Are the folks at Firefox aware that the bitcoinminerplugin on their site is a trojan that takes over Firefox, redirecting all browsing to the bmp webpage?
I downloaded the plugin from your site, and within a day Firefox was rendered useless by redirecting all my attempts at browsing to the BitCoinMinerPlugin webpage. I know that banking Trojans are a problem, but I trusted Mozilla, and had no idea that your site had been hacked. I've uninstalled Firefox, and hope you have some ideas on how to proceed - I really don't want to continue using IE as my browser. All Best, ~ Khem Caigan <Khem@ZAPGARDEN.com>
All Replies (9)
What plugin did you install? There are no bitcoin miner viruses from Mozilla's products, so I'm wondering where you installed this from?
If you'd like we can help you continue using Firefox, try scanning your Computer for malware first, Troubleshoot Firefox issues caused by malware
Is it https://addons.mozilla.org/en-US/firefox/addon/bitcoin-mining-software/ that you installed?
First, this is an extension developed by a third-party, not Mozilla, it hasn't passed full review (hence the warning) and it has low reviews. I'd suggest installing Firefox again and just don't install that add-on.
I am very sorry that you had problem with a add-on that is hosted at AMO. https://addons.mozilla.org/en-US/firefox/addon/bitcoin-mining-software/ And will probably never get beyond that with 3 poor reviews.
Currently that extension is on "preliminary review" status, which should have caught any "security" issues in the code. https://addons.mozilla.org/en-US/faq#preliminary
I will file a Bug report to request that this extension be pulled from the AMO website. Quite honestly I feel that extension has been abandoned by the developer - the http://bitcoinminerplugin.com/ website domain name appears to be expired, with the "Sponsored Listings" sitting there.
But I am concerned about this statement of yours - "redirecting all browsing to the bmp webpage".
Did you mean http://bitcoinminerplugin.com/ ? If so, after reading the "Privacy Policy" for that extension, I think I know why that would be happening - "When you visit bitcoinminerplugin.com, Bitcoin Miner Extensions Web servers automatically collect and store limited information about your computer's connection to the Internet." - so if that website doesn't exist any longer it can't communicate with the web server that collects that information.
My advice is to uninstall that extension and see if that "redirect to the bmp webpage" webpage stops. If not, "we" got some more work to do.
Just an update, that extension got blocked about 5 minutes ago :)
Bitcoin Mining Software has been blocked for your protection. https://addons.mozilla.org/en-US/firefox/blocked/i640
Thank you. And I just got finished posting a request to do that at the AMO support website!
I type too damn slow ... Just saw that Tyler posted while I was sussing out that extension and didn't see that he had "found" that extension already.
Hi - Thanks to everyone who replied! I am downloading the tools recommended on your forum (Malwarebytes, TDSS anti-rootkit, &tc. and will give my Win7 laptop a good "scrub" before re-installing the latest Firefox. I'll be in touch about the results. I realize that Mozilla is not in any way responsible for the bitcoinminerplugin gizmo - just wanted to be sure that y'all know how drastic the effect of it is on the functioning of Firefox. And I sincerely hope the behavior of bmp / bitcoinminerplugin is the result of a malfunction instead of malicious intent. All of the Best, - Khem Caigan (Khem@ZAPGARDEN.com)
Hello again - I 'scrubbed' my laptop and reinstalled Firefox. Lo and behold, the bitcoinminerplugin appeared in the upper right-hand side of the toolbar, doing its imitation of the Dow Index. I quickly hit the Menu button, and proceeded to Reset Firefox to its Default State. So far, so good. Thanks again, and All of the Best, - Khem Caigan