Doc Searls Weblog

10 responses to “My Firefox phucked by phishing?”

1. 

   John

   February 27, 2015 at 7:38 pm

   Are you running Windows? Check uninstall options in Control Panel and sort by most recently installed. Remove anything you don’t recognize.
   This Trojan has been known to install the following: Bing toolbar (not due if it’s legit), DropDownDeals, Yontoo layers, PageRage and BuzzDock. I assume most of these things are adware annoyances. Also remove Gimp and get the real version from gimp.org. Hope this helps.

   Reply
2. 

   Susan F Heywood

   February 27, 2015 at 8:01 pm

   These are the worst. They put this sh*the on the computer and use it to serve pop up offers to get rid of them. Cyber blackmail is what it seems like to me. I had the same issue at the time of the search change. If you run task manager at start up and see unfamiliar processes, particularly if they are all letters it is probably one of the Trojans. Right click and click end process tree. If you see one called edealpop kill it off. Keep TM open when you open Firefox. If you see a process called Zombie Invasion, kill it off quickly. This should help you search for a fix that is not related to the trojan. Uninstall any Salus programs and other ad programs that you can using the Control Panel.

   Symantec’s Trojan removal tools

   Pop-ups and re-directed are likely to pop up, so be careful or use another machine to get the fix.

   Also, look in certmgr.msc for any certificates from Salus and kill them. This should help keep the app from popping up so frequently after you think you have found and deleted it’s files. This is just based on my personal experience and a few hours of tracking it down.

   Hope this helps. These Trojans are a scourge of the Web.

   Reply
3. 

   Susan F Heywood

   February 27, 2015 at 8:09 pm

   Of course I didn’t process the Apple on the screen shot, so the process will be different. When one of the population comes up, view the page source to see what loaded. Searc for Apple on Symantec’s site for the Mac version.

   Reply
4. 

   Kris Kenyon

   February 27, 2015 at 8:37 pm

   Doc,
   As an Apple Consultant network member I do this all of the time. Life hacker has a nice walk though here http://lifehacker.com/bundled-crapware-has-come-to-macs-so-hone-your-bs-dete-1688207772
   Outside of /Library/Launch* look at ~/Library/LaunchAgents because you’ll have items there too. I would also look for add ons to Safari since these usually add them by default. Email me if you have issues.

   P.S. thank you for the years of enjoyment reading your articles. Keep up the good work.

   Reply
5. 

   Doc Searls

   February 28, 2015 at 5:52 am

   Thanks, all.

   I’m still in the midst. The apparent culprit is trovi, and I’ve removed everything called trovi that I can find from the machine (a MacBook Air). It no longer seems to be infecting Firefox or Safari, but it’s still infecting Chrome. Every new tab I open has http://www.trovi.com/?… (long string of jive) as the default URL. Chrome seems to have removed “reset browser settings” as an option. I don’t want to reset everything yet, but maybe I’ll have to.

   I also bought and installed Norton, but it does nothing to fix the browser stuff, and didn’t catch anything related to Trovi. Just saying.

   Reply
6. 

   Adrian Klaver

   February 28, 2015 at 7:17 am

   Tips on how to get rid of Trovi, including on Chrome:

   http://lavasoft.com/mylavasoft/company/blog/how-to-remove-trovi-search

   Reply
7. 

   Doc Searls

   February 28, 2015 at 8:51 am

   Thanks, Adrian, but Lavasoft seems to be Windows only. Won’t work for me.

   Reply
8. 

   Adrian Klaver

   February 28, 2015 at 9:41 am

   You do not need to use Lavasoft to do the removal. They would like you to, but it is not a requirement. Go to the bottom of the page and walk throught the instructions for cleaning up Chrome from within Chrome.

   Reply
9. 

   Doc Searls

   February 28, 2015 at 10:41 am

   Okay, I reset Chrome and that seems to have done the trick. So I think (or hope) I’m done.

   Thanks for all your help!

   Reply
10. 

    Adelia Goetter

    March 12, 2015 at 5:37 am

    Hi there, i just wanted to drop you a line to say that i thoroughly enjoyed this detailed post of yours, I have subscribed to your RSS feeds and have skimmed a few of your posts before but this one really stood out for me. I know that I am just a stranger to you but I figured you might appreciate the admiration Take care and keep blogging.

    Reply