X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Need help manually removing malware add-on: gophotoit from extenstions list.

Posted

I attempted to install a media player the other day and it was crap and I started to feel sketchy about it, so I uninstalled it completely from my computer. But when returning to firefox I noticed that three new extensions had been added. I disabled all three, but only one had the option to remove it. The other two are still in my add-ons manager. They are not enabled, so not causing a problem (I hope), but would like to remove them. (GoPhotoIt is the main one I've read about all over the internet). I tried to follow the manual uninstall instructions, but there is no file in the extensions folder that matches the IDkeys listed in the "troubleshooting information" panel. (The same extenstions were on Chrome, but that was very easy to trash all three in, for some reason FF isn't making it so easy). (Notice: no "remove" option: http://img.photobucket.com/albums/v55/xaraan/ScreenShot2013-02-24at102511AM_zps325da890.png)

Chosen solution

OK, NOW I GOT IT!

First you have to follow the manual removal instructions, but when you go to Library, don't just go to the Firefox folder and check and remove, but also the Mozilla folder (extensions folder in that) and remove the files. Then you can do the SQL removal I listed above and they seem to be gone now, even after restarting the browser a few times.

Read this answer in context 1

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.5 r502
  • Version 3.13.2.11592
  • Google Talk Plugin Video Accelerator version:0.1.44.23
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in web pages. For more information, visit the QuickTime Web site.
  • Displays Java applet content, or a placeholder if Java is not installed.
  • iPhoto6
  • The Flip4Mac WMV Plugin allows you to view Windows Media content using QuickTime.

Application

  • User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:19.0) Gecko/20100101 Firefox/19.0

More Information

Tyler Downer
  • Administrator
  • Moderator
1164 solutions 6629 answers

The Reset Firefox feature can fix many issues by restoring Firefox to its factory default state while saving your essential information. Note: This will cause you to lose any Extensions, Open websites, and some Preferences.

To Reset Firefox do the following:

  1. Go to Firefox > Help > Troubleshooting Information.
  2. Click the "Reset Firefox" button.
  3. Firefox will close and reset. After Firefox is done, it will show a window with the information that is imported. Click Finish.
  4. Firefox will open with all factory defaults applied.


Further information can be found in the Reset Firefox – easily fix most problems article.

Did this fix your problems? Please report back to us!

Question owner

that seemed to fix it Edit: no, it didn't work...

Modified by xaraan

Question owner

Actually, I was mistaken. It wiped out every extension/add-on except those two. So that didn't work either.

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

please run a full of your system with adwcleaner and see if it will pick up the malicious addon - otherwise try the manual removal methods described at Cannot uninstall an add-on

Question owner

The adwcleaner looks like a PC only program, (any specific mac program I should use?)

Already tried the manual removal methods initially before submitting help. Just retried them again since I had 'reset' firefox. No option to remove shows when starting in safe mode and when I use finder to look in 'extensions' for them, the folder contains only 7 extensions (the ones I'm using) and not nine (for the two that are disabled that I'm trying to get rid of).

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

sorry, i didn't check your OS first (don't know of any Mac specific removal tools though). the addon in question might also sit in the extensions subfolder of the firefox main installation folder - what is referred to as "globally installed extensions" in the support article (the extension folder you've already looked at was within your profile folder).

Question owner

Not sure what the main installation folder is. I tried "Show package contents" found an extensions folder and it didn't have any of the extensions in there.

I just completely uninstalled Firefox using an uninstaller to wipe everything. Did a search on my computer for anything firefox, gophoto or firstrowsports and got nothing after. Reinstalled FF from a new download and pow, those two extensions are sitting right there in extensions unactivated all alone.

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

for the installation folder see http://kb.mozillazine.org/Installation_directory#Mac_OS_X

Question owner

hmmm, well, according to that I did look in the right place with the 'show package contents' method and didn't see it. Well, I've removed it best i could, I don't see it showing on any search of my computer, so maybe it's just sitting on that list and won't hurt anything. Shame though. Thanks for trying to help.

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

can you get rid of the issue like described here by another user?: https://support.mozilla.org/en-US/questions/935485#answer-408017

Question owner

No. the jeremymaxwell user is having the exact same issue as me (didn't see that thread when I first searched for help). I've searched the hidden library folder/applications/firefox/extensions folder and it lists the same extensions as the extensions folder you can open in the previous directions. There is no sign of those two extensions on my computer outside of showing up on the extensions list in FF. A Shame they can't be deleted as easily as it was on chrome, but at least unactivated I don't "think" they are doing anything.

cor-el
  • Top 10 Contributor
  • Moderator
10738 solutions 96600 answers

Extensions that do not have a "Remove" button are installed by other software and are not under control of the Firefox extension manager.

Such globally installed extensions are usually found via a registry scan or are installed in a location that Firefox scans for installed extensions.

Extensions installed that way need to be removed via the settings (preferences) in the program that added the extension to Firefox.

Modified by cor-el

Question owner

Yea, that was the same thing I tried above already. It's not in the main extensions folder. But over the last few days as I've poked around I've found a listing for it in a file marked "extensions.sqlite", (should be sitting along side the extensions folder mentioned and an "extensions.ini" file. I'm just not sure how to get it out of there. If i find a solution I'll post it.

Question owner

I FOUND IT!

ok - I had to download an app called SQLite Manager, that let me open the extensions.sqlite file.

In the program there are three boxes at top (Design/Data/SQL) Click on Data. Under Tables if you select 'addon' and 'locale' you'll see it in both spots. Make sure FF is closed or it won't let you change anything. Say you do 'locale' first: Then select the row for the gophotoit and hit the "-" at the bottom to delete. Repeat for FirstHD and then repeat for both under 'addon'. Restart FF and they should be gone for good.

Question owner

Well, crap, scratch that. It removed it, but when I restarted firefox the next time, it added them back in there. This is pissing me off, for some malware this well known there should be a solution to it by now.

Chosen Solution

OK, NOW I GOT IT!

First you have to follow the manual removal instructions, but when you go to Library, don't just go to the Firefox folder and check and remove, but also the Mozilla folder (extensions folder in that) and remove the files. Then you can do the SQL removal I listed above and they seem to be gone now, even after restarting the browser a few times.