X
Nhấn vào đây để đến phiên bản di động của trang web.

Diễn đàn trợ giúp

How do i get the SecureWebBHO malware out of FIrefox 33.03

Được đăng

I use Firefox (version 33.03 right now) as my main web browser. Recently, a number of regularly visited sites have started acting strange. I am also getting random pop ups telling me that I need to update my video player, or Java version (my version is current). I checked the "add ons" in the control menu, nothing looks out of place (2 nVidia 3D Vision plugin, one VLC Web plug in, one OpenH264 plug in from Cisco). I fired up IE 11 to see if it had the same issue. It did. When I opened up IE's control menu, and went to "manage add-ons", it showed the SecureWeb BHO from a company called Jelbrus LLC. I disabled it in IE 11, and it is running properly. I have run Windows Defender on a full scan. It says it found 1 item, which it said it deleted. I ran the freeware version of MalwareBytes Anti-Malware. It says it found 2 registry problems, and a PUP (Probably Unwanted Program). Asked it to quarantine the problems. Problem still exists with Firefox, ONLY. My questions are: a) why is it not showing up as an add-on or extension or service? and b) How do I get rid of this?

Kostas

I use Firefox (version 33.03 right now) as my main web browser. Recently, a number of regularly visited sites have started acting strange. I am also getting random pop ups telling me that I need to update my video player, or Java version (my version is current). I checked the "add ons" in the control menu, nothing looks out of place (2 nVidia 3D Vision plugin, one VLC Web plug in, one OpenH264 plug in from Cisco). I fired up IE 11 to see if it had the same issue. It did. When I opened up IE's control menu, and went to "manage add-ons", it showed the SecureWeb BHO from a company called Jelbrus LLC. I disabled it in IE 11, and it is running properly. I have run Windows Defender on a full scan. It says it found 1 item, which it said it deleted. I ran the freeware version of MalwareBytes Anti-Malware. It says it found 2 registry problems, and a PUP (Probably Unwanted Program). Asked it to quarantine the problems. Problem still exists with Firefox, ONLY. My questions are: a) why is it not showing up as an add-on or extension or service? and b) How do I get rid of this? Kostas

Giải pháp được chọn

Further information points:

-The problem re-occurred.

-I downloaded and ran Microsoft's Offline Defender today. It was downloaded with a separate, un-infected PC, burned onto DVD, and then I booted from the DVD drive on the infected* computer. Ran a full scan on the infected* computer and let it run to completion. No infection found.

-Rebooted Windows 8.1 Upgrade 1. Opened up FIrefox. Problem still there. Went into the Control menu, looked at add-ons and extensions. Nothing showed up. Went to extensions. Did a search and downloaded NoScript. Closed down Firefox. Re-started Firefox, and problem is gone.

Kostas

Đọc câu trả lời này trong ngữ cảnh 1

Chi tiết hệ thống bổ sung

Phần bổ trợ đã cài đặt

  • VLC media player Web Plugin 2.1.3
  • NVIDIA 3D Vision plugin for Mozilla browsers
  • NVIDIA 3D Vision Streaming plugin for Mozilla browsers

Ứng dụng

  • Firefox 33.0.3
  • Chuỗi đại diện người dùng: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
  • URL hỗ trợ: https://support.mozilla.org/1/firefox/33.0.3/WINNT/en-US/

Tiện ích mở rộng

  • Troubleshooter 1.1a (troubleshooter@mozilla.org)

Javascript

  • incrementalGCEnabled: True

Đồ họa

  • adapterDescription: NVIDIA GeForce 8600 GT
  • adapterDescription2:
  • adapterDeviceID: 0x0402
  • adapterDeviceID2:
  • adapterDrivers: nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
  • adapterDrivers2:
  • adapterRAM: 256
  • adapterRAM2:
  • adapterVendorID: 0x10de
  • adapterVendorID2:
  • direct2DEnabled: True
  • directWriteEnabled: True
  • directWriteVersion: 6.3.9600.17111
  • driverDate: 7-2-2014
  • driverDate2:
  • driverVersion: 9.18.13.4052
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'direct2d', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'direct2d', u'AzureSkiaAccelerated': 0}
  • isGPU2Active: False
  • numAcceleratedWindows: 1
  • numTotalWindows: 1
  • webglRenderer: Google Inc. -- ANGLE (NVIDIA GeForce 8600 GT Direct3D9Ex vs_3_0 ps_3_0)
  • windowLayerManagerRemote: True
  • windowLayerManagerType: Direct3D 11

Thay đổi cài đặt

  • browser.cache.disk.capacity: 358400
  • browser.cache.disk.smart_size.first_run: False
  • browser.cache.frecency_experiment: 2
  • browser.places.smartBookmarksVersion: 7
  • browser.sessionstore.upgradeBackup.latestBuildID: 20141105223254
  • browser.startup.homepage: https://mail.google.com/mail/u/0/#inbox|http://www.forfmjbodiesonly.com/|http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1&CurrentPage=MyeBaySummary&ssPageName=STRK:ME:LNLK:MESUMX
  • browser.startup.homepage_override.buildID: 20141105223254
  • browser.startup.homepage_override.mstone: 33.0.3
  • browser.tabs.warnOnClose: False
  • dom.mozApps.used: True
  • extensions.lastAppVersion: 33.0.3
  • gfx.direct3d.last_used_feature_level_idx: 1
  • media.gmp-gmpopenh264.lastUpdate: 1415421126
  • media.gmp-gmpopenh264.version: 1.1
  • media.gmp-manager.lastCheck: 1415421125
  • network.cookie.prefsMigrated: True
  • places.database.lastMaintenance: 1415423652
  • places.history.expiration.transient_current_max_pages: 104858
  • plugin.disable_full_page_plugin_for_types: application/pdf
  • plugin.importedState: True
  • plugin.state.npvlc: 1
  • privacy.sanitize.migrateFx3Prefs: True
  • storage.vacuum.last.index: 0
  • storage.vacuum.last.places.sqlite: 1415423651

Linh tinh

  • Người dùng JS: Không
  • Có thể tiếp cận: Không
jayelbe 50 giải pháp 293 câu trả lời
Được đăng

Hi kkritsilas,

It would be worth resetting Firefox. This will give you a fresh start (hopefully free of that addon!) but will preserve all of your history, saved passwords and bookmarks. See the Refresh Firefox - reset add-ons and settings article for more information.

To Reset Firefox:

  1. Open the Troubleshooting Information page using one of these methods:
    • Click the menu button New Fx Menu , click help Help-29 and select Troubleshooting Information. A new tab containing your troubleshooting information should open.
    • If you're unable to access the Help menu, type about:support in your address bar to bring up the Troubleshooting Information page.
  2. At the top right corner of the page, you should see a button that says "Reset Firefox" that looks like this: Button reset . Click on it.
  3. Firefox will close and reset. After it is done, Firefox will show a window with the information that is imported.
  4. Click Finish and Firefox will reopen.

Did this fix the problem? Please report back to us!

Thank you,

Jayelbe

Hi kkritsilas, It would be worth resetting Firefox. This will give you a fresh start (hopefully free of that addon!) but will preserve all of your history, saved passwords and bookmarks. See the [[Reset Firefox – easily fix most problems]] article for more information. To Reset Firefox: # Open the Troubleshooting Information page using one of these methods: #*Click the menu button [[Image:New Fx Menu]], click help [[Image:Help-29]] and select ''Troubleshooting Information''. A new tab containing your troubleshooting information should open. #*If you're unable to access the Help menu, type '''about:support''' in your address bar to bring up the Troubleshooting Information page. #At the top right corner of the page, you should see a button that says "Reset Firefox" that looks like this: [[Image:Button reset]]. Click on it. #Firefox will close and reset. After it is done, Firefox will show a window with the information that is imported. #Click Finish and Firefox will reopen. Did this fix the problem? Please report back to us! Thank you, Jayelbe

Người tạo câu hỏi

Hi,

I have tried to reset Firefox 5 times. I have also tried almost all of the solutions in the Troubleshooting Information. I have tried starting up Firefox with Add-Ons disabled. I have tried running 2 anti-malware programs, and deleted what they found, I have run Windows Defender on a full scan. This problem is still here. I have enclosed screen captures of the same website using Firefox (titled Infected Firefox Screen Capture) and the same website on IE (titled IE Screen Capture (uninfected)). Note all of the underlined links, that all pop out with the window shown. This is annoying on a bulletin board type web site, it renders sites like eBay useless, as instead of jumping into the different categories/areas of eBay, it imposes its own search engine on top of the eBay links, making moving around the eBay site impossible (this is just an example) It also limits, or attempts to limit, what you can see or puts up windows that tries to get you to load a new version of a video player or Java update (I have not allowed this to happen).

Hi, I have tried to reset Firefox 5 times. I have also tried almost all of the solutions in the Troubleshooting Information. I have tried starting up Firefox with Add-Ons disabled. I have tried running 2 anti-malware programs, and deleted what they found, I have run Windows Defender on a full scan. This problem is still here. I have enclosed screen captures of the same website using Firefox (titled Infected Firefox Screen Capture) and the same website on IE (titled IE Screen Capture (uninfected)). Note all of the underlined links, that all pop out with the window shown. This is annoying on a bulletin board type web site, it renders sites like eBay useless, as instead of jumping into the different categories/areas of eBay, it imposes its own search engine on top of the eBay links, making moving around the eBay site impossible (this is just an example) It also limits, or attempts to limit, what you can see or puts up windows that tries to get you to load a new version of a video player or Java update (I have not allowed this to happen).
FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.

You can try these free programs to scan for malware, which work with your existing antivirus software:

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of. You can try these free programs to scan for malware, which work with your existing antivirus software: * [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner] * [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware] * [http://support.kaspersky.com/viruses/disinfection/5350 Anti-Rootkit Utility - TDSSKiller] * [http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner AdwCleaner] (for more info, see this [http://www.bleepingcomputer.com/download/adwcleaner/ alternate AdwCleaner download page]) * [http://www.surfright.nl/en/hitmanpro/ Hitman Pro] * [http://www.eset.com/us/online-scanner/ ESET Online Scanner] [http://windows.microsoft.com/MSE Microsoft Security Essentials] is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article. Did this fix your problems? Please report back to us!

Câu trả lời hữu ích

Again, as previously stated, I have run Malware Bytes Anti-Malware, and Adw Cleaner. I have run HItman Pro, and I have run Windows Defender in full scan mode. I can run every anti-virus/malware program on the face of the planet, and they all come up clean. SecureWeb BHO is NOT a virus or malware in the traditional sense. It is an add-on that has attached itself to FIrefox. It had a attached itself to Internet Explorer 11 as well, but I was able to disable it within Internet Explorer by using its Manage Add-ons control panel inside of IE 11. Not only can I not do that within FIrefox, I can't even SEE it within Firefox; it doesn't show up as an extension or add-on (it was shown as an extension in IE 11m which is what allowed me to disable it there). This seems to be an area that could use improvement in Firefox.

Also, while I haven't stated it outright, this is a WIndows 8.1 update 1 64 bit machine, so Windows Defender, the replacement for Microsoft Security Essentials, is built in. it is set to update automatically, both for Defender and for regular Windows updates.

FYI, the issue has now been resolved by deleting and re-installing Firefox.

Kostas

Again, as previously stated, I have run Malware Bytes Anti-Malware, and Adw Cleaner. I have run HItman Pro, and I have run Windows Defender in full scan mode. I can run every anti-virus/malware program on the face of the planet, and they all come up clean. SecureWeb BHO is NOT a virus or malware in the traditional sense. It is an add-on that has attached itself to FIrefox. It had a attached itself to Internet Explorer 11 as well, but I was able to disable it within Internet Explorer by using its Manage Add-ons control panel inside of IE 11. Not only can I not do that within FIrefox, I can't even SEE it within Firefox; it doesn't show up as an extension or add-on (it was shown as an extension in IE 11m which is what allowed me to disable it there). This seems to be an area that could use improvement in Firefox. Also, while I haven't stated it outright, this is a WIndows 8.1 update 1 64 bit machine, so Windows Defender, the replacement for Microsoft Security Essentials, is built in. it is set to update automatically, both for Defender and for regular Windows updates. FYI, the issue has now been resolved by deleting and re-installing Firefox. Kostas

Được chỉnh sửa bởi kkritsilas vào

Người tạo câu hỏi

HI,

Just had this re-occur. I believe that the current Adobe Flash download is doing this. I don't know if it is intended or not, but with the re-loaded Firefox 33.0.3, it was fine until I downloaded the Flash 15.0 plug in. Problem started up again, with the "ghost audio in the background".

Kostas

HI, Just had this re-occur. I believe that the current Adobe Flash download is doing this. I don't know if it is intended or not, but with the re-loaded Firefox 33.0.3, it was fine until I downloaded the Flash 15.0 plug in. Problem started up again, with the "ghost audio in the background". Kostas
FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng

What is the name of the add-on? What ever it is, it should have been listed.

What is the name of the add-on? What ever it is, it should have been listed.

Người tạo câu hỏi

As per the the first email, IE called it "SecureWeb BHO" by Jelbrus LLC. My assumption is that this is the same piece of code that was affecting Firefox 33.0.3, but I can of course be wrong about that. With IE, when I disabled the SecureWeb BHO extension, all of the behaviors (Ghost audio, every uncommon word being underlined as a link, with the link being directed to some strange web search engine) disappeared. This does NOT show up in FIrefox as either an extension or add-on. Doing a web search reveals that this is a PUP (Potentially Unwanted Program) which for some reason is not classified as a virus or as a browser hijack. I'm pretty sure it needs to have the Flash Player plug in installed, as this was one of the steps I took to get rid of it (deleting Flash player 15.0.6, I think).

The fact that is runs under Flash may be the key, and why it doesn't show up in the Firefox add-ons/extensions. IE has its own, internal Flash player now, while Firefox is still relying on the Adobe Flash player. Because IE has full control over all plug ins, including Flash based ones, it can see that something has installed itself (ie. SecureWeb BHO). Firefox can see the Flash Player Plug in just fine, It just can't see that something has installed itself using Flash player, because it can't see inside of Flash Player, all it can see it that Flash is installed or not. Just some thoughts based on my experience.

Kostas

As per the the first email, IE called it "SecureWeb BHO" by Jelbrus LLC. My assumption is that this is the same piece of code that was affecting Firefox 33.0.3, but I can of course be wrong about that. With IE, when I disabled the SecureWeb BHO extension, all of the behaviors (Ghost audio, every uncommon word being underlined as a link, with the link being directed to some strange web search engine) disappeared. This does NOT show up in FIrefox as either an extension or add-on. Doing a web search reveals that this is a PUP (Potentially Unwanted Program) which for some reason is not classified as a virus or as a browser hijack. I'm pretty sure it needs to have the Flash Player plug in installed, as this was one of the steps I took to get rid of it (deleting Flash player 15.0.6, I think). The fact that is runs under Flash may be the key, and why it doesn't show up in the Firefox add-ons/extensions. IE has its own, internal Flash player now, while Firefox is still relying on the Adobe Flash player. Because IE has full control over all plug ins, including Flash based ones, it can see that something has installed itself (ie. SecureWeb BHO). Firefox can see the Flash Player Plug in just fine, It just can't see that something has installed itself using Flash player, because it can't see inside of Flash Player, all it can see it that Flash is installed or not. Just some thoughts based on my experience. Kostas

Được chỉnh sửa bởi kkritsilas vào

FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng
http://www.bing.com/search?q=SecureWeb%20BHO

Giải pháp được chọn

Further information points:

-The problem re-occurred.

-I downloaded and ran Microsoft's Offline Defender today. It was downloaded with a separate, un-infected PC, burned onto DVD, and then I booted from the DVD drive on the infected* computer. Ran a full scan on the infected* computer and let it run to completion. No infection found.

-Rebooted Windows 8.1 Upgrade 1. Opened up FIrefox. Problem still there. Went into the Control menu, looked at add-ons and extensions. Nothing showed up. Went to extensions. Did a search and downloaded NoScript. Closed down Firefox. Re-started Firefox, and problem is gone.

Kostas

Further information points: -The problem re-occurred. -I downloaded and ran Microsoft's Offline Defender today. It was downloaded with a separate, un-infected PC, burned onto DVD, and then I booted from the DVD drive on the infected* computer. Ran a full scan on the infected* computer and let it run to completion. No infection found. -Rebooted Windows 8.1 Upgrade 1. Opened up FIrefox. Problem still there. Went into the Control menu, looked at add-ons and extensions. Nothing showed up. Went to extensions. Did a search and downloaded NoScript. Closed down Firefox. Re-started Firefox, and problem is gone. Kostas
FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng

Well done.

Well done.

Người tạo câu hỏi

Turns out that this malware is coming from a particular site. I don't know why it only seems to affect Firefox (now at version 33.1). I intentionally visited this same site with IE 11, and it is not affected. I will avoid visiting this website with Firefox for the time being. I don't know if it affects Chrome, because I don't use Chrome, and refuse to do so.

Kostas

Turns out that this malware is coming from a particular site. I don't know why it only seems to affect Firefox (now at version 33.1). I intentionally visited this same site with IE 11, and it is not affected. I will avoid visiting this website with Firefox for the time being. I don't know if it affects Chrome, because I don't use Chrome, and refuse to do so. Kostas
FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng

What is the name of the site? Send a message to the site support and ask about this.

BlockSite {web link} BlockSite is an extension, which automagically blocks websites of your choice. Additionally, this extension will disable all hyperlinks to these websites, by just displaying the link text without the clicking functionality.

What is the name of the site? Send a message to the site support and ask about this. '''[https://addons.mozilla.org/en-US/firefox/addon/blocksite/ BlockSite]''' {web link} BlockSite is an extension, which automagically blocks websites of your choice. Additionally, this extension will disable all hyperlinks to these websites, by just displaying the link text without the clicking functionality.

Người tạo câu hỏi

FredMcD:

Thanks for the pointer to BlockSIte. I have contacted the website owner to let them know that their website has most likely been hacked and has malware residing on it. I have also added the site to the BlockSIte blacklist.

Kostas

FredMcD: Thanks for the pointer to BlockSIte. I have contacted the website owner to let them know that their website has most likely been hacked and has malware residing on it. I have also added the site to the BlockSIte blacklist. Kostas
FredMcD
  • Top 10 Contributor
4230 giải pháp 59023 câu trả lời
Được đăng

Once they get their system straightened out, you can remove that site from BlockSite. If you end up on a site you don't like, right click on the page, and near the bottom is Block This Site. The best way is to open the add-on, and edit the entry so it looks this; *website.com*

Once they get their system straightened out, you can remove that site from BlockSite. If you end up on a site you don't like, right click on the page, and near the bottom is '''Block This Site.''' The best way is to open the add-on, and edit the entry so it looks this; '''*website.com*'''