Filezilla-Bing hijack of homepage

[MilesbeforeIsleep]

There was a recent update to Filezilla, which I use for transferring image files to Alamy.   I made a mistake and ended up with a server update instead of client, so I uninstalled, re-downloaded, and re-installed Filezilla client.    Apparently the Filezilla download contained a virus which caused BING to become my default homepage.   I say only "apparently" because I have no hard proof, but the Filezilla download was the only change I made to the computer. 

 

This is just a heads-up in case others run into this problem. 

--Michael

[Brian Yarvin]

This is a very unlikely - but not impossible - series of events. Let's see what we can see ...

 

First, since Filezilla doesn't have a "default homepage," you must be talking about some other software, most likely a browser. (Which always has a default homepage.) If a "virus" has changed it, test this. Change the homepage to something else and check it. An actual virus would change it back. Remove all the add-ins and extensions from the browser and see if it still changes the homepage to Bing. 

 

Next, check to see if that Bing page actually is Bing and not some other phishing page. This too, would be a sign of either a virus or hijacking. While a switch of homepages to a clean search engine is possible, it's unlikely. 

 

Then check to see if you didn't get an automatic browser update of some sort. This is the most likely source of a switch to the actual Bing site. If your browser is Edge, than this is even more likely.

 

Keep us posted!

[MilesbeforeIsleep]

Hi Brian, thanks for the response.

 

Here's the scoop, as I see it: https://www.bleepingcomputer.com/news/security/filezillas-use-of-bundled-offers-sparks-outrage-from-users/

Discussion of BING is part way down the page.

 

During the download, I saw a checked option for some software (not Bing), and unchecked it.  It's possible I missed another one.  See how they have it embedded in the privacy policy agreement. 

 

Thus far, I have not had the home page change recur, after changing back to my default of NOTHING.

If it does, may have to do further work.

 

 

--Michael

 

P.S.:   So this is not a virus, but maybe called unwanted "adware"?

[Brian Yarvin]

Your link is very interesting, but not very surprising, reading. I would suggest that in the future, you never leave your default home page blank. For that matter, always select your search engine too. 

 

The only thing that puzzles me about it is why I've never seen such a menu. I've been using Filezilla for at least five years and forced an upgrade this morning in order to see if I could find the offending check boxes. Are you using Filezilla as a stand-alone or extension?

 

As for what it is - if it buries itself in your registry and keeps making changes, it's a virus, no matter what its defenders want you to think. If not, I can live with the name "adware" and suggest that you do the same. Whatever you call it though, make sure its gone. 

[MilesbeforeIsleep]

Brian,  it didn't come with an update or upgrade, but with a fresh install from: https://filezilla-project.org  

 I do have a  selected search engine.   See no need to have a default home page.  Prefer it opens just to the Firefox page, with links to recently opened sites.

 

Enjoy your pics from PA.   My wife and I visit northern PA, usu. every year.  She went to High School in Smethport, on US 6.  Love that area, and managed to get some pics this year..

--Michael

[Brian Yarvin]

Michael, this is good detective work. I am always very suspicious of Bing. It can be itself, or it can be part of a mess of malware that can keep you awake for months. Leaving a default blank in Firefox can make it more difficult to see malware-induced changes when they occur. Adding a default setting puts you in control of one more of the many thousands of variables that you are up against. 

 

It appears that I've never seen this malware because I don't use Firefox. Chrome and Vivaldi seem to be able to block it. Or maybe it's how I have my defaults set. Or maybe it's something else. Just be careful out there!

 

Thank you for the kind words. I've been exploring Pennsylvania for decades and now live in the heart of Lancaster Amish Country. 

[Simon]

I did read some time ago that some downloads of Filezilla had some potential malware in it. I changed to Cyberduck.  Virustotal is a good site to go and check any potential download before you install it, as it submits to multiple engines.

[MilesbeforeIsleep]

On 10/13/2018 at 06:01, Simon said:

I did read some time ago that some downloads of Filezilla had some potential malware in it. I changed to Cyberduck.  Virustotal is a good site to go and check any potential download before you install it, as it submits to multiple engines.

 

Thanks, Simon.   As far as I can tell, it wasn't seriously damaging.  Just changed my homepage and my search engine to Bing!.  Once I changed them back to my preferences, there were no recurrences.  It is quite annoying---to me, at least.  On a par with spam phone calls--though, at least with spam calls I  can retaliate a bit.

 

I'll look at cyberduck.

 

Michael

[Starsphinx]

13 minutes ago, MilesbeforeIsleep said:

 

 at least with spam calls I  can retaliate a bit.

 

I'll look at cyberduck.

 

Michael

2

Our household had several months of fun with spam phone calls - we took to answering them with "Operation cornflower ID please" - and you could hear the panicked pause before the phone was put down. 
Unfortunately, after a while, some more persistent telesales people started talking back.
Time to think of a new wheeze.

[MilesbeforeIsleep]

3 minutes ago, Starsphinx said:

Our household had several months of fun with spam phone calls - we took to answering them with "Operation cornflower ID please" - and you could hear the panicked pause before the phone was put down. 
Unfortunately, after a while, some more persistent telesales people started talking back.
Time to think of a new wheeze.

I used several when I had my woodworking business:  Caller: "Can I speak to _______?"  Me:  "I'm sorry, Mr. ____ just committed suicide in the lobby.  Would you like to speak to his widow?"