
Possible infection on Firefox
Every time I access the web I get a report from Norton saying "Threat secured". It attaches every single website that I open. See attachment for some exmaples (only variabole part of message shown apart from first one).This is occuring 50+ times a day but does not occur using Edge, so it appears to be related to Firefox. PLEASE help. Norton have not helped with this. Thank you- Colin O'Brien
Wubrane rozwězanje
Yes! As soon as saw this extension (whose name occurs in every event) I disabled it. My system is now Ok. THANK YOU..
Toś to wótegrono w konteksće cytaś 👍 1Wšykne wótegrona (16)
Hi,
Do you recognize the website mentioned in the reports? Are you trying to open it?
Thank you Denys, Sorry not to reply earlier, I went out for the rest of the day after posting my query. I do not know the website and have never tried to open it. I would never open a website that I did not know, and certainly not a .io. It's odd that I do not get this problem with Edge. I have had it since March; have removed Norton and reloaded it without any effect. Colin
colin_obrien said
Thank you Denys, Sorry not to reply earlier, I went out for the rest of the day after posting my query. I do not know the website and have never tried to open it. I would never open a website that I did not know, and certainly not a .io. It's odd that I do not get this problem with Edge. I have had it since March; have removed Norton and reloaded it without any effect. Colin
Oh, I see. To make sure it's not an extension causing this, could you please try running Firefox in Troubleshoot Mode? Does the problem persist?
I'm afraid the problem remains exactly as before- the Norton pop up appears about 2 seconds after I have entered a URL. (Every URL seems to cause it).
I have just tried it again in troubleshoot mode and on this occasion the pop up has not appeared. Maybe I wasn't applying the mode correctly.
If the problem doesn't occur in Troubleshoot Mode, then the most likely cause is an extension. Please follow these instructions to make sure of this and determine the exact extension causing the issue.
Wubrane rozwězanje
Yes! As soon as saw this extension (whose name occurs in every event) I disabled it. My system is now Ok. THANK YOU..
However, that doesn't explain how it got onto my computer in the first place, and whether it might still be there.
If you don't recognize this extension, just remove it!
- Click the menu button
, click "Extensions and themes" and select Extensions.
- The Add-ons Manager Manage Your Extensions page will open in a new tab. Scroll through the list of extensions.
- Click the ellipsis
(3-dot) icon for the extension you wish to remove and select Remove.
If the Remove option is available and the extension is not installed automatically after restarting Firefox, the chance of a third-party intervention is low (and you are safe!)
colin_obrien said
However, that doesn't explain how it got onto my computer in the first place, and whether it might still be there.
It looks like it may be available on the Mozilla Add-ons site (https://addons.mozilla.org/firefox/addon/syrup/). If you check your History in the Library window (Ctrl+Shift+H) and search for syrup in the tiny search box at the upper right, can you find any references to the Add-ons site? The Library only lists the latest visit, so please search before revisiting.
And if there's no record of that, could you check the Enterprise Policies list: type or paste about:policies in the address bar and press Enter to load it.
Normally the "Active" list says "The Enterprise Policies service is inactive." Does yours list any active policies, especially related to extensions or extension settings?
Assuming it's not force-installed
Thank you very much for the extra input. I could not find "syrup", which is not surprising as it has been on my computer since March and the listing only goes back one month. Regarding about:policies, under Active it says Documentation. i attach a screen shot. Clicking on Documentation creates a very long list of policies- screenshots of the first few attached, plus the Extensions policies. I had not ideas this was all going on- you have opened a new world for me.
Thank you- I have removed it, and made a report. What a relief to have this removed- I don't recall adding it to my extensions, but it was a long time ago and I might have done.
The extension did not reappear on restarting Firefox.
colin_obrien said
The extension did not reappear on restarting Firefox.
Great! I've chosen another your reply as a solution to make it more clear what extension was the cause.
Regarding the policies, jscher2000 knows much more about them, so let's wait for his reply :)
colin_obrien said
Regarding about:policies, under Active it says Documentation. i attach a screen shot. Clicking on Documentation creates a very long list of policies- screenshots of the first few attached, plus the Extensions policies. I had not ideas this was all going on- you have opened a new world for me.
The "Documentation" list is just for information; we all have the same list. Your "Active" list has the "ImportEnterpriseRoots" policy set to true. What that does is direct Firefox to trust certificates in the system certificate store (the one used by Microsoft Edge) rather than limiting itself to Firefox's own certificate store. Typically, this policy is inserted by security software that intercepts and filters your browsing. Since there's nothing on the Active panel about Extensions or ExtensionSettings, then you can rule this out as the source of the Syrup extension.
Thank you very much for the explanation. It has all been very helpful. Best Regards Colin O'Brien