Closed Bug 548338 Opened 16 years ago Closed 15 years ago

No solution to iamwired.net

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Version:
3.6 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: vinieux, Unassigned)

Details

(Whiteboard: [CLOSEME 2011-2-25])

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 Despite Firefox being touted as the ultimate browser in terms of security, I am unable to rid my system of a firefox browser hijack which randomly loads a site called iamwired.net when I click on a link... in google search results or even on websites i am browsing... I have used Symantec, Mcafee, Malwarebytes, Superantispyware, spybot, hijackthis, TDSS killer, rootkit revealer, Norman, Smitfraud, Stinger and many more.. Nothing changes the fact that clicks randomly take me to iamwired.net and I am surprised that ther eis SO LITTLE to be found online on Google search that tackles this problem in any sensible and foolproof way... What the hell?? Reproducible: Always Steps to Reproduce: 1. Click on any link... in google search or any other website I might be browsing 2. Takes me to iamwired.net instead of the link I clicked on 3. Actual Results: I cannot reproduce it, it is absolutely random..About 30% of the links I click on take me to iamwired.net Expected Results: I landed up at this stupid iamwired.net site Gone to the site I clicked on obviously...
Version: unspecified → 3.6 Branch
Version: 3.6 Branch → unspecified
I am on WIn XP SP 3 genuine... with 4GB RAM and running SYmantec as the office policy... I use firefox 3.6
Does it also occur in Safe Mode (to rule out that it's caused by an extension) ? http://support.mozilla.com/en-US/kb/Safe+Mode
Also: do you use a proxy server (Tools->Options->Advanced->Network->Connections) ?
I have tried practically all the tricks listed on those bleepingcomputer forums. I am losing track of the number of antimalware programs and killers on my system thanks to those pages... There is a firewall... WIndows Firewall My question is, why has this not been identified as a serious FF security issue and why is there no clear way of getting rid of it instead of just hit and miss suggestions which show everything as clean? I have not tested it in safe mode to see if it still happens. Here is a list of my extensions: abled Extensions: [20] * Adblock Plus 1.1.3 * Add Bookmark Here ² 3.6.20091115 * All-in-One Gestures 0.21.0 * CoolPreviews 3.0.1 * DownThemAll! 1.1.8 * FaviconizeTab 1.0.1 * FireFTP 1.0.7 * Google Shortcuts 1.8.5 * Googlepedia 0.6.1 * Html Validator 0.8.6.1 * Hyperwords 6.0.1 * JSView 2.0.5 * LoudMo Contextual Ad Assistant 4.6.6.4 * MR Tech Toolkit 6.0.4 * NoScript 1.9.9.47 * QuickDrag 2.0.2.1 * Speed Dial 0.9.5 * Stop-or-Reload Button 0.2.2 * Tab Mix Plus 0.3.8.2 * Web Search Pro 2.8.3 Installed Themes: [1] * Default
There is a proxy server for the office... no proxy when run from home on my personal profile... I also have two separate ff profiles - one for office and one for home.. and this problem exists regardless of whether I am in office or at home...
AH I found the culprit... When I listed the Extensions for this above I see Loudmo there large as life though it is an Extension I have never installed and therefore I had no idea it was there. Thanks a ton for your replies and sorry for not noticing extensions that loaded themselves without my knowledge... How does this happen by the way? Shouldn't there be some kind of alert before such things happen?
>My question is, why has this not been identified as a serious FF security issue Because this is not a security issue at all in Firefox. Everything is already lost if malware applications are running on your system with enough (admin) privileges. Such malware can do everything on your system. >I have not tested it in safe mode to see if it still happens Please test it....
Mid-Air Do you still have the addon folder or do you removed that addon from your system? We could try to blocklist it but that won't help much because they can always change it. >How does this happen by the way? Either you installed it over the web and you had an alert or you had some application running on your system that installed this addon as systemwide addon. You will get an "new addon installed" alert at the next startup but many users click the addon alert away. There is somewhere a bug to make it more clear that Addon X got installed. >Shouldn't there be some kind of alert before such things happen? There is an alert but it's possible that you didn't recognized it as "new addon installed" dialog. But if the malware runs with enough privileges on your system it can always disable this alert if it modifys Firefox files.
I uninstalled the extension and also went to Add/Remove Programs in XP where it appeared as a program. Uninstalled that too and it gave me a message saying cannot find program it might be already removed. I then deleted all references to loudmo from my registry... One thing is for sure. I am very careful with extensions and I have no idea how it could have installed itself without my knowledge...
Reporter, are you still seeing this issue with Firefox 3.6.13 or later in safe mode or a fresh profile? If not, please close. These links can help you in your testing. http://support.mozilla.com/kb/Safe+Mode http://support.mozilla.com/kb/Managing+profiles Also, ensure you update all your plugins (Flash, Reader, java, quicktime, etc) to the latest version available on the vendor's website.
Whiteboard: [CLOSEME 2011-2-25]
Version: unspecified → 3.6 Branch
This bug has had the CLOSEME tag for several weeks and the date in the tag is far gone. If the reporter can still see this issue, Please retest with Firefox 3.6.x or later and a new profile (http://support.mozilla.com/kb/Managing+profiles). Then please remove the closeme tag in the whiteboard, mark the bug against the proper version and comment on the bug.
Status: UNCONFIRMED → RESOLVED
Closed: 15 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.