I seem to have a browser hijacker. I don't know where it came from, but it seems to work only, or at least primarily, on Pandora.com. I looked at the malwarebytes website to learn more about it, but there is no solution posted for Linux systems. Googling 'prepare2upvideo ubuntu' did not get any matching hits. I also note that this thing thinks I am on Mac OS. I found this post: Redirection to ad pages in browsers where the OP specifically mentions fake flash downloads in FF, so apparently this is an old and known problem, perhaps just in a new form. enter image description here So, in researching this, I found that FF blocks Flash, so my questions are: 1. If Flash is blocked, why is Pandora still playing? Is it not Flash? 2. Do I really have this thing on Ubuntu or not? It might be just a scare tactic and not actually on my HD, but how would I know/find it, and most important of all, get rid of it? 3. Finally, what is the vector? Could it be piggybacking on a legitimate seeming ad on Pandora? Thanks. Ubuntu 16.04, FF 50.

--update-- extensions: firebug ubuntu modifications for firefox 3.2, not updated since 9/18/15, but when I clicked ‘check for updates’ there weren’t any. H264 Shockwave Flash 24 Itunes application detector (says ‘ask to activate’. I don’t have itunes, so why is this here at all? Did it come by default? I changed it to ‘never activate’, which disabled it, but there was no indication as to how to remove it altogether.

I discovered that there is an ‘add on debugger’ in FF. However, when I try to use it, I get this warning:

“An incoming request to permit remote debugging connection was detected. A remote client can take complete control over your browser!”

Both server and client endpoints are localhost, so I clicked ok – and nothing happened. I click to run the debugger again, and got the same message. Then I found a second window had opened up underneath. It said “error opening browser toolbox”:

[Exception... "Component returned failure code: 0x80470002 (NS_BASE_STREAM_CLOSED) [nsIInputStream.available]" nsresult: "0x80470002 (NS_BASE_STREAM_CLOSED)" location: "JS frame :: resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/security/socket.js :: onInputStreamReady :: line 298" data: no]

I am not syncing this FF with any other machine or install of FF.

I found a blocklist file:///usr/lib/firefox/browser/blocklist.xml with a lot of entries for ‘flash’. This must be something from Mozilla. I sure didn’t create this. But this particular site is not on the list.

It seems I can’t access or move the firefox folder, except, perhaps, with sudo at the command line, which I am loathe to do. I tried accessing the profile manager by following the instructions here: http://kb.mozillazine.org/Profile_Manager Linux Close the application completely and make sure that it is not running in the background. Open the terminal and execute cd (program directory) then execute: (Firefox) ./firefox -profilemanager

bash: ./firefox: Is a directory well duh…

cd into firefox malikarumi@Tetuoan2:/usr/lib/firefox$ -profilemanager No command '-profilemanager' found, did you mean: Command 'profilemanager' from package 'edubuntu-menueditor' (universe)

However, this works: malikarumi@Tetuoan2:/usr/lib/firefox$ ./firefox -profilemanager

but the only options are create, rename, and delete. I only have the default profile.

  • You can visit this page with Firefox to see which version of Flash you have (if any). – Gunnar Hjalmarsson Jan 4 '17 at 14:30
  • FF in Linux is not immune to malware in form of "extras" (extensions, addons, etc.) and those can be synced from any other OS you've running FF on (and enabled syncing, of course). The same applies to Chrome. The first thing to do is check the extensions and disable or delete any suspicious ones. – user589808 Jan 4 '17 at 15:48
  • The first thing I would try is moving my ~/.firefox folder to another location and then running firefox, this will create a new config to see if it is in your system or not, I doubt it could get to the file system. – Mark Kirby Jan 4 '17 at 16:09

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.