I recently found a suspicious entry while browsing my Firefox history data that clearly was a site no one using the computer had visited. I clicked the link to see where it might lead and was prompted to install what was obviously a virus onto my local drive.

That was a new one for me. Being in the computer industry for most of my adult life has naturally exposed me to a number of clever methods for virus and spyware attacks but I’ve never seen a virus attempt to gain a foothold by installing itself an entry into the browser history.

Firefox stores the history data in a file appropriately called “history.dat”; this file can be found in the Firefox Profile folder (XP users, something like this location: “C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\h96641qz.default\history.dat“).

Opening this file in a text editor reveals the MORK file format used by Mozilla which of course doesn’t reveal much to our human eyes. I needed more information about the history entry than this file or even the history sidebar revealed.

Fortunately I somehow stumbled across a simple and lightweight program called DORK which converts the MORK formatted history.dat file into a human readable tab delimited file. Click here to download DORK.

For those that are interested I never did discover how the history entry was added to my data file. It was most likely triggered by a “Pop-Under” window that stayed open just long enough to register itself as an entry. If something like this rears its head again hopefully there will be more information on the net about it and I can dig deeper.

Until then, I’ll continue to keep my system as protected and as clean as possible with free programs and utilities like these:

• Spyware Terminator (free anti-spyware detection)
• Avast (free anti-virus protection)