Autofill sugestions of strange usernames and emails I do not know.
When I go to any website to log in, I click in the box to enter my user name or email and there are names and emails of people I don't know, who are not in my contacts, and I have never received any contact (phone or email) from them. I am not logged in, not syncing, and have never set up a Mozilla account until needing to ask this question.
WTF is going on? Have I been hacked? Who are these people and how is there info stored in my browser?
(I know how to delete them from the drop down list. My question is how did they get there and how to make sure it doesn't happen again.)
All Replies (12)
Here is the text from about:support Application Basics
Name: Firefox Version: 94.0.1 Build ID: 20211103134640 Distribution ID: Update Channel: release User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 OS: Windows_NT 10.0 19043 Launcher Process: Enabled Multiprocess Windows: 1/1 Fission Windows: 0/1 Disabled by default Remote Processes: 12 Enterprise Policies: Inactive Google Location Service Key: Found Google Safebrowsing Key: Found Mozilla Location Service Key: Found Safe Mode: false
Crash Reports for the Last 3 Days
Firefox Features
Name: Add-ons Search Detection Version: 1.0.1 ID: addons-search-detection@mozilla.com
Name: DoH Roll-Out Version: 2.0.0 ID: doh-rollout@mozilla.org
Name: Firefox Screenshots Version: 39.0.1 ID: screenshots@mozilla.org
Name: Form Autofill Version: 1.0.1 ID: formautofill@mozilla.org
Name: Picture-In-Picture Version: 1.0.0 ID: pictureinpicture@mozilla.org
Name: Proxy Failover Version: 1.0.2 ID: proxy-failover@mozilla.com
Name: Reset Search Defaults Version: 2.1.0 ID: reset-search-defaults@mozilla.com
Name: Web Compatibility Interventions Version: 27.1.0 ID: webcompat@mozilla.org
Name: WebCompat Reporter Version: 1.4.2 ID: webcompat-reporter@mozilla.org
Remote Features
bug-1680034-rollout-shirley-feature-roll-out-81-to-83-release-81-83: active bug-1690367-rollout-moving-webrtc-networking-functionality-into-i-release-87-100: active bug-1693420-rollout-sponsored-top-sites-rollout-release-84-100: active bug-1712189-rollout-keep-firefox-up-to-date-even-when-it-is-not-ru-release-90-94: active rollout-doh-us-staged-rollout-to-all-us-desktop-users-release-73-77-bug-1586331: active rollout-increasing-normandy-skew-out-changes-from-15-m-release-73-75-bug-1616898: active rollout-monitor-v2-1505837: active rollout-webrender-release-67-1541488: active
Remote Processes
Type: Web Content Count: 8 / 8
Type: Extension Count: 1
Type: Privileged About Count: 1
Type: GPU Count: 1
Type: Socket Count: 1
Add-ons
Name: Amazon.com Type: extension Version: 1.3 Enabled: true ID: amazondotcom@search.mozilla.org
Name: Bing Type: extension Version: 1.3 Enabled: true ID: bing@search.mozilla.org
Name: DuckDuckGo Type: extension Version: 1.1 Enabled: true ID: ddg@search.mozilla.org
Name: eBay Type: extension Version: 1.3 Enabled: true ID: ebay@search.mozilla.org
Name: Google Type: extension Version: 1.1 Enabled: true ID: google@search.mozilla.org
Name: Keywords Everywhere - Keyword Tool Type: extension Version: 10.12 Enabled: true ID: jid1-PmuMUcuMey5ABw@jetpack
Name: Wikipedia (en) Type: extension Version: 1.1 Enabled: true ID: wikipedia@search.mozilla.org
Name: S3.Translator Type: extension Version: 6.19 Enabled: false ID: s3google@translator
Security Software
Type: ESET Security
Type:
Type: ESET Firewall
Graphics
Features Compositing: WebRender Asynchronous Pan/Zoom: wheel input enabled; scrollbar drag enabled; keyboard enabled; autoscroll enabled; smooth pinch-zoom enabled WebGL 1 Driver WSI Info: EGL_VENDOR: Google Inc. (NVIDIA) EGL_VERSION: 1.5 (ANGLE 2.1.15727 git hash: 23851a53779d) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_d3d_texture_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_ANGLE_direct_composition EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_get_all_proc_addresses EGL_KHR_stream EGL_KHR_stream_consumer_gltexture EGL_NV_stream_consumer_gltexture_yuv EGL_ANGLE_flexible_surface_compatibility EGL_ANGLE_stream_producer_d3d_texture EGL_ANGLE_create_context_webgl_compatibility EGL_CHROMIUM_create_context_bind_generates_resource EGL_CHROMIUM_sync_control EGL_EXT_pixel_format_float EGL_KHR_surfaceless_context EGL_ANGLE_display_texture_share_group EGL_ANGLE_display_semaphore_share_group EGL_ANGLE_create_context_client_arrays EGL_ANGLE_program_cache_control EGL_ANGLE_robust_resource_initialization EGL_ANGLE_create_context_extensions_enabled EGL_ANDROID_blob_cache EGL_ANDROID_recordable EGL_ANGLE_image_d3d11_texture EGL_ANGLE_create_context_backwards_compatible EGL_KHR_create_context_no_error EGL_KHR_reusable_sync EGL_EXTENSIONS(nullptr): EGL_EXT_client_extensions EGL_EXT_device_query EGL_EXT_platform_base EGL_EXT_platform_device EGL_ANGLE_platform_angle EGL_ANGLE_platform_angle_d3d EGL_ANGLE_platform_angle_d3d11on12 EGL_ANGLE_device_creation EGL_ANGLE_device_creation_d3d11 EGL_ANGLE_experimental_present_path EGL_KHR_client_get_all_proc_addresses EGL_KHR_debug EGL_ANGLE_explicit_context EGL_ANGLE_feature_control IsWebglOutOfProcessEnabled: 1 WebGL 1 Driver Renderer: Google Inc. (NVIDIA) -- ANGLE (NVIDIA, NVIDIA GeForce GTX 1050 Ti Direct3D11 vs_5_0 ps_5_0, D3D11-27.21.14.6280) WebGL 1 Driver Version: OpenGL ES 2.0.0 (ANGLE 2.1.15727 git hash: 23851a53779d) WebGL 1 Driver Extensions: GL_ANGLE_base_vertex_base_instance GL_ANGLE_client_arrays GL_ANGLE_depth_texture GL_ANGLE_explicit_context GL_ANGLE_explicit_context_gles1 GL_ANGLE_framebuffer_blit GL_ANGLE_framebuffer_multisample GL_ANGLE_get_serialized_context_string GL_ANGLE_get_tex_level_parameter GL_ANGLE_instanced_arrays GL_ANGLE_lossy_etc_decode GL_ANGLE_memory_size GL_ANGLE_multi_draw GL_ANGLE_multiview_multisample GL_ANGLE_pack_reverse_row_order GL_ANGLE_program_cache_control GL_ANGLE_provoking_vertex GL_ANGLE_request_extension GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_ANGLE_texture_usage GL_ANGLE_translated_shader_source GL_CHROMIUM_bind_generates_resource GL_CHROMIUM_bind_uniform_location GL_CHROMIUM_color_buffer_float_rgb GL_CHROMIUM_color_buffer_float_rgba GL_CHROMIUM_copy_compressed_texture GL_CHROMIUM_copy_texture GL_CHROMIUM_lose_context GL_CHROMIUM_sync_query GL_EXT_EGL_image_external_wrap_modes GL_EXT_blend_func_extended GL_EXT_blend_minmax GL_EXT_color_buffer_half_float GL_EXT_debug_label GL_EXT_debug_marker GL_EXT_discard_framebuffer GL_EXT_disjoint_timer_query GL_EXT_draw_buffers GL_EXT_draw_elements_base_vertex GL_EXT_float_blend GL_EXT_frag_depth GL_EXT_instanced_arrays GL_EXT_map_buffer_range GL_EXT_multisampled_render_to_texture GL_EXT_occlusion_query_boolean GL_EXT_read_format_bgra GL_EXT_robustness GL_EXT_sRGB GL_EXT_shader_texture_lod GL_EXT_texture_compression_bptc GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_rgtc GL_EXT_texture_compression_s3tc_srgb GL_EXT_texture_filter_anisotropic GL_EXT_texture_format_BGRA8888 GL_EXT_texture_rg GL_EXT_texture_storage GL_EXT_unpack_subimage GL_KHR_debug GL_KHR_no_error GL_KHR_parallel_shader_compile GL_KHR_robust_buffer_access_behavior GL_NV_EGL_stream_consumer_external GL_NV_fence GL_NV_pack_subimage GL_NV_pixel_buffer_object GL_OES_EGL_image GL_OES_EGL_image_external GL_OES_compressed_EAC_R11_signed_texture GL_OES_compressed_EAC_R11_unsigned_texture GL_OES_compressed_EAC_RG11_signed_texture GL_OES_compressed_EAC_RG11_unsigned_texture GL_OES_compressed_ETC2_RGB8_texture GL_OES_compressed_ETC2_RGBA8_texture GL_OES_compressed_ETC2_punchthroughA_RGBA8_texture GL_OES_compressed_ETC2_punchthroughA_sRGB8_alpha_texture GL_OES_compressed_ETC2_sRGB8_alpha8_texture GL_OES_compressed_ETC2_sRGB8_texture GL_OES_depth24 GL_OES_depth32 GL_OES_draw_elements_base_vertex GL_OES_element_index_uint GL_OES_fbo_render_mipmap GL_OES_get_program_binary GL_OES_mapbuffer GL_OES_packed_depth_stencil GL_OES_rgb8_rgba8 GL_OES_standard_derivatives GL_OES_surfaceless_context GL_OES_texture_border_clamp GL_OES_texture_float GL_OES_texture_float_linear GL_OES_texture_half_float GL_OES_texture_half_float_linear GL_OES_texture_npot GL_OES_texture_stencil8 GL_OES_vertex_array_object GL_WEBGL_video_texture WebGL 1 Extensions: ANGLE_instanced_arrays EXT_blend_minmax EXT_color_buffer_half_float EXT_float_blend EXT_frag_depth EXT_shader_texture_lod EXT_sRGB EXT_texture_compression_bptc EXT_texture_compression_rgtc EXT_texture_filter_anisotropic MOZ_debug OES_element_index_uint OES_fbo_render_mipmap OES_standard_derivatives OES_texture_float OES_texture_float_linear OES_texture_half_float OES_texture_half_float_linear OES_vertex_array_object WEBGL_color_buffer_float WEBGL_compressed_texture_s3tc WEBGL_compressed_texture_s3tc_srgb WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_depth_texture WEBGL_draw_buffers WEBGL_lose_context WebGL 2 Driver WSI Info: EGL_VENDOR: Google Inc. (NVIDIA) EGL_VERSION: 1.5 (ANGLE 2.1.15727 git hash: 23851a53779d) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_d3d_texture_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_ANGLE_direct_composition EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image
Firefox can provide 3 types of suggestions:
- Form history
- Address autofill (in the U.S., possibly a few other countries)
- Saved logins
It sounds like these are Form history entries. Normally there wouldn't be form history if you didn't generate it yourself, unless you are on a shared computer. You can confirm whether it is Form history by disabling form history and then testing sites where you have this problem:
- Windows: "3-bar" menu button (or Tools menu) > Settings (previously "Options")
- Mac: "3-bar" menu button (or Firefox menu) > Preferences
- Linux: "3-bar" menu button (or Edit menu) > Preferences
- Any system: type or paste about:preferences into the address bar and press Enter/Return to load it
In the left column, click Privacy & Security, and on the right side, scroll down to the History section.
Select Firefox will: Use custom settings for history to reveal specific checkboxes
Uncheck the box for "Remember search and form history"
Does that stop the weird suggestions from appearing?
I am not on a shared computer. I have never entered or seen these names or emails. Ever. They are not in my saved passwords and there is no reason for them to be there. Most recently, this happened on the Zappos website after establishing an account and attempting to order shoes. Bill-Mostier@gmail.com pops up the minute I click in the username box (as well as MY legit accounts). I don't know who this is or why they are there. I searched all my email accounts. Not a contact and not anyone I know.
I've already deleted this one and two others from the drop down by clicking on the name and holding down the mouse key while pressing "delete" on keyboard.
I just want to know HOW they got there if I am the only user, never use unknown/public access. Having a security issue is my primary concern, but Eset scans to not find any problem.
Additionally, I've recently noticed a command prompt box that launches within a few minutes of me waking/turning on my computer. This is new. I'm paranoid as hell. I need this computer to be secure.
By the way, thank you for your prompt reply and assistance!
Suggestions in a login drop down list that have a key icon in front are login suggestions that you need to remove in the Lockwise Password Manager. Suggestions in a drop down list without a key symbol are autocomplete saved form data.
Suggestions without a key icon are part of autocomplete saved form data that you should be able to remove by selecting this item with the cursor Down key and pressing Delete (Mac: Shift+Delete).
emjayess1 said
Most recently, this happened on the Zappos website after establishing an account and attempting to order shoes. Bill-Mostier@gmail.com pops up the minute I click in the username box (as well as MY legit accounts). I don't know who this is or why they are there.
I would be very alarmed myself. But did you turn off form history so you can tell whether that email address came from form history, or is coming from some other source?
I already deleted it. Not able to test this theory.
This is not the first time this has happened, so I'll monitor it and see if it happens again.
For the life of me though, I just don't understand how something can populate my autofill if I've never typed or seen the contact info before.
Years ago I walked by my daughter's computer (2AM) and saw someone was operating it remotely. They were downloading a lot of files and installing them. I unplugged the internet and had someone come in to clean it (all of our computers) and view the files.
Ever since, I've been paranoid as hell about my computer. Now I see a random email and unknown user names and I automatically think of that incident with the other computer.
Yes, I agree you should be concerned.
To see what is in form history, you can view the contents of a file in your Firefox profile folder. This takes a few steps:
(1) Open the Troubleshooting Information page. We'll use this to copy/paste the profile path in a later step.
Either
- "3-bar" menu button > Help > More Troubleshooting Information
- (menu bar) Help > More Troubleshooting Information
- type or paste about:support in the address bar and press Enter
In the first table on the page, there will be a Profile Folder row. Select and copy the path starting from C:\Users\ to the end (unique profile name)
(2) Open an online SQLite database browser. I've used both of these and think the first one is a bit easier:
(3) Click the link/button to load a database. This should pop up a Windows browsing dialog.
Paste the path you previously copied and press Enter to point Firefox to that folder.
Select formhistory.sqlite and click the Open button (or double-click formhistory.sqlite and Windows may handle the Open button automatically).
(4) Switch the table to moz_formhistory to list out its contents. Here's an example (I only use form history for testing, so disregard my weird data):
(5) For extra credit, you can use a custom query to convert the dates. Paste the following into the query box to the left of the Execute button, then click that button:
SELECT id, fieldname, value, timesUsed, DATE(ROUND(firstUsed / 1000000), 'unixepoch') AS SavedOn, DATE(ROUND(lastUsed / 1000000), 'unixepoch') AS LastUsed FROM 'moz_formhistory' ORDER BY lastUsed DESC
Do the dates associated with unexpected entries ring a bell in any way?
I am having the same problem. The same unknown name pops up in autofill now on several sites. There is no link button as suggested in item (3) from 11/8 so I cannot go further. Logins and Passwords, and Forms and Autofill do not have this unknown name. I am concerned about how it got there and if my computer is compromised. Thank you for your help.
sheri.baucom said
The same unknown name pops up in autofill now on several sites. There is no link button as suggested in item (3) from 11/8 so I cannot go further. Logins and Passwords, and Forms and Autofill do not have this unknown name.
So the most likely source sounds like Form History in that case. Was that the one you couldn't turn off?
You can rename/remove formhistory.sqlite in the Firefox profile folder with Firefox closed to reset all saved form data. Note that saved form data isn't website specific, but merely looks at the name/id of the field, so in case of common names you can see a suggestion on a lot of webpages.
You can use the button on the "Help -> More Troubleshooting Information" (about:support) page to go to the current Firefox profile folder or use the about:profiles page (Root directory).
- Help -> More Troubleshooting Information -> Profile Folder/Directory:
Windows: Open Folder; Linux: Open Directory; Mac: Show in Finder - https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data