socopoco search engine hijack on Firefox linux
I have inadvertently installed the socopoco search engine malware. If I remove it, it reappears. There is information on the web about how to remove it on Windows machines, but I can't find anything for Linux. It has also infected all my machines, and I am wondering if it is now attached to synch. Any ideas about how to remove it from a linux machine?
Chosen solution
This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.
Read this answer in context 👍 0All Replies (4)
Do you have this add-on which takes over the new tab:
https://addons.mozilla.org/firefox/addon/socopoco/
You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:
- Ctrl+Shift+a (Mac: Command+Shift+a)
- "3-bar" menu button (or Tools menu) > Add-ons
- type or paste about:addons in the address bar and press Enter/Return
In the left column of the Add-ons page, click Extensions.
Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).
You might also need to reset your default search engine on the Preferences page: Change your default search settings in Firefox
Success?
No. Unfortunately (??) I never installed the add-on and it doesn't appear there. It appears in the "One-Click Search Engines", and removing it doesn't work.
Chosen Solution
This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.
dreidpath said
No. Unfortunately (??) I never installed the add-on and it doesn't appear there.
Do you have any unknown extensions?
It appears in the "One-Click Search Engines", and removing it doesn't work.
When does it come back? For example, when you Quit Firefox and start it up again (next session), or when you shut down and restart your system, or at some other interval?
Could you check for a possible alien script in the Firefox program directory. I'm not quite sure where you'll find it on Linux, but it's the folder the the Firefox application starts from. Look for either of these folders:
- firefox/defaults/pref
- firefox/browser/defaults/pref
It's normal to find a file named channel-prefs.js with a few comment lines at the top and then a command like this:
pref("app.update.channel", "release");
If you find any other files at all, that would be suspicious. Remove them to some other location for analysis, or delete them.