1039829 - [malware] delete unwanted startup page is not enough clear, reliable and simple

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[brainstuff John Scheb]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

i try to kill an unwanted startup-page (sweet-page). 


Actual results:

I have killed all related files in the system and also all related entrys in the config of firefox. I have verified the registery of win7  and deleted all kind of entrys who use the name "sweet-page". But: this stinky sweet-page comes up every time when I start firefox. I have changed the start-page, the ordinary startpage loads correctely. but when I restart Firefox, the sweet-**** is the first loaded page. When I have closed teh shhit-page, then Firefox works without this page ... as long as I do not restart Firefox.  


Expected results:

it must be possible to delete all kind of toolbars and start pages in Firefox. The Firefox button restore Standard does kill all kind of unwanted toolbars and all kind of stinky  "sweet-pages".

Comment 1

[bull500]

Please try resetting the browser 
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

Comment 2

[brainstuff John Scheb]

@bullionareboy  I have resetted the browser ... in the version 30 I had still the stupid sweet-page ... Now I have installed the firefox version 31 and it seems that the **** "sweet-page" does not comes up again ... but I must see if this is a permanent success. 

Do to the fact that these stupid "extensions" becomes a big problem and also do to other malware it is needed that Firefox does not handle parameters from such stupid malware.

Please let open this post for 10 days: I watch if this malware restarts in some days or after some system restarts and I post here the result.. 

Thanks a lot
brainstuff

Comment 3

[bull500]

@brainstuff

I can advise you some precautions:
1. choose the advanced or custom install option on softwares you're trying to install, since most of them contain unwanted features.
2. Do not install toolbars or addons from unknown sites.

Some malwares like the one you have mentioned might right them selves to the registry. a bit of googling can help you out i guess. :)

happy to help :)

Comment 4

[brainstuff John Scheb]

@ bullionareboy I take still all these precautions. 

And I have bad news ... the sweet-****-page comes still up  (the first start of Firefox was clean ... and now the **** page is again on the screen ...bevore the start of sessions manager ... this is the screenshot: http://mail2vip.com/vippages/firefox/firefox%20sweet-shitpage%20still%20opens.jpg

We expect a new kind of malware "installers" ... I have given them the name of "learning malware installers": Normally, a lot of malware installer programs ask the user ... do you want to install the xyz toolbar (or other ****) and give you the choice between yes and no. We had some of these programs who will "learn" that the "stupid user" will not install the "toolbar" ... and then they inverse the function of the yes and the no button. With other words: the program "learns" when a "stupid  user" clicks every time to NO and then the program install at the next "update" the "toolbar" when the user clicks to NO (we have seen this on some programs ... when the toolbar was installed, the program changes at new to the ordinary function (No is again NO), in this way it is not possible to proove the betray. 

Do to the fact that the "****-sweet-page" starts only immediately after the start of firefox (it is the FIRST page who opens ... then the session manager opens) I expect that this malware changes the first firefox start page. This will mean that the reset function of Firefox does not reset this page address to the ordinary value. When we reset Firefox,Firefox must be reset to his "factory" settings.   

I seek now for the portable version of Firefox and I try to see if the "****-sweet-page" is also loaded in teh portable version. I get back to you in some days with the result.  

thank you for your help.     
brainstuff

Comment 5

[bull500]

@brainstufff

I hope these two links will help you out
http://malwaretips.com/blogs/sweet-page-com-removal/
http://www.wikihow.com/Get-Rid-of-Sweet-page.com-Virus-from-Web-Browser

One of them should help you out soon

Comment 6

[brainstuff John Scheb]

@bullionareboy  thank you for the links ... but I had still tried all these procedures. (The second link is a little bit problematic, there is a lot of publicity for winzip.com/malwareprotector and it seems that this "protector" is also a "worm").  

But, in the second Link, I have fund a phrase who has given to me an idea ... You remember that I have stated that Firefox starts up the first time (after the reset) WITHOUT this "stupid sweet **** page" but at the next start, the malware comes back. 

I think I have fund out what happens: the first time after the restart Firefox starts by its self ... and when I start Firefox again, it starts by a link file! 

And this link file was probably changed by the "worm". In this way Firefox starts with the "****-sweet 
-page" address as parameter ... and opens with this page. (like you see on my screen shot)

I am testing now ... in the first step I have restart Firefox by clicking directely on the firefox.exe File .. no "****-Sweet-page" comes up! 

I will now seek for all links Files who can start Firefox .. and then I save them and I replace all by new link files. Then I verify if the problem does not come back lather and I get back to this post.  

But in this moment I think that the idea with the manipulated lnk-file seems to be intelligent. This is also a clean reason for the fact, that I have not fund "sweet-page" as text in any file on this computer!LNK Files does not content text!    

If this is confirmed, the Firefox developers must add to the reset procedure also a reset of the link file(s).

I will have some days to verify and I get back to you.

Thanks
brainstuff

Comment 7

[brainstuff John Scheb]

My idea with the link to start firefox with the **** "sweet page" as parameter was the right idea. I have replaced all LNK files and "sweet **** page" does not more start. 

It would be a good idea to include a renew of the link files when Firefox is resetted to his original state.

Thanks to all.