Firefox keeps opening tabs with ads

January 11, 2022 12:48 PM

Once or twice a day, two tabs pop up unprompted showing ads for "manlyz dot com" and "ebetaca dot com."

I think it's the most updated version of Firefox (91.5.0). I'm using a Macbook Air mid 2012- Mojave. It's been going on for months. I have googled this multiple times. I have completely uninstalled and reinstalled Firefox multiple times. The only Firefox extensions I use are Ublock Origin and Windscribe (Windscribe is disabled unless I am using it). It never happens on Chrome (I use both Chrome and Firefox every day and usually simultaneously).

Does this sound familiar to anyone or any advice on the next steps I can take?

posted by aralymn to Computers & Internet (9 answers total)

Best answer: I googled for other people also getting pop-ups from those particular sites, and there were a number of people on Macs, using Safari instead of FF. If you have the same problem they do, then indeed it's not a firefox problem but a malware that launches pop-ups from the default browser no matter which.

So, I'm in agreement with the above comment: you likely have malware.

At least one person was cured by Malwarebytes, which is a great place to start:

https://www.malwarebytes.com/mac
posted by Sunburnt at 1:04 PM on January 11, 2022 [6 favorites]

Response by poster: I looked at my history, and there is no one common site before the popups. If anything, it's common sites like twitter or youtube.

I also downloaded Malwarebytes. It restarted my computer and says it's "protected" (during the 14 day trial). It detects threats and "quarantines" them - but how do I delete them permanently?
posted by aralymn at 1:34 PM on January 11, 2022

Best answer: This is 100% malware. Run an anti-malware program. I can vouch for Malwarebytes, linked above. Unobtrusive, does the job, and doesn't annoy me constantly with "important" updates.
posted by fight or flight at 1:34 PM on January 11, 2022 [1 favorite]

Best answer: Just saw the update -- in Malwarebytes, go to the Detection History and you can select the harmful files to be deleted. But once the program has quarantined them, they can't harm your computer, so you don't absolutely need to delete them unless it would make you feel better.

The malware could have arrived in a downloaded file or by clicking some rogue element of an email. Keep Malwarebytes going and it'll deal with any future threats.
posted by fight or flight at 1:36 PM on January 11, 2022

Response by poster: Okay! I found Detection History and deleted the files, so hopefully that has solved it!

fight or flight, do you know if this would be the end of it or do I *have* to keep Malwarebytes going?
posted by aralymn at 1:53 PM on January 11, 2022

do you know if this would be the end of it or do I *have* to keep Malwarebytes going?

In my experience using Malwarebytes in IT, it is very good at cleaning up problems and doesn't need to be constantly run, however it's good housekeeping to run it periodically so that you don't only run it when you see a problem.
posted by AzraelBrown at 2:48 PM on January 11, 2022 [1 favorite]

Also unfortunately, MacOS Mojave is currently out of support by Apple and they aren't fixing any new security vulnerabilities. On the operating system level, it is only going to be worse. You should try to upgrade your operating system soon if possible.
posted by meowzilla at 2:49 PM on January 11, 2022 [2 favorites]

If you're asking if you have to keep it installed: I would, given your OS' above stated vulnerabilities. The free version is limited but it can do a decent job, though I would suggest it's worth paying for (I do) to have the peace of mind. FWIW it's the only security software I pay for and I haven't had a problem for years even though I often engage in.. let's say less than scrupulous activities insofar as what I download.

But it may be easier/cheaper for you to just upgrade your OS and hope nothing else happens, so ymmv on that one.
posted by fight or flight at 4:08 PM on January 11, 2022

You are also five versions of Firefox behind, as today (January 11), v96.0 became available (for 10.12 and up).
posted by channaher at 5:38 PM on January 11, 2022