X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Hijacked network settings (proxy)

Posted

I am running windows 7, and using Firefox 4.0b7.

Somehow I got a hold of the "backdoor:win32/cycbot.b". I ran "Dr.Web CureIt!" and then "MalwareBytes". It was found and removed, but now, whenever I open Firefox, the connection setting defaults to using http proxy of 127.0.0.1, with a port setting of 55030.

I have to go in, delete the proxy and reset every time I launch Firefox. IE, once backdoor was removed, is opening just fine and retains its settings.

I also noticed in the file named prefs.js, the following lines appear and can not be removed. When I do remove them, they reappear as soon as I launch FF.

user_pref("network.http.max-persistent-connections-per-server", 4); user_pref("network.proxy.http", "127.0.0.1"); user_pref("network.proxy.http_port", 55030); user_pref("network.proxy.type", 1);

Modified by rpdenney

Chosen solution

See if that happens with a new Profile - just test it, don't add anything to the new Profile.
http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows

Read this answer in context 3

Additional System Details

This happened

Every time Firefox opened

This started when...

12/10/10

Installed Plug-ins

Extensions: Adblock; F.B. Purity 3.9; Feedback 1.0.3; FoxTab 1.4.1; Ghostery 2.4.2; Google Toolbar for Firefox 7.1.20101113Wb1

Plugins: 2007 MS Office System 12.0.4518.1014; Adobe Acrobat 9.4.1.222; iTunes Application Detector 1.0.1.1; Java Deployment Toolkit 6.0.220.4; Java Platform SE 6 U22 6.0.220.4; MS Windows Media Player Firefox plugin 1.0.0.8; QuickTime Plug-in 7.6.9

Application

  • User Agent:

More Information

Application Basics
Name
Firefox
Version
4.0b7
User Agent
Mozilla/5.0 (Windows NT 6.1; rv:2.0b7) Gecko/20100101 Firefox/4.0b7
Profile Directory
Open Containing Folder
Enabled Plugins
about:plugins
Build Configuration
about:buildconfig
Extensions
Name
Version
Enabled
ID
Google Toolbar for Firefox
7.1.20101113Wb1
true
{3112ca9c-de6d-4884-a869-9855de68056c}
Feedback
1.0.3
true
testpilot@labs.mozilla.com
Java Console
6.0.17
true
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Java Console
6.0.19
true
{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
Java Console
6.0.20
true
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Java Console
6.0.21
true
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
Java Console
6.0.22
true
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
RealPlayer Browser Record Plugin
1.1.5
false
{ABDE892B-13A8-4d1b-88E6-365A6E755758}
F.B. Purity
3.9.5
true
fbp@fbpurity.com
Ghostery
2.4.2
true
firefox@ghostery.com
FoxTab
1.4.1
true
{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
Adblock Plus
1.3.2
true
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
Modified Preferences
Name
Value
accessibility.typeaheadfind.flashBar
0
browser.fixup.alternate.enabled
false
browser.history_expire_days.mirror
180
browser.places.importBookmarksHTML
false
browser.places.smartBookmarksVersion
2
browser.startup.homepage
http://www.google.com/ig?hl=en&source=iglk
browser.startup.homepage_override.buildID
20101104131838
browser.startup.homepage_override.mstone
rv:2.0b7
browser.tabs.warnOnClose
false
dom.max_script_run_time
1800
extensions.lastAppVersion
4.0b7
keyword.URL
http://www.google.com/search?sourceid=navclient&hl=en&q=
network.cookie.prefsMigrated
true
network.http.max-persistent-connections-per-server
4
places.history.expiration.transient_current_max_pages
64113
places.last_vacuum
1289831510
print.print_printer
Dell Laser Printer 1720 XL
print.printer_Dell_Laser_Printer_1720_XL.print_bgcolor
false
print.printer_Dell_Laser_Printer_1720_XL.print_bgimages
false
print.printer_Dell_Laser_Printer_1720_XL.print_command
print.printer_Dell_Laser_Printer_1720_XL.print_downloadfonts
false
print.printer_Dell_Laser_Printer_1720_XL.print_edge_bottom
0
print.printer_Dell_Laser_Printer_1720_XL.print_edge_left
0
print.printer_Dell_Laser_Printer_1720_XL.print_edge_right
0
print.printer_Dell_Laser_Printer_1720_XL.print_edge_top
0
print.printer_Dell_Laser_Printer_1720_XL.print_evenpages
true
print.printer_Dell_Laser_Printer_1720_XL.print_footercenter
print.printer_Dell_Laser_Printer_1720_XL.print_footerleft
&PT
print.printer_Dell_Laser_Printer_1720_XL.print_footerright
&D
print.printer_Dell_Laser_Printer_1720_XL.print_headercenter
print.printer_Dell_Laser_Printer_1720_XL.print_headerleft
print.printer_Dell_Laser_Printer_1720_XL.print_headerright
print.printer_Dell_Laser_Printer_1720_XL.print_in_color
true
print.printer_Dell_Laser_Printer_1720_XL.print_margin_bottom
0.5
print.printer_Dell_Laser_Printer_1720_XL.print_margin_left
0.5
print.printer_Dell_Laser_Printer_1720_XL.print_margin_right
0.5
print.printer_Dell_Laser_Printer_1720_XL.print_margin_top
0.5
print.printer_Dell_Laser_Printer_1720_XL.print_oddpages
true
print.printer_Dell_Laser_Printer_1720_XL.print_orientation
0
print.printer_Dell_Laser_Printer_1720_XL.print_pagedelay
500
print.printer_Dell_Laser_Printer_1720_XL.print_paper_data
1
print.printer_Dell_Laser_Printer_1720_XL.print_paper_height
11.00
print.printer_Dell_Laser_Printer_1720_XL.print_paper_size_type
0
print.printer_Dell_Laser_Printer_1720_XL.print_paper_size_unit
0
print.printer_Dell_Laser_Printer_1720_XL.print_paper_width
8.50
print.printer_Dell_Laser_Printer_1720_XL.print_reversed
false
print.printer_Dell_Laser_Printer_1720_XL.print_scaling
1.25
print.printer_Dell_Laser_Printer_1720_XL.print_shrink_to_fit
true
print.printer_Dell_Laser_Printer_1720_XL.print_to_file
false
print.printer_Dell_Laser_Printer_1720_XL.print_unwriteable_margin_bottom
0
print.printer_Dell_Laser_Printer_1720_XL.print_unwriteable_margin_left
0
print.printer_Dell_Laser_Printer_1720_XL.print_unwriteable_margin_right
0
print.printer_Dell_Laser_Printer_1720_XL.print_unwriteable_margin_top
0
print.printer_Microsoft_XPS_Document_Writer.print_bgcolor
false
print.printer_Microsoft_XPS_Document_Writer.print_bgimages
false
print.printer_Microsoft_XPS_Document_Writer.print_command
print.printer_Microsoft_XPS_Document_Writer.print_downloadfonts
false
print.printer_Microsoft_XPS_Document_Writer.print_edge_bottom
0
print.printer_Microsoft_XPS_Document_Writer.print_edge_left
0
print.printer_Microsoft_XPS_Document_Writer.print_edge_right
0
print.printer_Microsoft_XPS_Document_Writer.print_edge_top
0
print.printer_Microsoft_XPS_Document_Writer.print_evenpages
true
print.printer_Microsoft_XPS_Document_Writer.print_footercenter
print.printer_Microsoft_XPS_Document_Writer.print_footerleft
&PT
print.printer_Microsoft_XPS_Document_Writer.print_footerright
&D
print.printer_Microsoft_XPS_Document_Writer.print_headercenter
print.printer_Microsoft_XPS_Document_Writer.print_headerleft
print.printer_Microsoft_XPS_Document_Writer.print_headerright
print.printer_Microsoft_XPS_Document_Writer.print_in_color
true
print.printer_Microsoft_XPS_Document_Writer.print_margin_bottom
0.5
print.printer_Microsoft_XPS_Document_Writer.print_margin_left
0.5
print.printer_Microsoft_XPS_Document_Writer.print_margin_right
0.5
print.printer_Microsoft_XPS_Document_Writer.print_margin_top
0.5
print.printer_Microsoft_XPS_Document_Writer.print_oddpages
true
print.printer_Microsoft_XPS_Document_Writer.print_orientation
0
print.printer_Microsoft_XPS_Document_Writer.print_pagedelay
500
print.printer_Microsoft_XPS_Document_Writer.print_paper_data
1
print.printer_Microsoft_XPS_Document_Writer.print_paper_height
11.00
print.printer_Microsoft_XPS_Document_Writer.print_paper_size_type
1
print.printer_Microsoft_XPS_Document_Writer.print_paper_size_unit
0
print.printer_Microsoft_XPS_Document_Writer.print_paper_width
8.50
print.printer_Microsoft_XPS_Document_Writer.print_reversed
false
print.printer_Microsoft_XPS_Document_Writer.print_scaling
1.00
print.printer_Microsoft_XPS_Document_Writer.print_shrink_to_fit
false
print.printer_Microsoft_XPS_Document_Writer.print_to_file
false
print.printer_Microsoft_XPS_Document_Writer.print_unwriteable_margin_bottom
0
print.printer_Microsoft_XPS_Document_Writer.print_unwriteable_margin_left
0
print.printer_Microsoft_XPS_Document_Writer.print_unwriteable_margin_right
0
print.printer_Microsoft_XPS_Document_Writer.print_unwriteable_margin_top
0
print.printer_\\HOME\Lexmark.print_bgcolor
false
print.printer_\\HOME\Lexmark.print_bgimages
false
print.printer_\\HOME\Lexmark.print_command
print.printer_\\HOME\Lexmark.print_downloadfonts
false
print.printer_\\HOME\Lexmark.print_edge_bottom
0
print.printer_\\HOME\Lexmark.print_edge_left
0
print.printer_\\HOME\Lexmark.print_edge_right
0
print.printer_\\HOME\Lexmark.print_edge_top
0
print.printer_\\HOME\Lexmark.print_evenpages
true
print.printer_\\HOME\Lexmark.print_footercenter
print.printer_\\HOME\Lexmark.print_footerleft
&PT
print.printer_\\HOME\Lexmark.print_footerright
&D
print.printer_\\HOME\Lexmark.print_headercenter
print.printer_\\HOME\Lexmark.print_headerleft
print.printer_\\HOME\Lexmark.print_headerright
print.printer_\\HOME\Lexmark.print_in_color
true
print.printer_\\HOME\Lexmark.print_margin_bottom
0.5
print.printer_\\HOME\Lexmark.print_margin_left
0.5
print.printer_\\HOME\Lexmark.print_margin_right
0.5
print.printer_\\HOME\Lexmark.print_margin_top
0.5
print.printer_\\HOME\Lexmark.print_oddpages
true
print.printer_\\HOME\Lexmark.print_orientation
0
print.printer_\\HOME\Lexmark.print_pagedelay
500
print.printer_\\HOME\Lexmark.print_paper_data
1
print.printer_\\HOME\Lexmark.print_paper_height
11.00
print.printer_\\HOME\Lexmark.print_paper_size_type
0
print.printer_\\HOME\Lexmark.print_paper_size_unit
0
print.printer_\\HOME\Lexmark.print_paper_width
8.50
print.printer_\\HOME\Lexmark.print_reversed
false
print.printer_\\HOME\Lexmark.print_scaling
1.00
print.printer_\\HOME\Lexmark.print_shrink_to_fit
false
print.printer_\\HOME\Lexmark.print_to_file
false
print.printer_\\HOME\Lexmark.print_unwriteable_margin_bottom
0
print.printer_\\HOME\Lexmark.print_unwriteable_margin_left
0
print.printer_\\HOME\Lexmark.print_unwriteable_margin_right
0
print.printer_\\HOME\Lexmark.print_unwriteable_margin_top
0
privacy.popups.showBrowserMessage
false
privacy.sanitize.migrateFx3Prefs
true
privacy.sanitize.timeSpan
4
security.warn_viewing_mixed
false
Graphics
Adapter Description
Mobile Intel(R) 945 Express Chipset Family
Vendor ID
8086
Device ID
27a2
Adapter RAM
Unknown
Adapter Drivers
igdumd32
Driver Version
8.15.10.1930
Driver Date
9-23-2009
Direct2D Enabled
false
DirectWrite Enabled
false
GPU Accelerated Windows
0/1

the-edmeister
  • Top 10 Contributor
  • Moderator
3202 solutions 24452 answers

Helpful Reply

See if you have a user.js file in your Profile folder and if those prefs are there.

If so, delete those prefs from there.

Question owner

I do have a user.js file, but the contents are:

user_pref("network.http.max-persistent-connections-per-server", 4); user_pref("nglayout.initialpaint.delay", 600);

Also in the internet settings, each time FF is launched, defaults to: "Manual Proxy Configuration" HTTP Proxy: 127.0.0.1 Port: 55030

the-edmeister
  • Top 10 Contributor
  • Moderator
3202 solutions 24452 answers

Chosen Solution

See if that happens with a new Profile - just test it, don't add anything to the new Profile.
http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows

Question owner

PERFECT!!!! Thanks, this worked. Now, if I can only figure out "why" it acted like that in the first place.

betabeta1 0 solutions 2 answers

. . . I looked for files modified at the time I thought a similar Malware acted on my PC.



Found 3 lines added to the:




C:/users/xxxxxmyprofile/appdata/roaming/mozilla/firefox/profiles/xxxxx.default/extensionsfoxmarks@kei.com/default/preferences/prefs.js



I removed them, and I saved the prefs.js file again. They were like: user_pref("network.proxy.http", "127.0.0.1"); user_pref("network.proxy.http_port", 58505); user_pref("network.proxy.type", 1); More or less.




My suggestions: Check all *.js files in firefox/ subfolders, plugins included (in my case, as you can see, it was in foxmarks subfolder).



Took me a while, finally solved.

Modified by betabeta1