286173 - unwanted WhatUSeek homepage on Linux

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Ed]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050306 Firefox/1.0.1 (Debian package 1.0.1-2)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050306 Firefox/1.0.1 (Debian package 1.0.1-2)

Originally, I had my homepage set to http://www.google.com/linux.  When I
re-opened Firefox, it automatically went to http://www.whatuseek.com.  I have no
idea how or why.  I've went through and cleared all cache and cookies,
everything else that has a "clear" option.  That didn't work.  I've even
uninstalled Firefox, and deleted the entire /home/(me)/.mozilla/firefox folder.
 Then I reinstalled, and even with an empty homepage preference, Whatuseek still
came up.  Now, if I click on the HOME button, It will load in my choice for
homepage.

There is no reference for Whatuseek.com, except for in my History list.  I
downloaded the Cookie viewer extention, and the only one I can see in there, was
the Google homepage setting.  I do get files for it in
/home/(me)/.mozilla/firefox/l7ndcnz4.default/Cache.

Reproducible: Always

Steps to Reproduce:
Hard to say.  I'm guessing this is from a page that I've browsed along the way. 

Actual Results:  
http://www.whatuseek.com loads up.

Expected Results:  
Load up my selected homepage, not whatuseek.

Comment 1

[Ben Fowler]

If you do an nslookup or dig for the two hosts you mention, do you get
the expected results?

If there is no mention of 'www.whatuseek.com' in your files (home
directory, profile if it is elsewhere) then this does not look at
first glance like a defect in Firefox.

This raises the question of what has happened, and how it managed
to happen on a system that enforces separation of privileges.

What happens if you create a brand new user, and use Firefox
as that user?

You may want to check with other Debian users.

Comment 2

[Daniel Veditz [:dveditz]]

Have you installed any other extensions? Which ones and where did you get them?

This seems a bit like an installed adware program, but I don't think I've heard
of any on Linux. Could be a javascript XPCOM component? But that would go away
when you uninstalled. If it hitchhiked on an extension that would go away when
you nuked your profile. Where is the bugger hiding?

Does about:plugins show anything interesting that shouldn't be there?

Could you run an adware-detector?

Comment 3

[Daniel Veditz [:dveditz]]

found a theory on a Fedora forum: you've got a desktop shortcut that does
something like "firefox %u" or "htmlview %u" (where something else maps the
htmlviewer to your default browser Firefox).

On invalid urls Firefox uses Google's "I'm feeling Lucky" behavior (Oh, how I
hate that); the result for "%u" is the whatuseek site. I think the "%u" is
supposed to be replaced with a URL when the default browser is called from
another application, but when passed raw into firefox it triggers the search
that ends up on whatuseek.

You can try to find the shortcuts with this "%u" and remove the trailing text
(possibly breaking the ability for other apps to call firefox).

Another approach would be to remove or change the "keyword" behavior. Go to
about:config and enter "keyword" in the Filter text box. You should get two
items. Either double-click the "keyword.enabled" line to turn the feature off,
or double-click the keyword.URL line to edit the search URL
("http://www.google.com/search?q=" will give you regular Google search results).

We've got other bugs on the mysteriousness of the keyword feature and system
edits are outside the scope of a bugzilla bug: I'm closing this one. If I'm
wrong about the cause please comment and I'll reopen.