profile. My .mozilla/ contains 25 subdirectories covering 21 different Firefox and SeaMonkey profile directories. If you have more than one app using .mozilla then you can lose a lot more than one profile. .mozilla/firefox/profiles.ini contains locations and names of firefox profiles that can be used to be more selective in what to hide, rename or delete.
Very true, which is why one should always take advice and learn (dig deeper) not just copy paste commands. If we went through every possible use case each answer would be several pages for each scenario. Do you use X then do Y, do you use YZ then revert back to A, unless you use C then choose option B....
 
  


Reply

Tags
firefox, popups


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: After Firefox, LibreOffice Has Been Hacked to Work on Wayland - Video LXer Syndicated Linux News 0 07-28-2015 11:01 PM
Firefox problems "already running, please close process .." Hacked Desktop mazinoz Linux - Security 4 12-03-2012 09:14 AM
LXer: Firefox 8 is 20% Faster than Firefox 5, Install Firefox 8 in Ubuntu via PPA LXer Syndicated Linux News 0 07-21-2011 09:31 PM
[SOLVED] My network is hacked for sure. I want to reinstall but it will be hacked again. MsRefusenik Linux - Security 19 10-18-2010 05:02 PM
my firefox got hacked, messagebox / alert spam / lots of messageboxes H_TeXMeX_H Linux - Software 4 12-01-2009 05:39 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration