639319 - Videobash download, even after uninstall of both toolbar and browser itself, ruins url search capability

Status: RESOLVED INVALID

(Firefox :: Extension Compatibility, defect)

Description

[David Studhalter]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15

This isnt a bug, exactly, but a browser specific attack by the Russian site videobash. I foolishly fell for their download offer for a utility to download and save youtube videos. It made itself my homepage and messed up the search capability in the URL entry line, so that anything entered there just goes to http://start.videobash.com/s/?src=FF-Address&site=Bing&cfg=2-215-0-...&q=igoogle no matter what. I tried uninstalling the toolbar, the browser itself (and IE too, since it did it to IE as well). Nothing worked. Everything else is normal, but if I type words in the URL field instead of an actual URL, it goes to this address. 

I think of this as a viral attack on Firefox, so there may be something you could do in the future to protect users from this. Meantime, if there is a way to completely wipe this out, even if I have to totally scrub firefox from my computer and start over, I'd appreciate knowing about it. 

Reproducible: Always

Steps to Reproduce:
In the main URL window, type anything at all other than an actual web address. The browser redirects to http://start.videobash.com/s/?src=FF-Address&site=Bing&cfg=2-215-0-...&q=igoogle ... every time. (This isn't an actual website; you get an error message). 
Actual Results:  
See above, there is nothing more to it. 

Expected Results:  
That's it; you get the error message. If you use the google search window, it's fine, so it's not a huge big deal, but it's irritating. 

It's not Firefox's fault, obviously, but I thought you should know about it and maybe see if there's a way to protect against this kind of disabling of a feature of the software by foreign based malware. This was my own fault, I realize, but it's probably a fairly common problem. Thank you.

Comment 1

[Ed Morley [:emorley]]

It sounds like the utility modified your Firefox prefs for the search suggest URL. This preference is stored in your Firefox profile, that does not get removed when uninstalling Firefox.

See this guide for resetting:
http://support.mozilla.com/kb/Searches+are+redirected+to+another+site

However, if it were me, I would just start with a new profile and transfer bookmarks/passwords over - to make sure anything else bad is cleared out. See this guide:
http://support.mozilla.com/kb/Basic+Troubleshooting#w_make-a-new-profile

I'd also run an antivirus/anti-malware tool. eg:
http://www.microsoft.com/security_essentials/
and
http://www.malwarebytes.org/

Marking this bug as invalid since this is a due to spyware/malware/broken addon (take your pick), rather than a bug in Firefox. Videobash isn't on AMO, so presume blocklisting is pointless (they would just change the GUID and work around the block anyway).

Comment 2

[Ed Morley [:emorley]]

Also, for the future, if you have problems, the best place to ask for support is:
http://support.mozilla.com/

...since bugzilla is for developer bug reports rather than support requests.

Thanks!