This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

socopoco search engine hijack on Firefox linux

more options

I have inadvertently installed the socopoco search engine malware. If I remove it, it reappears. There is information on the web about how to remove it on Windows machines, but I can't find anything for Linux. It has also infected all my machines, and I am wondering if it is now attached to synch. Any ideas about how to remove it from a linux machine?

I have inadvertently installed the socopoco search engine malware. If I remove it, it reappears. There is information on the web about how to remove it on Windows machines, but I can't find anything for Linux. It has also infected all my machines, and I am wondering if it is now attached to synch. Any ideas about how to remove it from a linux machine?

Chosen solution

This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.

Read this answer in context 👍 0

All Replies (4)

more options

Do you have this add-on which takes over the new tab:

https://addons.mozilla.org/firefox/addon/socopoco/

You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

  • Ctrl+Shift+a (Mac: Command+Shift+a)
  • "3-bar" menu button (or Tools menu) > Add-ons
  • type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions.

Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).

You might also need to reset your default search engine on the Preferences page: Change your default search settings in Firefox

Success?

more options

No. Unfortunately (??) I never installed the add-on and it doesn't appear there. It appears in the "One-Click Search Engines", and removing it doesn't work.

more options

Chosen Solution

This is now resolved. The problem was with a benignly named Add-On I had installed (Force PDF Download). The add-on checks for and re-installs the socopoco search engine in the One-Click Search Engines.

more options

dreidpath said

No. Unfortunately (??) I never installed the add-on and it doesn't appear there.

Do you have any unknown extensions?

It appears in the "One-Click Search Engines", and removing it doesn't work.

When does it come back? For example, when you Quit Firefox and start it up again (next session), or when you shut down and restart your system, or at some other interval?


Could you check for a possible alien script in the Firefox program directory. I'm not quite sure where you'll find it on Linux, but it's the folder the the Firefox application starts from. Look for either of these folders:

  • firefox/defaults/pref
  • firefox/browser/defaults/pref

It's normal to find a file named channel-prefs.js with a few comment lines at the top and then a command like this:

pref("app.update.channel", "release");

If you find any other files at all, that would be suspicious. Remove them to some other location for analysis, or delete them.