Spyware Removal for Fedora Core 4

Thanks.  I'll certainly try this when I get to the new machine.

Joe

To avoid this problem in the future...

type this in this URL address using firefox
"about:config"

You'll end up in a "secret" (heh) configuration area for firefox.

open a new tab to this url

http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries

have fun.

Interesting.  The about:config file shows most of the default status entries, and those that I have changed, or am familiar with, the status is "user set".  I didn't see anything that looked like a spy, but this is strange:  Now when I come to Experts Exchange, I still occasionally get the "http://a.tribalfusion.com - University of Phoenix" pop up.  I suppose that EE is getting advertizing money to allow this.  I wonder why FireFox does not block it.

Oh well. . .  If no one else can provide more info, I'll accept the answer in a few days.

Look at the URL (in firefox only) about:config (NO HTTP:// )
In the search bar type "privacy"
Set everything to "FALSE" (toggle right click)
In the one option which is numeric set it to "2"

Firefox's popup blocker doesn't stop popups launched by plugins (for example, Flash movies) by default.

The value of privacy.popups.disable_from_plugins should be changed to 2, meaning that plugins are not allowed to open new windows, and the value of dom.popup_allowed_events is changed to an empty string, which stops all Web page events (such as clicks and form submissions) from launching popups.

This means that some user-initiated popups (the type you generally want) may now be blocked.

You can still whitelist sites that you wish to allow to use popups.

See also a plugin for firefox at:

http://www.4degreez.com/popupsmustdie/

After searching I find:

privacy.popups.firstTime                                      default          boolean           true
privacy.popups.policy                                           default          integer             1
privacy.popups..showBrowserMessage              default          boolean           true
privacy.popups.usecustom                                   default          boolean           true

Please give me more details on your instructions.

Thanks.

privacy.popups.disable_from_plugins

won't show up unless you add the plugin from

http://www.4degreez.com/popupsmustdie/

I didn't bother with it, since only a couple of site use the flash to make popups.

Thanks, the pictures were helpful.  But even after rebooting, going to EE gave me the tribalfusion pop up again.  I then deleted all cookies, including doubleclick and tribalfusion.

Then on going back to EE put one doubleclick and four tribalfusion cookies again appeared.  Are you recommending now that I install the privacy.popups.disable_from_plugins ?  

Next, after removing those five cookies, I clicked on "Don't allow sites that set removed cookies to set future cookies" and the five don't come back.  But, although I see about 12 excite.com cookies, something else has gone wrong.  I receive email, from EE in excite mail, and cannot get to the emails any longer.
I have three other web mail addresses, which work just fine.


The error message is IMAP ERROR: [CLOSED] IMAP connection broken (server respons).  This may be a separate problem, but I can get to excite mail just fine on a WinXP machine.

Oh, and to address the original question (even though it is most likely there is no spyware on your system and the ad was just designed to frighten people) you can use chkrootkit: http://www.chkrootkit.org/  It's kind of like adaware for linux.

I agree with KurtVon, you should install chkroot, it will email the root user of the linux once a day ( i think I set mine to 3 am) a log file of anything that goes one.

btw, when I say email... I mean internal email.
/var/spool/mail/root

You can get Kmail to check this "mbox" and a few others available with linux.

Or... just..

cat /var/spool/mail/root >> $HOME/root.mail

and open with whatever editor you like. (you need to be root (su) and given permission to the user (chmod 777 $HOME/root.mail)

OK I'll work on this tomorrow.  I'm delighted that you guys are so interested.  The Fedora website doesn't respond much.  It's late tonight and I will work on this and get back to you.