Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

socopoco search engine hijack on Firefox linux

dreidpath
dreidpath
more options

I have inadvertently installed the socopoco search engine malware. If I remove it, it reappears. There is information on the web about how to remove it on Windows machines, but I can't find anything for Linux. It has also infected all my machines, and I am wondering if it is now attached to synch. Any ideas about how to remove it from a linux machine?

I have inadvertently installed the socopoco search engine malware. If I remove it, it reappears. There is information on the web about how to remove it on Windows machines, but I can't find anything for Linux. It has also infected all my machines, and I am wondering if it is now attached to synch. Any ideas about how to remove it from a linux machine?

Chosen solution

This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.

Read this answer in context 👍 0

All Replies (4)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Do you have this add-on which takes over the new tab:

https://addons.mozilla.org/firefox/addon/socopoco/

You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

  • Ctrl+Shift+a (Mac: Command+Shift+a)
  • "3-bar" menu button (or Tools menu) > Add-ons
  • type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions.

Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).

You might also need to reset your default search engine on the Preferences page: Change your default search settings in Firefox

Success?

dreidpath
dreidpath Question owner
more options

No. Unfortunately (??) I never installed the add-on and it doesn't appear there. It appears in the "One-Click Search Engines", and removing it doesn't work.

dreidpath
dreidpath Question owner
more options

Chosen Solution

This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

dreidpath said

No. Unfortunately (??) I never installed the add-on and it doesn't appear there.

Do you have any unknown extensions?

It appears in the "One-Click Search Engines", and removing it doesn't work.

When does it come back? For example, when you Quit Firefox and start it up again (next session), or when you shut down and restart your system, or at some other interval?

Could you check for a possible alien script in the Firefox program directory. I'm not quite sure where you'll find it on Linux, but it's the folder the the Firefox application starts from. Look for either of these folders:

  • firefox/defaults/pref
  • firefox/browser/defaults/pref

It's normal to find a file named channel-prefs.js with a few comment lines at the top and then a command like this: 

pref("app.update.channel", "release");

If you find any other files at all, that would be suspicious. Remove them to some other location for analysis, or delete them.