Firefox Popping Spam Tabs - Fixing the Malware Infection

Firefox Popping Spam Tabs - Fixing the Malware Infection
Page content

Pop-up Spam Tabs in the Firefox Browser

The Mozilla Firefox browser includes a pop-up blocker to prevent pop-up windows or pop-up tabs from opening without the user’s consent. The pop-up blocker in Firefox has an option to specify which websites are allowed or blocked from displaying pop-up windows. In some cases, the pop-up blocker will fail to block Firefox spam tabs. This is not a bug or issue in the browser, but a problem in the webpage being viewed.

Rogue distributors, hackers or malware creators are using several new techniques to find victims. Some of them will inject a script or code into a webpage or compromised website. The script or code will trigger a new pop-up tab in Firefox which you may or may not be able to close. Others will use legitimate advertisements to inject the malicious scripts that will open a new spam tab. Even good or reputable sites may become victims of a malicious script, if the ad server is not filtered by the account holder or the ad server provider. To get rid of these unwanted pop-up tabs in Firefox, follow the steps in this article.

Solutions for Firefox: Popping Spam Tabs

If a computer is infected with a Trojan that adds a hidden object into Windows, a.k.a rootkit, the only solution to prevent Firefox from displaying pop-up spam tabs is to clean the system with any of the following tools:

  • TDSSKiller - This free tool by Kaspersky will scan and remove the TDSS or Alureon trojan that adds a rootkit onto the computer. If your searches are being redirected, if spam tabs open frequently and if the websites you try to visit are replaced with unwanted websites, TDSSKiller will find the culprit and remove it.
  • Malwarebytes Anti-Malware - MBAM is a free tool to scan and remove many types of malware, including Trojans with rootkit capability.
  • EmsiSoft Anti-Malware - Another free tool to scan and remove many types of viruses or malware or those that can cause pop-up spam tabs in Firefox or any browser.
  • SUPERAntiSpyware - Free scanner and malware remover with enhanced detection of TDSS infections and other types of malware.
  • Hitman Pro - This program is not freeware, but it offers a 30-day trial to find and remove malware. It uses several antivirus engines and virus database to detect infections on the computer. Hitman Pro uses EmsiSoft, PrevX, Dr.Web, Ikarus and G Data to find malicious files and processes in Windows.
  • Windows Malicious Software Removal tool (MRT.exe)- This is a free tool from Microsoft that includes detection of Alureon or TDSS and other types of malicious software that affect hundreds or thousands of computers. Simply type mrt.exe or mrt in the run command/box in Windows to start scanning the computer. If you have an old version, download the latest release from the Microsoft website.

It’s recommended that you run a scan using TDSSKiller, reboot the computer and then run a scan using MBAM, SUPERAntiSpyware, EmsiSoft Anti-Malware or Hitman Pro. This will allow a complete removal of TDSS or Alureon infections and remove other malware that TDSSKiller is not designed to detect.

After the removal of your TDSS or Alureon infection, review the Internet connection settings in Windows and remove any changes made by the malware: Open the Internet options, click on the Connections tab and then the LAN settings button. Uncheck the box before Use a proxy server for your LAN, if you are not actually using a proxy server to connect to the Internet. . Also, ensure that the DNS servers provided by your ISP have not been modified by checking your router settings or your dial-up connection settings.

Finally, ensure that the default Hosts file in Windows is not modified. You can reset the Hosts file to its default by using Microsoft Fix it 50267 solution.

What to Do if TDSSKiller and Other Tools Can’t Solve Spam Tabs in Firefox?

If none of the above free software or trial programs have found infections in Windows, but the pop-up spam tabs in Firefox continue to appear, you are likely infected by a variant of the TDSS or Alureon worm, or you may have a new type of malware infection that is not detected yet by those tools. You should visit a malware removal forum that will analyze your computer’s status by viewing the scan log you can provide. Visit AUMHA or BleepingComputer to receive free malware removal help.

Image credit: Firefox logo from