1

I've got a bad browser hijacker. It affects my online banking site, which (fortunately perhaps) displays a generic error code message when I attempt to log in. I suspect it came somehow from Wine, because I use Editplus as my text editor.

The url it redirects to is eaoueopa.com. I also suspect it is controlling my searches because any search involving "anti-virus" gets redirected to a set of bogus results with pages in non-native standard English, and reputable pages like cnet or Trend Micro don't appear.

It also prevents Comodo and Sophos from running. Commodo reports "comodo filesystem filter driver is not loaded" and running the terminal commands it suggests sends you back into an endless circle of the same error message. Sophos simply does not run. Literally nothing happens when I load it from the apps menu. A full scan of the file system in clamav doesn't make nay difference. I have quarantined all the infected files it reported and it's still there.

I have deleted and created a new profile in Firefox -- that doesn't make any difference.

I tried installing f-prot but that's too difficult for an uneducated user such as myself.

Short of reinstalling Mint, is there anything else I could try?

2
  1. Go to Tools -> Addons -> Extensions in Firefox and remove any suspicious-looking extensions.

    If you can't identify the problem extension, then create a new Firefox profile and start from scratch by running:

    firefox --ProfileManager --new-instance
    

    You will lose all your bookmarks, browser history, saved passwords, pre-filled forms, extensions, etc in this new profile. That's the point of doing this - a fresh start for your browser.

    Set this to be the default profile. Or just choose it from the Profile Manager memory every time (makes it slightly easier to create different profiles to use for different purposes)

     

  2. Use a Linux-native text-editor. There are many to choose from.

     

  3. Most importantly, start practising basic internet hygiene by preventing your browser from running javascript except from sites that you need js for (and either trust or partially trust).

    Most sites work just fine with javascript disabled, or with a bare-minimum of javascript enabled.

    While there are several plugins to do this, IMO the best are:

     

    These are also available for Google Chrome, and the open-source version Chromium.

     

  4. I very strongly recommend using a completely different browser (or at least a different Firefox profile) to access your bank's web site. Even better, create a second login account which you use ONLY for internet banking.

    Most display managers (e.g. lightdm, gdm, kdm, xdm etc) can be configured to start up a second login screen on the same monitor, allowing you to switch back and forth between, e.g., user1 on tty7 and user2 on tty8 with Ctrl-Alt-F7 and Ctrl-Alt-F8 without having to log out.

     

  5. Running a local squid proxy is useful as a second line of defense against ads and other malware. Configure it to block known advertising sites, and then either configure all browsers on your machine/network to use it, or use iptables to do transparent proxying (transparent proxying works well for http, but requires a lot of messing around to get working well with https).

  • I've tried using a new profile, and un-installing all browsers. The same problem occurs with all new installations. – Korky Keef Mar 12 '18 at 0:37
  • @KorkyKeef Do you have a proxy configured in your browser, or in your http_proxy or https_proxy environment variables? Is there any chance your ISP is transproxying your web browsing? BTW. including at least the text of the error message in your question would have been useful. – cas Mar 12 '18 at 1:32
  • No there is not proxy. The error message I get is nonsensical, but here it is: ibb.co/dUWgv7 "The requested URL was rejected. Please consult with your administrator. Your support ID is [long number]." – Korky Keef Mar 12 '18 at 3:00
  • something is intercepting and redirecting your web traffic. the most likely causes are 1. your ISP is transproxying your web requests. 2. your /etc/resolv.conf points to some bogus nameserver. I already saw that URL in your comment to Bixbyte - that's why I asked about proxies, and why i said that it was important info that should have been included in your question. – cas Mar 12 '18 at 3:07
  • I use a UK-based VPN. I haven't got a /etc/resolve.conf file but /etc/resolvconf/resolv.conf.d has three files in it, called tail, head and base respectively. The outer two are empty and the head one has the content "# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN" I'll send a support request to my ISP. – Korky Keef Mar 12 '18 at 3:32
0
  1. Make a copy of your bookmarks and store them as a .json file
  2. Close Firefox
  3. Run in Terminal mode:
  4. Type or copy and paste: rm -r -v ~/.mozilla && rm -r -v ~/.cache/mozilla

Note: you will be asked for your password before this works

Now, import your bookmarks

  • Thank you but that didn't work. I still get the re-direct page in non-native English. ibb.co/dUWgv7 – Korky Keef Mar 12 '18 at 0:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.