X
Tap here to go to the mobile version of the site.

Support Forum

How to I tell if I have a Legitimate copy of Firefox and how do I remove it if it's a bad one

Posted

OK guys, I found this saying my Firefox could be a piece of junk and that big brother has his noise up my butt again. I was looking at the article at was publish on CP Pro and from what I seeing I have a bad copy. How do I remove it and get a good copy of Firefox to replace it.

http://www.pcpro.co.uk/news/security/381538/mozilla-government-spyware-disguising-itself-as-firefox?utm_campaign=pcpro_newsletter&utm_medium=email&utm_source=newsletter

I going by the file size shown which is 724 kb, which is the size mine is showing.

How do I get a good copy of Firefox and how do I make sure I keep getting the right update for you, so they don't trick me again.

OK guys, I found this saying my Firefox could be a piece of junk and that big brother has his noise up my butt again. I was looking at the article at was publish on CP Pro and from what I seeing I have a bad copy. How do I remove it and get a good copy of Firefox to replace it. http://www.pcpro.co.uk/news/security/381538/mozilla-government-spyware-disguising-itself-as-firefox?utm_campaign=pcpro_newsletter&utm_medium=email&utm_source=newsletter I going by the file size shown which is 724 kb, which is the size mine is showing. How do I get a good copy of Firefox and how do I make sure I keep getting the right update for you, so they don't trick me again.

Additional System Details

Installed Plug-ins

  • Next Generation Java Plug-in 10.21.2 for Mozilla browsers
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Shockwave Flash 11.7 r700
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • RealPlayer Download Plugin
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In
  • RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In
  • RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In
  • RealDownloader Plugin
  • Google Update
  • Adobe PDF Plug-In For Firefox and Netscape 11.0.02
  • Foxit Reader Plug-In For Firefox and Netscape
  • ActiveTouch General Plugin Container Version 105
  • Office Live Update v1.5
  • NPWLPG
  • 1.9.0042.0
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Npdsplay dll
  • np-mswmp
  • Office Plugin for Netscape Navigator

Application

  • Firefox 20.0.1
  • User Agent: Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0
  • Support URL: http://support.mozilla.org/1/firefox/20.0.1/WINNT/en-US/

Extensions

  • CBSurge.com 1.5.5 (cbsurge@cbsurge.com)
  • ColorZilla 2.8.1 ({6AC85730-7D0F-4de0-B3FA-21142DD85326})
  • CoolPreviews 3.9 ({CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B})
  • Extension List Dumper 1.15.2 (extensionlistdumper@sogame.cat)
  • Firebug 1.11.2 (firebug@software.joehewitt.com)
  • FireFTP 2.0.13 ({a7c6cf7f-112c-4500-a7ea-39801a327e5f})
  • Gmail Checker 2.6.1 ({6BFD307A-C040-11DA-9749-FB1C850B47DF})
  • Java Console 6.0.38 ({CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA})
  • MeasureIt 0.4.10 ({75CEEE46-9B64-46f8-94BF-54012DE155F0})
  • Microsoft .NET Framework Assistant 0.0.0 ({20a82645-c095-46ed-80e3-08825760534b})
  • RankChecker 1.8.24 (rankchecker@seobook.com)
  • RealDownloader 1.3.1 ({DAC3F861-B30D-40dd-9166-F4E75327FAC7})
  • SearchPreview 6.2 ({EF522540-89F5-46b9-B6FE-1829E2B572C6})
  • SEO Doctor 1.6.2 (seodoctor@prelovac.com)
  • SEO For Firefox 3.6.8 (seo4firefox@seobook.com)
  • Seo Toolbar 1.2.3 (seotoolbar@seobook.com)
  • SeoQuake 2.8.9.1 ({317B5128-0B0B-49b2-B2DB-1E7560E16C74})
  • Spell Checker 1.3.2 (gaurangnshah@gmail.com)
  • TooManyTabs 1.4.1 (TooManyTabs@visibotech.com)
  • Troubleshooter 1.1a (troubleshooter@mozilla.org)
  • KnowtheBible 2.73.1.10955 (4lffxtbr@BibleTriviaTime_4l.com) (Inactive)
  • ScanQuery 1.0 ({DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}) (Inactive)
  • Wajam 1.26 ({5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}) (Inactive)

Javascript

  • incrementalGCEnabled: True

Graphics

  • adapterDescription: Intel(R) Q35 Express Chipset Family
  • adapterDescription2:
  • adapterDeviceID: 0x29b2
  • adapterDeviceID2:
  • adapterDrivers: igxprd32
  • adapterDrivers2:
  • adapterRAM: Unknown
  • adapterRAM2:
  • adapterVendorID: 0x8086
  • adapterVendorID2:
  • direct2DEnabled: False
  • direct2DEnabledMessage: [u'blockedDriver']
  • directWriteEnabled: False
  • directWriteVersion: 0.0.0.0
  • driverDate: 8-11-2008
  • driverDate2:
  • driverVersion: 6.14.10.4977
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'cairo', u'AzureFallbackCanvasBackend': u'none', u'AzureContentBackend': u'none'}
  • isGPU2Active: False
  • numAcceleratedWindows: 0
  • numAcceleratedWindowsMessage: [u'tryNewerDriver', u'6.1400.1000.5218']
  • numTotalWindows: 2
  • webglRendererMessage: [u'tryNewerDriver', u'6.1400.1000.5218']
  • windowLayerManagerType: Basic

Modified Preferences

  • accessibility.typeaheadfind.flashBar: 0
  • browser.cache.disk.capacity: 358400
  • browser.cache.disk.smart_size.first_run: False
  • browser.cache.disk.smart_size.use_old_max: False
  • browser.cache.disk.smart_size_cached_value: 358400
  • browser.places.smartBookmarksVersion: 4
  • browser.startup.homepage_override.buildID: 20130409194949
  • browser.startup.homepage_override.mstone: 20.0.1
  • browser.tabs.loadInBackground: False
  • browser.tabs.onTop: False
  • dom.mozApps.used: True
  • dom.w3c_touch_events.expose: False
  • extensions.lastAppVersion: 20.0.1
  • font.internaluseonly.changed: True
  • font.name.serif.x-western: Georgia
  • font.size.fixed.x-western: 14
  • network.cookie.prefsMigrated: True
  • places.database.lastMaintenance: 1367511554
  • places.history.expiration.transient_current_max_pages: 52986
  • plugin.disable_full_page_plugin_for_types: application/pdf
  • privacy.cpd.sessions: False
  • privacy.sanitize.migrateFx3Prefs: True
  • privacy.sanitize.timeSpan: 0

Misc

  • User JS: No
  • Accessibility: No
Tyler Downer
  • Top 25 Contributor
  • Moderator
1530 solutions 10669 answers

Helpful Reply

If you downloaded Firefox from mozilla.org, you got the real firefox. If you are unsure, uninstall it (don't remove your personal information though) and go to mozilla.org and re-download Firefox.

If you downloaded Firefox from mozilla.org, you got the real firefox. If you are unsure, uninstall it (don't remove your personal information though) and go to mozilla.org and re-download Firefox.
the-edmeister
  • Top 25 Contributor
  • Moderator
5398 solutions 40147 answers

That article was written very poorly. There are no bad copies of Firefox. That software masquerades as Mozilla Firefox in both file properties and in the file manifest, areas that usually aren't visible to the user.

If you want to feel better, download Firefox directly from Mozilla.
http://www.mozilla.org/en-US/firefox/fx/#desktop
Uninstall what is now installed and install the newly downloaded version.

Quite honestly though, if you do have that Gamma program you will need to do a lot more than re-install some software, that garbage messes with the MBR and bypasses all the software (including the Windows operating system) which is going mean a big fix.

IMO, if you aren't using a "right-to-left" language (Middle-east languages, like Hebrew or Arabic) you are probably safe. This exploit may only work with the RLO character. (right-to-left-override) Mentioned on page 9 of the PDF linked on this - https://citizenlab.org/2013/04/for-their-eyes-only-2/ - page.

My advice is to wait until next week until the sensationalism abates, and serious "fix" type articles start appearing.

That article was written very poorly. There are no '''''bad''''' copies of Firefox. That software masquerades as Mozilla Firefox in both file properties and in the file manifest, areas that usually aren't visible to the user. If you want to feel better, download Firefox directly from Mozilla. <br /> http://www.mozilla.org/en-US/firefox/fx/#desktop <br /> Uninstall what is now installed and install the newly downloaded version. Quite honestly though, if you do have that Gamma program you will need to do a lot more than re-install ''some software'', that garbage messes with the MBR and bypasses all the software ''(including the Windows operating system)'' which is going mean a big fix. IMO, if you aren't using a "right-to-left" language (Middle-east languages, like Hebrew or Arabic) you are probably safe. This exploit may only work with the RLO character. (''right-to-left-override)'' Mentioned on page 9 of the PDF linked on this - https://citizenlab.org/2013/04/for-their-eyes-only-2/ - page. My advice is to wait until next week until the sensationalism abates, and serious "fix" type articles start appearing.

Question owner

That where I got this copy but according to the size of the file it's a bad copy. I just reinstall this 30 days ago.

How do I tell if it's bad or good, it toke me about 6 days to reinstall and set this back up the way I have it.

If I have to reinstall I will, but if it's good I really don't want to spend the next 6 day fixing this, plus I belong to a group of Internet marketers that will all want to know the same thing as me.

How do I tell if it's good or bad for sure.

That where I got this copy but according to the size of the file it's a bad copy. I just reinstall this 30 days ago. How do I tell if it's bad or good, it toke me about 6 days to reinstall and set this back up the way I have it. If I have to reinstall I will, but if it's good I really don't want to spend the next 6 day fixing this, plus I belong to a group of Internet marketers that will all want to know the same thing as me. How do I tell if it's good or bad for sure.

Modified by dminor

the-edmeister
  • Top 25 Contributor
  • Moderator
5398 solutions 40147 answers

Are you referring to the "file size" in this image ?
http://www.pcpro.co.uk/gallery/news/381538/mozilla-government-spyware-disguising-itself-as-firefox/194071

If so, the file size won't match - you are using Firefox 20.0 and that image is from Firefox 14.0.1!

Are you referring to the "file size" in this image ? <br /> http://www.pcpro.co.uk/gallery/news/381538/mozilla-government-spyware-disguising-itself-as-firefox/194071 If so, the file size won't match - you are using Firefox 20.0 and that image is from Firefox 14.0.1!

Question owner

Right, that's why I am asking. I have 20.0.1 running right now. So I really don't know if mine is good or bad. What should the file size be for it, I found nothing stating the correct file size for 20.0.1.

I know this version is a little liter than the early version was anyway after improvements.

After you give me this information I can post this in the Skype Chat room with over a 1000 members which could save you a lot more questions

Right, that's why I am asking. I have 20.0.1 running right now. So I really don't know if mine is good or bad. What should the file size be for it, I found nothing stating the correct file size for 20.0.1. I know this version is a little liter than the early version was anyway after improvements. After you give me this information I can post this in the Skype Chat room with over a 1000 members which could save you a lot more questions

Modified by dminor

Question owner

Doe s anyone have an answer as to how you can make sure that you latest copy of FireFox is Good. could someone tell me the correct file size for 20.0.1

Doe s anyone have an answer as to how you can make sure that you latest copy of FireFox is Good. could someone tell me the correct file size for 20.0.1
philipp
  • Top 25 Contributor
  • Moderator
5306 solutions 23424 answers

those media reports are slightly exaggerated and misleading sometimes.

nothing what is known about the distribution of the finfisher spyware suggests that people where infected by intentionally downloading something that they believed to be the firefox program or updates to the program (only once people have the malware on the computer it will have similar filenames/describtions as the legitimate firefox browser in order to trick users and firewalls/security software etc).

so in short: in case you have downloaded & installed firefox intentionally (always use the official source at getfirefox.com) and when a browser window opens once you launch firefox, you're not affected by the threat that was reported.

those media reports are slightly exaggerated and misleading sometimes. nothing what is known about the distribution of the finfisher spyware suggests that people where infected by intentionally downloading something that they believed to be the firefox program or updates to the program (only once people have the malware on the computer it will have similar filenames/describtions as the legitimate firefox browser in order to trick users and firewalls/security software etc). so in short: in case you have downloaded & installed firefox intentionally (always use the official source at getfirefox.com) and when a browser window opens once you launch firefox, you're not affected by the threat that was reported.