Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firefox - ads in new tabs popping up


  • This topic is locked This topic is locked
8 replies to this topic

#1 petiepete

petiepete

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 01 June 2015 - 10:19 AM

My Firefox has a hidden ad-on or hijack that's popping advertisements into separate tabs whenever I interact with some forms or links on benign websites (common websites like CNN, Homedepot.com).  This doesn't happen when I load Firefox in Safe Mode, but I need some extensions for work, so this isn't a long-term solution.

 

I checked my extensions and ad-ons and they are all from trusted organizations.

 

I've run Malwarebytes, Ad-Aware, HitmanPro, JRT, but they've not been able to remove whatever's causing this.  I made sure these programs had the latest updates before running and that my regular anti-malware (Symantec Endpoint Protection) was disabled at the time.

 

I've cleared all Firefox caches and deleted all cookies, but the problem still occurs.

 

This isn't happening with IE or Chrome on the same machine, only Firefox. I've tested all 3 browsers with the same forms on the same pages, and only Firefox produces the new tabs.

 

I checked my recently installed programs and they're all benign as well - there's nothing I cannot account for.

 

I uninstalled Firefox, rebooted, then re-installed Firefox, but the issue is still there.

 

Sysinfo:

Firefox: 38.0.1
Windows: 7 Professional SP1 (64-bit)

 



BC AdBot (Login to Remove)

 


#2 ken545

ken545

    Malware Response Team


  • Malware Response Team
  • 1,685 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Space Coast of Florida
  • Local time:10:22 PM

Posted 02 June 2015 - 09:30 AM

:welcome:

 

Lets run these scanners and see what'g going on

 

1QYkxTZ.jpg Please download aswMBR to your desktop.
 
  • Right click the aswMBR icon and select Run as Administrator
  • XP users just Double Click it to run
  • If it says that this computer supports VIRTUALIZATION TECHNOLOGY do you want to use it say Yes
  • Click the Scan button to start scan.
  • Select Quickscan on the dropdown list
  • If you are asked to update the Avast Virus database please allow it to do so.
  • The scan could take 20 minutes or more , please be patient and let it finish
  • It will say Scan Finished when its done.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
  •  
    I just want to see the report....Please Do Not Fix Anything
     
    ============================================================================
     
     
     
    You need to download and run the 64bit version of FRST, make sure you download it to your desktop

    Please download Farbar Recovery Scan Tool and save it to your DESKTOP
     
    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
     
    How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
    A simple way to check your system: Start --> Computer (right click) --> Properties
     
    FRST_zps5d956a1a.jpg
     
     
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Please make sure All Users is checked
  • Just keep the defaults as in the picture checkmarked
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

  • mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



    donate.gif Please consider a donation to help me keep up my fight against malware.

     

    Just a reminder that threads will be closed if no response in 3 days


    #3 petiepete

    petiepete
    • Topic Starter

    • Members
    • 4 posts
    • OFFLINE
    •  
    • Local time:10:22 PM

    Posted 02 June 2015 - 03:50 PM

    Ken:  I'll check these out when I get a chance.  I found the source of the problem - it wasn't malware directly, but an out of date Firefox extension (FoxLingo).  Once I disabled that extension, the problem went away.



    #4 ken545

    ken545

      Malware Response Team


    • Malware Response Team
    • 1,685 posts
    • OFFLINE
    •  
    • Gender:Male
    • Location:The Space Coast of Florida
    • Local time:10:22 PM

    Posted 02 June 2015 - 04:55 PM

    There could be more, it would be to your benefit to run the scanners and lets see if there is anything else that needs to go


    mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



    donate.gif Please consider a donation to help me keep up my fight against malware.

     

    Just a reminder that threads will be closed if no response in 3 days


    #5 petiepete

    petiepete
    • Topic Starter

    • Members
    • 4 posts
    • OFFLINE
    •  
    • Local time:10:22 PM

    Posted 02 June 2015 - 07:23 PM

    There could very well be more, but I've already run Malwarebytes, Ad-Aware, HitmanPro and JRT, all following the instructions for each step by step (including having the latest updates), I have Symantec Endpoint Protection running constantly (always with the latest updates), and I run Malwarebytes on a weekly basis. I'm fairly well covered now, no?



    #6 ken545

    ken545

      Malware Response Team


    • Malware Response Team
    • 1,685 posts
    • OFFLINE
    •  
    • Gender:Male
    • Location:The Space Coast of Florida
    • Local time:10:22 PM

    Posted 02 June 2015 - 08:12 PM

    Dont know, your not saying if any of those programs found threats and removed them, just looking at the logs for the scanners I posted will tell


    mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



    donate.gif Please consider a donation to help me keep up my fight against malware.

     

    Just a reminder that threads will be closed if no response in 3 days


    #7 petiepete

    petiepete
    • Topic Starter

    • Members
    • 4 posts
    • OFFLINE
    •  
    • Local time:10:22 PM

    Posted 02 June 2015 - 08:14 PM

    Whenever malware or suspicious cookies are found by these programs, I follow the advice given by the program



    #8 ken545

    ken545

      Malware Response Team


    • Malware Response Team
    • 1,685 posts
    • OFFLINE
    •  
    • Gender:Male
    • Location:The Space Coast of Florida
    • Local time:10:22 PM

    Posted 02 June 2015 - 08:21 PM

    Well, your call, if you feel your issue is resolved and your happy then I will close this thread, if you would like me to take a peak I can do that to. Most times looking at logs like what  Malwarebytes and AdwCleaner removed can give a clue if we need to look further.


    Edited by ken545, 02 June 2015 - 08:23 PM.

    mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



    donate.gif Please consider a donation to help me keep up my fight against malware.

     

    Just a reminder that threads will be closed if no response in 3 days


    #9 ken545

    ken545

      Malware Response Team


    • Malware Response Team
    • 1,685 posts
    • OFFLINE
    •  
    • Gender:Male
    • Location:The Space Coast of Florida
    • Local time:10:22 PM

    Posted 05 June 2015 - 05:48 AM

    It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

    mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



    donate.gif Please consider a donation to help me keep up my fight against malware.

     

    Just a reminder that threads will be closed if no response in 3 days





    0 user(s) are reading this topic

    0 members, 0 guests, 0 anonymous users