0

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, suddenly I got an overlay with a suggestion to install an extension:

enter image description here

The Text Encoding entry on the menu is now grayed-out, which it shouldn't be. The same thing happens on other websites, including, say, DuckDuckGo.

I have not done anything meaningful with my browser or my machine over the past several hours (before which I did not experience this behavior). And still - this seems very much like a kind of a virus, or a virus "bootstrapper" which wants to get me to install the next phase part of the virus, with more privileges.

  • Am I misinterpreting the situation?
  • Is this a known virus/malware script/whatever you call it?
  • How could it have gotten onto my system?
  • Other than shutting down, how can I mitigate my exposure?
  • How can I remove it?
Improve this question

1 Answer 1

Reset to default
1

Three "diagnostic" procedures to try (perhaps not the best thing, safety-wise) are:

  1. Check the same sites with your other browser.
  2. Disable all your extensions, and restart the browser normally.
  3. Restart the browser from the command-line with firefox -ProfileManager, create a new profile, and have the browser start running with the new profile.

If you don't experience the same phenomenon when doing any of the above, it's most likely malicious code in one of the extensions you've installed.

Note that a perfectly benign extension can theoretically become malicious by virtue of an auto-update, if someone had exploited a vulnerability in the extension author's system, at Mozilla, or somewhere along the way. Of course - you might have installed an extension which seemed benign but start acting maliciously only now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .