123.SOGOU.COM - trojan horse in ukui-screensaver

Question

Firefox's default page is 123.sogou.com and I can't remove it. I've tried to reset and re-install it, but it keeps going back to sogou.

Answer 1

I just installed Ubuntu 17.10. Screensaver was not going on, then I went to Software Center and installed the first screensaver I got in search result. It led to set Firefox's default page as 123.sogou.com. I didn't imagine it was due to the screensaver util I read the post http://www.gabrielemerli.com/?p=3381. I tried to remove Firefox and all config files and cache, still dammed sogou was there. After reading the post from Gabriele, I remove the screensaver ukui-screensaver and also ubuntukylin-default-settings. Here is what I did to restore Firefox defaults.

$ sudo apt-get remove ukui-screensaver 
$ sudo apt-get remove ubuntukylin-default-settings 
$ sudo apt-get remove firefox 
$ rm -rf ~/.config/mozilla
$ rm -rf ~/.cache/mozilla
$ sudo rm /etc/apt/sources.list.d/ubuntukylin.list
$ sudo rm /etc/apt/sources.list.d/ubuntukylin.list.save
$ sudo apt autoremove
$ sudo apt-get autoclean 
$ sudo apt update
$ sudo apt-get install firefox 

Answer 2

I'm the member of Ubuntu Kylin, and I'm sorry for bring your the trouble, I will fix this in next release. And now you can:

$ sudo rm  /usr/lib/firefox/defaults/pref/all-ubuntukylin.js
$ sudo rm /usr/lib/firefox/ubuntukylin.cfg

Then edit homepage in about:preferences, and reboot.

Answer 3

I had the same issue and removing everything with "kylin" in it resolved the issue. I have no idea how it found its way in my system:

Just list them:

apt list --installed | grep -i kylin

Then install everything you see in that list. This is probably a cleaner way to get rid of it rather than deleting files individually.