Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

Browser hijack from unknown source starting Chrome instance within Firefox.

  • 3 uphendule
  • 1 inale nkinga
  • Igcine ukuphendulwa ngu James

more options

Yesterday my Firefox browser was apparently hijacked.

System information: Macbook Pro macOS Sierra 10.12.2 fully updated Extensions: uBlock Origin, Lastpass, Self-destructing cookies, Random Agent Spoofer, uMatrix

Symptoms: -The size of the browser tool bar and tabs were far too small, like they were zoomed out. The tabs and the buttons in the upper left (red, yellow, green on Mac) no longer overlayed properly. -Home page was redirected to (the 124 bytes part is correct, not sure if this is the whole address -Surfed to who notified me that I was using an old version of Chrome

   -Shut down all add-ons, restarted browser, returned to, same notification (wanted to ensure that it wasn't an add-on malfunction)

-Changing home page would stick until the browser was restarted -Ran virus/malware scans: Malwarebytes, ClamXav

   -No issues were returned with either

Resolution efforts (in order): -ClamXav virus scan -Malwarebytes scan -Delete and reinstall Firefox -Use terminal to look for hidden directories (none found) -Removed (rm -r) all Mozilla and Firefox directories from /Library

The last effort seems to have resolved the problem. Unfortunately I no longer have the user information because it was rm -r

I'm happy to help troubleshoot this further.

All Replies (3)

more options
more options

The User Agent you used to make this thread as you can see in your More System Details on right of your post is Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36

If you are using Firefox to post then perhaps your user agent was changed.

more options

hubrisbear said

Extensions: Random Agent Spoofer

Actually this may be due to the Random Agent Spoofer extension you have installed.