![Firefox logo](https://assets-prod.sumo.prod.webservices.mozgcp.net/media/uploads/products/2020-04-14-08-36-13-8dda6f.png)
Is Firefox or / and Windows hijacked ?
Scam sites tabs appear sometimes on two of my computers. Both are running Windows 10 1903 all updates applied with Firefox 69.0. I have other browsers and Linux sessions but I've never experienced such malware in these cases. Moreover, I have scanned my computer with McAfee Virus Scan (I bought this software), up to date, it says "no problem reported". Maybe I must document a new security exploit ?
Thanks for your help !
Alla svar (4)
Hi zepp.fr, in some cases, these sites load through ad networks on popular sites. In other cases, they might be triggered by an add-on, or by an external program that launches pages in your default browser.
For the first issue, a reputable content blocker like uBlock Origin could help:
https://addons.mozilla.org/firefox/addon/ublock-origin/
For the second issue, you can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:
- Ctrl+Shift+a (Mac: Command+Shift+a)
- "3-bar" menu button (or Tools menu) > Add-ons
- type or paste about:addons in the address bar and press Enter/Return
In the left column of the Add-ons page, click Extensions.
Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove). Be a little bit ruthless here, especially if it's an extension you can live without for the rest of the day.
Any improvement?
For the third issue, you could try changing your default browser at the Windows 10 level to Edge to see whether the unwanted pages start popping up there instead of Firefox.
Point 1 : I haven't understood everything as I'm not a native English speaker but I think it isn't normal tabs pop up while I'm NOT clicking anywhere ?
Point 2 : I have installed two plugins, one is Nielsen netsight (as I am member of a netpanel), the other is Wappalyzer. I think none of them are at risk, but maybe I'm wrong.
Point 3 : Yes Firefox is my default browser on both computers.
I must add that on one of my computers, Firefox has been already updated to version 69.0.1 when the incident occured, if it's useful...
Point 1 : I haven't understood everything as I'm not a native English speaker but I think it isn't normal tabs pop up while I'm NOT clicking anywhere ?
I agree, the popup blocker should block new tabs that aren't initiated by a user action. Please make sure the popup blocker is not disabled: Pop-up blocker settings, exceptions and troubleshooting.
Point 2 : I have installed two plugins, one is Nielsen netsight (as I am member of a netpanel), the other is Wappalyzer. I think none of them are at risk, but maybe I'm wrong.
I don't think Nielsen would want to provide any reason to uninstall its extension. Wappalyzer looks really interesting.
Point 3 : Yes Firefox is my default browser on both computers.
So possibly the links are loaded externally. That is difficult to determine. One possible way to differentiate between external and internal links is to set external links to always open in a separate window. If you want to try it:
(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful or accepting the risk.
(2) In the search box above the list, type or paste neww and pause while the list is filtered
(3) Double-click the browser.link.open_newwindow.override.external preference to display a small dialog, change the value to 2 and then click OK
For reference, these are the values Firefox recognizes for this preference:
- -1 = follow the setting for internal links (default)
- 3 = open external links in a new tab in the last active window
- 2 = open external links in a new window
- 1 = open external links in the last active tab replacing the current page
These tabs only rarely appear, so it is difficult to know.
Thank you very much for your support indeed, @jscher2000. :-)