Stop firefox opening multiple update tabs automatically
Hi there I'm having trouble with firefox opening up auto update tabs by itself. When you are on any site after about 5 seconds a new tab opens requesting you to auto update my video player. Then 5 seconds later another tab opens saying the same thing. and again. and again and so on perpetually. If left unattended for two minutes 85+ tabs will have opened. I am running firefox 30 on windows 7. I have found a temporary fix is to reset firefox. This works for a few days and then the update will occur 5-10 times in a session and then stop. Then a few days later it reaches critical mass and hijacks firefox, tab after tab after tab.
I would like to have gotten a screen shot but the reset lost the tabs. I don't think the problem will have shown in the troubleshooting diagnostic (mainly due to the reset). I have gone through my history and have managed to get the common URLs of the tabs.
An occasional one Install in a Flash http://lp.sharelive.net/?sysid=406&appid=1154&lpid=2883&subid=0081487796556604012
An occasional one (that I don't have a URL for) is your firefox video player may be out of date please check to see the latest version. I click on the apply and install button and it links me to Video Player Recommended http://www.lpmxp2016.com/6E29324C312E33517057256558763C2FA181039CFE41D8B572BE703BC40F1AFB45E301310E1D0C1782598A403ED704FC?tgu_src_lp_domain=www.ultimateplayersetup.com&CID=274930&ClickID=07_12005543_aa8381ee-014e-4747-8386-21904dcce45b&AffliateReferenceID=OTF8MzIwOXxBVXwyfDF8fA
Another occasional one Install in a Flash http://lp.sharelive.net/?sysid=406&appid=1154&lpid=2883&subid=0081487796556604012
Another occasional one Offer http://clkmon.com/static/lprdr.html?r=http%3A%2F%2Flp.sharelive.net%2F%3Fsysid%3D406%26appid%3D1154%26lpid%3D2883%26subid%3D0081487796556604012
One of the more prolific Download VLC Player http://www.onefloorserve.com/VLC/lp1.aspx?appId=335717&source=saymedia_1fa&cid=273021&clickid=07_11728158_b4d3e85d-4125-48da-b75c-7c0dc50e5af8
One of the more prolific 1Player http://www.onefloorserve.com/lps/player_lp7.aspx?appId=339032&source=saymedia_1fa&cid=277984&clickid=07_11728149_d772e93e-ffda-4d8a-8d4e-16dd2b91f4dc
One of the more prolific Video Player Recommended http://www.lpmxp2017.com/3D47345752317B4C21753046437649629852665CDE1580523D7CF3B5A0C54C81B5742D4921BEEE755BD11A6BCC59CDE0?tgu_src_lp_domain=www.ultimateplayersetup.com&CID=274930&ClickID=07_11728221_307d54a4-a760-4345-a66c-b324eed6e5f0&AffliateReferenceID=OTF8MzQ0OXxBVXwyfDF8fA
One of the more prolific Please Update to the Latest Version http://www.lpmxp2017.com/2378404779436B40657C70674D262053FC84823728C5E60FC131B6089B40884DEE657F2A41E779910CB63298C57A3116?tgu_src_lp_domain=www.ultimateplayersetup.com&CID=274546&ClickID=07_11790200_65a8241e-09cd-43a3-b451-2b21533c1292&AffliateReferenceID=OTN8NDMyNnxBVXwyfDF8fA
A common variant 1Player http://www.onefloorserve.com/lps/player_lp8.aspx?appId=339033&source=saymedia_1fa&cid=277992&clickid=07_11800247_6eb3dc39-4717-412b-8138-45204c0ad363
Another one Please Update to the Latest Version http://www.lpmxp2016.com/5870494A472D7C6636547E5F5A337B6B5BB218B9DB583B83A898A86EEF2E49732FE672124E77A0568DCF43D9F0DAF327?tgu_src_lp_domain=www.ultimateplayersetup.com&CID=274931&ClickID=07_11976377_fea87410-eb92-4004-a5fb-d58db3f6fbb3&AffliateReferenceID=OTF8MzE4MXxBVXwyfDF8fA
During all this going on is a program file download/install box is appearing asking if I want to save the file. Its 1.2 meg entitled player_setup.exe from download source http://kyle.mxp2203.com/I2ETeZ9CRw3yY0pXQgCz3Ks7vFKYiPYoWpVJ7FDEM_LNTKNN4VpnFBNK408G1M9qRBUoGCRE1XTI-LPLDH-vsA-jFn3DLSvbup3AAcZaR3XjA8bbIoFhtsDY4dpBIl6j
I thought if I downloaded the file and ran it then the messages would disappear. The file was a media player file associated with multiple advertising addons that would be installed if you did a typical install. I did a custom install and only installed the player. This did not stop the problem. The tab thing remained. I have uninstalled the program. The problem existed a few weeks before I did this so installing was not a trigger for further attacks.
I have discovered that resetting firefox also breaks a few links. I have to re-allow popups and re-enable my java plugins. I am enrolled in a tafe course and it also runs a diagnostic. This is what it checks.
Skillsoft Browser Capabilities Check.
Your browser results have been saved to our server and can be accessed for the next 30 days using this URL.
http://browser.skillport.com/bh/results.asp?resultsid=%7BCA2FAAE1%2D1E93%2D4B5B%2D81EA%2DB7D02252DB2B%7D
User Details.
Your e-mail damo74@iinet.net.au IP Address 124.171.39.176 Approximate Connection Speed 895 kbps Date and Time of Test 02 Jul 2014 00:46:41 Proxy Via
Combined Technical Specifications (20140520) This test checks compatibility for a combined specification of SkillSoft Course Player, Simulation Player and SkillPort
Test Operating System Result Pass Your Computer Microsoft Windows 7
Test Browser Type Result Pass Your Computer Firefox
Test Browser Version Result Pass Your Computer 30.0
Test Adobe Flash Result Pass Your Computer 13.0 r0
Test Java Environment Result Pass Your Computer Oracle Corporation
Version 7.0 Update 60 (1.7.0_60)
Test PopUp Blocker Result Pass Your Computer No PopUp Blocker Detected.
I have checked my plugins and have received the following text
Plugin Status
Step 1: Click Update to update a plugin. Step 2: Complete all recommended updates before restarting your browser.
Potentially vulnerable plugins Plugin Status Action Shockwave for DirectorAdobe Shockwave for Director Netscape plug-in, version 11.6.3.633 vulnerable 11.6.3.633 Update Now Shockwave FlashShockwave Flash 13.0 r0 vulnerable 13.0.0.214 Update Now Unknown Plugins Plugin Status Action Microsoft Office 2010The plug-in allows you to open and edit files using Microsoft Office applications unknown 14.0.4761.1000 Research Windows Live Photo GalleryNPWLPG unknown 15.4.3538.513 Research PicasaPicasa plugin unknown 3.0.0.0 Research globalUpdate UpdateglobalUpdate Update unknown 1.3.25.0 Research These plugins are up to date Plugin Status Action Adobe AcrobatAdobe PDF Plug-In For Firefox and Netscape 10.1.9 Up to Date 10.1.9.22 Up to Date Silverlight Plug-In5.1.30214.0 Up to Date 5.1.30214.0 Up to Date Java Deployment Toolkit 7.0.600.19NPRuntime Script Plug-in Library for Java(TM) Deploy Up to Date 10.60.2.19 Up to Date Java(TM) Platform SE 7 U60Next Generation Java Plug-in 10.60.2 for Mozilla browsers Up to Date 10.60.2.19 Up to Date
On top of the plugin assessment was a warning from firefox. "Firefox has prevented the unsafe plugin "java deployment toolkit" from running on www.mozilla.org continue blocking / allow. I chose to continue blocking.
I had a bit more of a look at my plugins through the add-on manager. Java deployment toolkit 7 was installed. And came up with a warning message that Java deployment toolkit 7 was vulnerable. On checking for more information I get diverted to
Add-ons for Firefox Blocklist Java Deployment Toolkit (click-to-play)
Java Deployment Toolkit (click-to-play) has been blocked for your protection.
I have since disabled the plugin.
Can you shed any light on what is going on or have I stumbled across the solution by disabling the toolkit. Hopefully we can address the issue before it gets hijacked again.
Please help cos I get really frustrated when it gets hijacked and I have to reset.
Được chỉnh sửa bởi cor-el vào
Tất cả các câu trả lời (4)
Kindly check the addons in your firefox
Tools > Addons
Remove or Disable all unwanted / suspicious ones. Then try to browse again. See if the problem comes again.
If you get a pop-up message asking to update Firefox or plugins then such a message is likely a scam and you should never respond to such an alert to avoid getting infected with malware.
- Only update Firefox via "Help > About" or by downloading and installing Firefox from the Mozilla server and never via a pop-up or link on a web page.
- Plugins should only be updated via the plugin itself or by visiting the home page of the plugin.
Do a malware check with several malware scanning programs on the Windows computer. Please scan with all programs because each program detects different malware. All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
- Malwarebytes' Anti-Malware:
http://www.malwarebytes.org/mbam.php - AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml - SuperAntispyware:
http://www.superantispyware.com/ - Microsoft Safety Scanner:
http://www.microsoft.com/security/scanner/en-us/default.aspx - Windows Defender:
http://windows.microsoft.com/en-us/windows/using-defender - Spybot Search & Destroy:
http://www.safer-networking.org/en/index.html - Kasperky Free Security Scan:
http://www.kaspersky.com/security-scan
You can also do a check for a rootkit infection with TDSSKiller.
- Anti-rootkit utility TDSSKiller:
http://support.kaspersky.com/5350?el=88446
See also:
- "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked
I notice for instance on the screenshot there is a link labelled
- Detailed note...
- In fact that is a link to (I unlinked it) http://download.sharelive.net/iLividSetup.exe -> ..../cdn/r/1154/iLividSetup-r1154-n-bf.exe
That is going to try to install something not give you details
- In fact that is a link to (I unlinked it) http://download.sharelive.net/iLividSetup.exe -> ..../cdn/r/1154/iLividSetup-r1154-n-bf.exe
It may be worth having a look at these articles about ilivid and bandoo
Please however follow cor-el's instructions and scan with multiple and up to date tools.
In future please try to take care to check out both downloads and download sites before clicking on things and then be careful only to install what you really need, not all the stuff likely to be offered.
- sigh*
Okay guys. (Thanks for the help by the way).
I reviewed and disabled my suspicious normal and not so normal add-ons. I removed Java deployment toolkit 7. I read up on globalupdae update and got rid of it. I relinked normal java and oracle. I reset/reconfigured my permissions, trusted sites and exclusions I updated firefox (again {from the source page}). I went through cor-el's list of programs sequentially, installed, updated and ran them.
I found lots of tracking cookies, a whole heap of suspicious files, a few toolbars, a whole heap of temporary files, some unwanted software and a clean rootkit.
I also read up on "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked Whilst informative this was not an issue.
So far, so good. No browser hijacking.
I'll wait a couple of weeks to see if it comes back (mainly cos it creeps in slowly and then quietly goes critical over a few weeks).
I'll check back with you guys in a few weeks to let you know how I go.
And now for a post script of times past. (and a how to guide to progressively kill your computer)
About 6 months ago a window opened stating that acrobat was out of date. It looked legit. All nice and black with red writing and the product logos. All official like. It had a nice grey install bar. I installed it and it updated acrobat but it also installed the snapdo toolbar. This lost my default homepage and I noticed adds appearing in my windows whenever I opened a new page. I didn't know what to do about it and lived with it. I put it down to windows doing its "thing" and slowly changing settings throughout normal use. I reasoned that if it got too bad I could either defrag and reformat the hard drive or reinstall the programs again to "fix" windows.
- ahh you've gotta love microsoft products*
So I resumed using the computer normally. Installing software (freeware and shareware) as required. (Yes I know freeware and shareware are sometimes run by a third party and their authenticity needs to be taken with a grain of salt). Whenever I was installing I would always choose custom installs (mainly cos I want control over the "additional software" that is often glazed over). I am also carefull about receiving and opening either unknown or unsolicited e-mails. Even previewing them. So about a month ago I started receiving different messages in e-mail (no subjects, no sender details, weird sender details etc.) At first I reasoned that previewing them was ok but then my radar went off that things were "off". So I stopped looking at them thinking that by even previewing them would unlock a worm, virus or something else. (Nothing like a healthy dose of paranoia). I then received a new your software is out of date window. I chose not to install. The window appeared whenever I logged on. Then it stopped and then I had a few sporadic messages that my media player was out of date. Then a tab would open asking for an install. I'd decline it and think no more about it. This kept on for a few weeks (the odd tab here and there). I then chose to install the player cos it had a firefox update window. It installed V player (i think) BUT in going through the custom install I saw it would also install a few toolbars, change my default search engine, reset my homepage, sign me up for offers, place me on a mailing list, install three advertising programs and reconfigure my browser to allow sponsored adds to appear. I thought that if I got rid of all the crap then the computer would "work" again. This didn't stop the problem. I was then receiving my tab hijacking problem. I noticed that there was a cycle to the hijack. The longer I had a browser connected the worse it got. So I had a 10-15 minute window from opening a browser to do all my work before the browser would become hijacked with tab after tab after tab opening (sometimes three at a time). I couldn't keep up closing them. Pissed off with this "solution" I bumbled my way through firefox help and found out about the reset. I tried it and it worked for a bit and then returned. And thats when I contacted you guys.
So yes I'm a poster child for hijacking and malware but I'm at a loss as to where the original "patient zero" came from and what loaded it as I'm carefull (or so I think) about where I install things from. So it was just "one of those things" that happened to find my computer.
Anyway hopefully its in the past now.
Thanks