Firefox Keeps Sending Me to the Wrong Link

Malware can cause Firefox, and other browser types, to show the wrong Web page.

Firefox, like other Web browsers, sometimes becomes infected by malicious software. The signs that malware is operating on a browser include the overriding of a pop-up blocker to show ads in pop-up windows, Other signs include the browser opening tabs spontaneously, showing unrequested pages and going to unrelated Web pages when you click on a link or enter an address in the address field.

Adware

Adware is a form of malware that exists solely to drive users towards advertisements. The redirection of Web addresses when you click a link is the classic sign of malicious adware operating in secret on your computer. Adware rarely damages a computer, but it will repeatedly lead the browser to show pages of its choice irrespective of what you want to see.

Purpose

Adware makes money for its distributors, who charge sites for driving traffic to them. Adware is often combined with spyware, which monitors the computer's usage and the user's Web surfing habits and reports back to the controller. This information is either sold as market analysis or is used to tailor the ads that the adware redirects to.

Delivery

Unwanted adware gets onto a computer by two methods. Viruses can exploit security weaknesses in your computer and use loopholes in networking software to get onto a computer. Firewalls and anti-virus software have become very efficient at blocking viruses, so the distributors of adware have turned to trojans, which encourage users to override the security features on their computers, download the program and install it. If the user knew that the package involved malware, the programs wouldn't stand much chance of getting onto a computer, and so the distributors invent false utilities and then offer these for free to users, who then downloads the program -- only to find that their browser starts to behave erratically.

Precautions

Firefox offers add-ons and plug-ins to increase and improve the browser's capabilities -- but these are also a popular hiding place for adware, which often use the name of legitimate add-ons. Firefox users report that deleting the XULRunner add-on, the “Google Toolbar for Firefox” and the “Java Console 1.0” add-on removes the problem of unwanted redirection. Adware sometimes changes the name it hides under, and so a sequential deletion of all add-ons should reveal what name the adware is using.

References

• Symantec; An Offer Too Good to Refuse, Courtesy of Vundo; Hon Lau; May 2010
• Symantec: Backdoor.Tidserv
• Microsoft Malware Protection Center: Virus:Win32/Alureon.H
• Spillspace; New Firefox Virus Causes Redirects to Adsites; February 2009