Firefox tries to access weird websites each time it starts

[Jerome]

Hello Kaspersky community! Merry Christmas!

I have noticed since yesterday (but maybe it is related to the 95.0.2 Firefox update) that Firefox tries to access some weird websites each time it starts.

The websites Firefox tries to access are various (non-exhaustive list):

• itchytidying.com
• jollytestpartying.com
• dateddeed.com
• censusmiles.com
• unpleasantconcrete.com
• pacifyrespirator.com
• (...)

Kaspersky Internet Security blocks all those access attempts and notifies me with a "Download denied" event and a "Probability of unauthorized software download" message (see image below):

Web Anti-Virus Report

I immediately suspected one of my Firefox extensions, so I disabled them all... But the issue kept on occurring. Could Firefox be infected? I ran Kaspersky Internet Security through my whole PC, and it found nothing.

I find it hard to believe that this behaviour is normal and that these alerts are false positives from Kaspersky Internet Security... What do you think guys?

Here is some information about my system:

• Microsoft Windows 10 Home 21H2 (2021-‎07-‎26 build 19044.1415)
• Mozilla Firefox 95.0.2 (64-bit)
• Kaspersky Internet Security 21.3.10.391 (g)

Regards,
Jerome.

 

 

[Berny]

@Jerome  Welcome.

Please see these important Topics from @richbuff  and @Danila T. 

Link

Link

 

Reset Firefox Settings to Default ?

 

Kaspersky Threat Intelligence Portal is pointing to Adware :
→ https://opentip.kaspersky.com/itchytidying.com/

 

 

 

 

[Jerome]

Thank you @Berny for welcoming me in this forum,

I read the 2 links you gave me and did all the suggested actions.

The issue was still there.

 

For a few minutes I thought I found the culprit (3 shortcuts on the Firefox home page which pointed to torrent websites). I removed the shortcuts and the problem was gone. But when I put the 3 shortcuts back on the Firefox home page, the issue did not occur any more.

 

I do not know what to say. Now that I cannot reproduce the issue, the investigation is over. I just have to wait for it to come back.

Anyway, thank you for your help, and happy Christmas Eve.

[Guest]

I had a similar issue a long time ago and I fixed it by going to settings, and repicked what happens when browser starts up. Probably you downloaded a program that changed your default browser startup page (the startup page in this case prob happens to redirect a lot) - so it’s not a virus, but just a spam software.

[Jerome]

My homepage is (and has always been) the “Firefox Home (Default)”. It is the first thing I have checked. And I have not found anything suspicious in the Firefox settings.

 

I forgot to mention that the 3 potential culprits for this issue (the 3 shortcuts on the genuine Firefox Home that point to torrent sites) are mine. They have not appeared “magically” on the Firefox Home. I put them there in the first place.

 

These kinds of sites regularly change drastically their behaviour (switching between a nearly-normal one to a pop-up-aggressive one full of ads). So it made sense that one of them became very “active”, trying to download stuff without my consent (and - thankfully - being blocked by Kaspersky Internet Security).

 

But this trail apparently was not the good one (since Firefox does not have this issue any more, regardless of me adding or removing those shortcuts on Firefox Home).

 

Investigation unfortunately cannot go on for now (nothing to study, problem vanished).