[SOLVED] firefox-bin security issue: "drivecleaner"

rickythesk8r · n00b Joined: 10 Aug 2003 Posts: 62

I am running firefox-bin on an amd64 box. Just now, a popup appeared touting a "product" called drivecleaner that was supposedly going to save my career and marriage by removing traces of "visits" to "adult sites." The mechanism behind the popup also managed to resize the firefox-bin frame to about 20x20 pixels and move it to the lower right hand corner of the screen (behind the popup).

What is the best course of action? Has the firefox-bin executable been corrupted? I have a few extensions: chatzilla, DOM inspector, download status bar, greasemonkey, talkback and videodownloader.

It's a little bit alarming. I assume that if I'd clicked Yes in the popup that a lot of personal information would have been harvested.

didymos · Posted: Mon Jun 25, 2007 2:12 am Post subject:

If the user isn't allowed to touch the firefox executable, then neither can the popup. Even if you had write access, it still probably wouldn't be able to do anything. What you want to do is open "about:config" and set anything that matches "dom.disable_window_*" to true. You may want to force any attempts to open a new window to open a new tab instead as well. Clean out the disk cache, and that should wipe any trace of the popup. If you feel especially paranoid, then "rm -rf ~/.mozilla/firefox". All your settings and extensions and themes go bye-bye if you do that, however.
_________________
Thomas S. Howard

desultory · Bodhisattva Joined: 04 Nov 2005 Posts: 9410

Hu · Administrator Joined: 06 Mar 2007 Posts: 23062

Since desultory mentioned restricting which sites can use JavaScript, I feel I should point out the use of x11-plugins/noscript, which will install NoScript in the system-wide Firefox plugins area. Of course, you can also install it in your profile if you do not want it to affect all Firefox users on the system.

This plugin lets you control JavaScript on a per-domain basis, without needing to keep editing preferences. It takes a bit of adjustment when you first start using it, but I have been very pleased with its results. In particular, you need to get all your trusted sites on the allow list so that their scripts are permitted to run. After the initial setup overhead, it requires very little maintenance.

rickythesk8r · n00b Joined: 10 Aug 2003 Posts: 62

Thanks for all the patient explanations and helpful suggestions.

NoScript is exactly what I needed. Not only does it keep predators at bay, it also performs the very useful service of showing you just exactly who is trying to run scripts. It's just amazing to me, for example, how often Google (in the form of google-analytics.com) pops up.