Suspicous firefox behavior @newegg.com

Discussion in 'Malware Help (A Specialist Will Reply)' started by Stragis, Dec 31, 2009.

  1. Stragis

    Stragis Private E-2

    Hey there!

    So I'm on the e-blast list for newegg, and on my laptop (everything in this post is related to said laptop).

    Whenever I go to a newegg site, even if I change the address to https://www.newegg.com which doesn't work (on a computer that isnt infected)

    My browser goes to a view much like full screen mode and I loze my address bar, and all capabilities to navigate except for clicking. I cannot right click. This happens even if I have multiple tabs open in the window it takes over the entire window.

    After poking and prodding I think I may have found the cause, a toolbar I have installed for one of those silly little games on facebook
    http://mousehuntguide.blogspot.com/2009/01/official-mousehunt-toolbar.html

    When I tell firefox to disable said toolbar (I recently updated from 3.0. something in firefox to 3.5.6) my navigation appears correctly at newegg for the most part. I am unable to test the 'secure' login part as I do not wish to compromise my security (I dont know what all a malicious user is able to access because I am pretty sure I have a debit card saved on there somewhere)

    I am worried that there might be a deeper infection that I do not understand. I have some basic understanding of hijack this, I found nothing suspicious there, so i went through the entire 'read and run me first'
     

    Attached Files:

    Last edited: Dec 31, 2009
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You forgot to attach the requested log from MGtools; however, I don't think we need it. You are not having malware problems. You are just having problems due to something you installed. Either remove the addon or uninstall FireFox and delete the FireFox folders. Then reinstall FireFox and don't reinstall the problem toolbars again. Other that that, I suggest that you post in the Software Forum.
     
  3. Stragis

    Stragis Private E-2

    Thank you! I just wanted to be sure I was not otherwise infected. When I first started doing malware removals I encountered a pretty ugly rootkit that only did one thing, very simular to the specifics of hijacking one certain website. But for the most part it is my understanding that when one goes to all the effort of cloaking the behavior of malware it generally does alot more than one specific ting like the issue I am having with newegg.com.

    I've attached the MGlogs but as it would appear I am otherwise clean.

    A side question about combo fix. I saw all the cautions of how powerful it is, but is it a removal tool or is it more of a detection in the class of Hijackthis type of tool?

    Thank you for your time. I've been using the MG forums for quite a while this is the first time using this persona (I could not remember the last one I created because I switched e-mails about 2 years ago and my last POST was about 3). I am working on setting up for my university (Humboldt state part of the CSU system) if they let me, a page quite like your 'read me run first' to help with various student malware problems if they are DIY inclined.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. This log is clean too.

    They are nothing alike. HijackThis is an extremely outdated toy compared to ComboFix. Also HijackThis does not detect malware. It just lists running processes and dumps a small set of registry keys most of which are typically normal; however malware sometimes could make use of some of those registry keys. Either way, HijackThis did not detect or automatically fix anything. The educated malware remove had to decide if anything needed to be fixed. And much of today's malware can not be removed using a simple tool like HijackThis nor can it even be detected by HijackThis since HijackThis is relatively limited in what it looks at. It does have other misc tools built-in to perform a variety of tasks, but again, none of this is automatic and there are better tools to provide these misc tools functions now too (like ComboFix, Avenger, DDS, OTM, OTL....etc).

    All that being said, neither HijackThis nor ComboFix are things that a novice or intermediate computer user should be running on their own since you need to know what you are looking at. Otherwise you could break your PC thru misuse. It could be even more problematic with ComboFix since it does not just scan (if run in the default mode). It will actually make many decisions on whether something is good or bad and will try to fix it. It is not something that should be used as a weekly/bi-monthly scanner like MBAM or SAS can be run.



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds