I seem to have a browser hijacker. I don't know where it came from, but it seems to work only, or at least primarily, on Pandora.com. I looked at the malwarebytes website to learn more about it, but there is no solution posted for Linux systems. Googling 'prepare2upvideo ubuntu' did not get any matching hits. I also note that this thing thinks I am on Mac OS. I found this post: Redirection to ad pages in browsers where the OP specifically mentions fake flash downloads in FF, so apparently this is an old and known problem, perhaps just in a new form. So, in researching this, I found that FF blocks Flash, so my questions are: 1. If Flash is blocked, why is Pandora still playing? Is it not Flash? 2. Do I really have this thing on Ubuntu or not? It might be just a scare tactic and not actually on my HD, but how would I know/find it, and most important of all, get rid of it? 3. Finally, what is the vector? Could it be piggybacking on a legitimate seeming ad on Pandora? Thanks. Ubuntu 16.04, FF 50.
--update-- extensions: firebug ubuntu modifications for firefox 3.2, not updated since 9/18/15, but when I clicked ‘check for updates’ there weren’t any. H264 Shockwave Flash 24 Itunes application detector (says ‘ask to activate’. I don’t have itunes, so why is this here at all? Did it come by default? I changed it to ‘never activate’, which disabled it, but there was no indication as to how to remove it altogether.
I discovered that there is an ‘add on debugger’ in FF. However, when I try to use it, I get this warning:
“An incoming request to permit remote debugging connection was detected. A remote client can take complete control over your browser!”
Both server and client endpoints are localhost, so I clicked ok – and nothing happened. I click to run the debugger again, and got the same message. Then I found a second window had opened up underneath. It said “error opening browser toolbox”:
[Exception... "Component returned failure code: 0x80470002 (NS_BASE_STREAM_CLOSED) [nsIInputStream.available]" nsresult: "0x80470002 (NS_BASE_STREAM_CLOSED)" location: "JS frame :: resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/security/socket.js :: onInputStreamReady :: line 298" data: no]
I am not syncing this FF with any other machine or install of FF.
I found a blocklist file:///usr/lib/firefox/browser/blocklist.xml with a lot of entries for ‘flash’. This must be something from Mozilla. I sure didn’t create this. But this particular site is not on the list.
It seems I can’t access or move the firefox folder, except, perhaps, with sudo at the command line, which I am loathe to do. I tried accessing the profile manager by following the instructions here: http://kb.mozillazine.org/Profile_Manager Linux Close the application completely and make sure that it is not running in the background. Open the terminal and execute cd (program directory) then execute: (Firefox) ./firefox -profilemanager
bash: ./firefox: Is a directory well duh…
cd into firefox malikarumi@Tetuoan2:/usr/lib/firefox$ -profilemanager No command '-profilemanager' found, did you mean: Command 'profilemanager' from package 'edubuntu-menueditor' (universe)
However, this works: malikarumi@Tetuoan2:/usr/lib/firefox$ ./firefox -profilemanager
but the only options are create, rename, and delete. I only have the default profile.