See this article about the New Tab page (about:newtab):

• https://support.mozilla.org/kb/new-tab-page-show-hide-and-customize-top-sites

If you do not keep changes after a restart then see:

• http://kb.mozillazine.org/Preferences_not_saved

Do a malware check with some malware scanning programs on the Windows computer.
You need to scan with all programs because each program detects different malware.
Make sure that you update each program to get the latest version of their databases before doing a scan.

• http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
• http://www.superantispyware.com/ - SuperAntispyware
• http://www.microsoft.com/security/scanner/en-us/default.aspx - Microsoft Safety Scanner
• http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
• http://www.safer-networking.org/en/index.html - Spybot Search & Destroy

You can also do a check for a rootkit infection with TDSSKiller.

• http://support.kaspersky.com/viruses/solutions?qid=208280684

See also:

• "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

Chosen Solution

Add-ons are usually the culprit.

" YouTube Videos Download in one click 1.0.0 " installs search.ghribi as your new tab page.

Helpful Reply

Go to Tools->Add ons (or do Ctrl+Shift+A), Select "Extensions" Disable "Youtube downloader", restart firefox, ..... n thats it!!!

Question owner

thank u very much, after uninstalling the " YouTube Videos Download in one click 1.0.0 ", the problem was solved

thank u for the useful reply

Hi cor-el, You have helped me before here (thanks again!) and this time, it's a bit broader question, but still specific to this filthy Trojan ghribi. 1. I'm stunned that this thing is still listed in Moz Extensions! Apparently it is quite well-known for quite a while. Why?

2. Sadly, I've tried all of the principal virus catcher programs above and not one of them worked, either at detection or removal. 

3. As I did learn over the years, most "gurus" are dangerous. I'd like to find someone to trust right now as this Trojan/virus/key logger??!! is continuing to damage my system even as I write this - Fox has now stopped working at all, this is written in I.E.!

What is the current setting of the browser.newtab.url pref on the about:config page?

If you do not keep changes after a restart then see:

• http://kb.mozillazine.org/Preferences_not_saved

Check for the presence of a mozilla.cfg file in the Firefox program folder to initialize some prefs.

This also involves the presence of a .js (JScript) file, probably in "defaults\pref" folder, that specifies to read this mozilla.cfg file.

If you have .js files apart from the channel-prefs.js file, that sets app.update.channel, in the defaultspref folder then open this file in an editor like Notepad and please post its content.
Also please post the content of the mozilla.cfg file.

If you have this mozilla.cfg file then best is to do a clean reinstall of Firefox and remove the Firefox program folder.

• http://kb.mozillazine.org/Preferences_not_saved#Other_solutions