Note that about:searchreset is a page used internally and isn't meant to be used this way (it is opened withso me GET parameters appended). This page isn't listed on about:about as well for this reason. The browser.search.reset.enabled pref that enables this page is false by default on release and beta builds.

Do a malware check with several malware scanning programs on the Windows computer.

• https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure you update each program to get the latest version of their databases before doing a scan.

• Malwarebytes' Anti-Malware:
  https://www.malwarebytes.com/
• AdwCleaner:
  http://www.bleepingcomputer.com/download/adwcleaner/
  http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
• SuperAntispyware:
  http://www.superantispyware.com/
• Microsoft Safety Scanner:
  https://www.microsoft.com/security/scanner/en-us/default.aspx
• Windows Defender:
  https://windows.microsoft.com/en-us/windows/using-defender
• Spybot Search & Destroy:
  http://www.safer-networking.org/en/index.html
• Kasperky Free Security Scan:
  https://www.kaspersky.com/security-scan

You can also do a check for a rootkit infection with TDSSKiller.

• Anti-rootkit utility TDSSKiller:
  https://support.kaspersky.com/viruses/disinfection/5350

https://support.kaspersky.com/viruses/utility

McCoy said

finlandsberet said

I checked the first one - about:searchreset - and I've included a screenshot as to what comes up.

That screenshot doesn't show your default search engine - would you check your setting again  ?

(Options => Search)

After checking under about:config, the value is set to false. Should it stay as false or do I need to change it?

No, don't change the value - it should stay on "false"

(it was a mere stab in the dark .... )

I checked in my options, and Google is my default search engine. I also have Avira SafeSearch on my list of one-click search engines; should I remove that and see what happens tomorrow?

I'll keep it as it is, then, thank you.

cor-el said

Note that about:searchreset is a page used internally and isn't meant to be used this way (it is opened withso me GET parameters appended). This page isn't listed on about:about as well for this reason. The browser.search.reset.enabled pref that enables this page is false by default on release and beta builds.

---

Do a malware check with several malware scanning programs on the Windows computer.

• https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure you update each program to get the latest version of their databases before doing a scan.

• Malwarebytes' Anti-Malware:
  https://www.malwarebytes.com/
• AdwCleaner:
  http://www.bleepingcomputer.com/download/adwcleaner/
  http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
• SuperAntispyware:
  http://www.superantispyware.com/
• Microsoft Safety Scanner:
  https://www.microsoft.com/security/scanner/en-us/default.aspx
• Windows Defender:
  https://windows.microsoft.com/en-us/windows/using-defender
• Spybot Search & Destroy:
  http://www.safer-networking.org/en/index.html
• Kasperky Free Security Scan:
  https://www.kaspersky.com/security-scan

You can also do a check for a rootkit infection with TDSSKiller.

• Anti-rootkit utility TDSSKiller:
  https://support.kaspersky.com/viruses/disinfection/5350

https://support.kaspersky.com/viruses/utility

I've run a malware scan already -as soon as I noticed this issue- and nothing has come-up as suspicious. One thing I did notice was that this morning, the whole "SearchRestore" folder had come back, as did the XPI File and HTML Document. The XPI File is called bing-ext.xpi and the HTML Document is simply called restore. I posted a screenshot of this earlier today, too. The first time this happened, on the 18th of November, Bing was added to my list of one-click search engines, but after removing it, it hasn't shown-up since, even with the tab as shown in the screeshot in my very first post returning.

All I want to know is why this keeps happening - as in, everything I have reported so far - and if it can or will be fixed as soon as possible. As mentioned a few times previously, this only started when Firefox updated to 63.0.3.

finlandsberet said

I checked in my options, and Google is my default search engine.

I asked, because I have Google set as my default search engine, and this is what I get when I go to "about:searchreset" : (see screenshot)

McCoy said

finlandsberet said

I checked in my options, and Google is my default search engine.

I asked, because I have Google set as my default search engine, and this is what I get when I go to "about:searchreset" : (see screenshot)

I see. Should I use that "about:searchreset" and change my search engine and see if that works?

Did you at least scan with AdwCleaner if you didn't use all programs I listed?

You can look for an unusual (suspicious) JavaScript file in these locations. There should only be a file named channel-prefs.js in this location, any other file present is suspicious and you can check its content in a plain text editor (right-click: Open with) to see what file it points to.

C:\Program Files\Mozilla Firefox\defaults\pref\
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\

You can look for the file that is referenced in the above mentioned .js file in the main Firefox program folder.

C:\Program Files\Mozilla Firefox\
C:\Program Files (x86)\Mozilla Firefox\

Delete this specific .js and .cfg file when present.

finlandsberet said

I see. Should I use that "about:searchreset" and change my search engine and see if that works?

I merely used "about:searchreset" as a tool, because I wanted to see what would show up as your default search engine.

What I would really like now is a screenshot of your search engine setting , but first of all : please, follow cor-el's advice.

cor-el said

Did you at least scan with AdwCleaner if you didn't use all programs I listed?

---

You can look for an unusual (suspicious) JavaScript file in these locations. There should only be a file named channel-prefs.js in this location, any other file present is suspicious and you can check its content in a plain text editor (right-click: Open with) to see what file it points to.

C:\Program Files\Mozilla Firefox\defaults\pref\
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\

You can look for the file that is referenced in the above mentioned .js file in the main Firefox program folder.

C:\Program Files\Mozilla Firefox\
C:\Program Files (x86)\Mozilla Firefox\

Delete this specific .js and .cfg file when present.

I used Malwarebytes, as I already have that installed. I also looked through and that file was the only file I found; channel-prefs.js.

I have gone through my options on Firefox, and it is only now that I notice an option that allows Firefox to automatically update search engines. Could that have anything to do with this? I've included a screenshot as to what I mean.

EDIT: I re-read your post; should I delete the channel-prefs.js file, or should I keep it?

McCoy said

finlandsberet said

I see. Should I use that "about:searchreset" and change my search engine and see if that works?

I merely used "about:searchreset" as a tool, because I wanted to see what would show up as your default search engine.

What I would really like now is a screenshot of your search engine setting , but first of all : please, follow cor-el's advice.

All I can show you is this, from my Firefox options. Ive also done as cor-el suggested, but there really seems to be nothing out of the ordinary. Whenever this happens - and by that, I mean the strange tab as shown in the screenshot with my very first post - it usually happens in the morning, when I first open Firefox. If I were to shut everything down now (for example) and come back again later in the day, then the tab doesn't open.

I apologise if it sounds like I'm going around in circles, but this has been an issue for a few days now and I would really like to just get it resolved. As soon as I found out that the XPI File and the HTML Document were back on my computer somehow -I deleted them both yesterday- I deleted them again in hopes of fixing this, but if they return then I would like to know how to stop the tab from opening when I first open Firefox.

finlandsberet said

I apologise if it sounds like I'm going around in circles, but this has been an issue for a few days now and I would really like to just get it resolved.

You have absolutely nothing to apologize for  ! You're doing exactly what you have been asked to do (thank you for those screenshots !) and you have a lot on your plate.

Like I mentioned earlier : the page that is shown in your first screenshot looks like a bad immitation of what is shown on "about:searchreset" - I was hoping that running those malware scans would come up with some explanation ...... :(

McCoy said

finlandsberet said

I apologise if it sounds like I'm going around in circles, but this has been an issue for a few days now and I would really like to just get it resolved.

You have absolutely nothing to apologize for  ! You're doing exactly what you have been asked to do (thank you for those screenshots !) and you have a lot on your plate.

Like I mentioned earlier : the page that is shown in your first screenshot looks like a bad immitation of what is shown on "about:searchreset" - I was hoping that running those malware scans would come up with some explanation ...... :(

I've just shut my laptop down and restarted it, but as I suspected nothing has come-up in terms of strange tabs. It only happens the very first time I open Firefox in the morning; would it be worth my time to go to about:support and refresh Firefox?

No, you shouldn't remove channel-prefs.js (this file sets the update channel), but this file is stored in a special location that survives an update and thus malware can misuse it.

cor-el said

No, you shouldn't remove channel-prefs.js (this file sets the update channel), but this file is stored in a special location that survives an update and thus malware can misuse it.

Okay then. Should I just wait this all out and see if the tab loads again tomorrow? If it does then I suppose my only option is to wait for whenever Firefox next updates and hope that that's the solution/fix.

Thank you for all of your help in this matter, and I apologise once again for going around in circles.

finlandsberet said

Should I just wait this all out and see if the tab loads again tomorrow? If it does then I suppose my only option is to wait for whenever Firefox next updates and hope that that's the solution/fix.

This isn't part of Firefox, so I don't think uninstall/reinstall/update will resolve the issue.

Is there any place you could upload the XPI file so people could take a look at it? This forum only allows images, but a new folder in OneDrive, Google Drive, Dropbox, etc., or a file hosting site, could work.

Note: a .xpi file is really a ZIP archive. If you rename the file extension from .xpi to .zip, you could look inside yourself, if you're interested. Sometimes the file named manifest.json contains an author name.

jscher2000 said

finlandsberet said

Should I just wait this all out and see if the tab loads again tomorrow? If it does then I suppose my only option is to wait for whenever Firefox next updates and hope that that's the solution/fix.

This isn't part of Firefox, so I don't think uninstall/reinstall/update will resolve the issue.

Is there any place you could upload the XPI file so people could take a look at it? This forum only allows images, but a new folder in OneDrive, Google Drive, Dropbox, etc., or a file hosting site, could work.

Note: a .xpi file is really a ZIP archive. If you rename the file extension from .xpi to .zip, you could look inside yourself, if you're interested. Sometimes the file named manifest.json contains an author name.

I don't have the folder/file as I deleted it earlier today, but if it shows up again tomorrow, I can try and do that. I'll keep that information in mind as well, just in case.

finlandsberet said

Should I just wait this all out and see if the tab loads again tomorrow? If it does then I suppose my only option is to wait for whenever Firefox next updates and hope that that's the solution/fix.

This isn't part of Firefox, so I don't think uninstall/reinstall/update will resolve the issue.

Is there any place you could upload the XPI file so people could take a look at it? This forum only allows images, but a new folder in OneDrive, Google Drive, Dropbox, etc., or a file hosting site, could work.

Note: a .xpi file is really a ZIP archive. If you rename the file extension from .xpi to .zip, you could look inside yourself, if you're interested. Sometimes the file named manifest.json contains an author name.

I just got on my laptop this morning and decided to do a little test; I searched "SearchRestore" in C: before opening Firefox, and there wasn't any such folder there. It was only after opening Firefox and getting the same imitation tab as in my very first screenshot that the "SearchRestore" file re-appears.

Do I need to drop the whole folder into Google Drive for the XPI File and Firefox HTML Document to show?

EDIT: I should mention that, even though the imitation tab suggests I change to Bing, ever since I removed Bing from my list of one-click search engines in Firefox Options, it hasn't shown-up since. I also had some other Firefox HTML Documents; I thought somehow they might have something to do with this, so I've deleted them (I didn't need them anyway), but I'm fairly certain this has something to do with Firefox given that the "SearchRestore" folder only reappeared after I opened Firefox, and I can only assume that it's due to the recent update to version 63.0.3.

I decided to look in the properties of the XPI File, and I found that in the permissions, the file has been given full access. I've included a screenshot to better explain what I mean.

Would it help if I were to deny the file all of these permissions?

EDIT: I've just checked the Firefox HTML Document, and it too has the same permissions as the XPI File. In addition, the folder as a whole only has "Special permissions" allowed. Should I remove all permissions? Would that help at all?

finlandsberet said

I just got on my laptop this morning and decided to do a little test; I searched "SearchRestore" in C: before opening Firefox, and there wasn't any such folder there. It was only after opening Firefox and getting the same imitation tab as in my very first screenshot that the "SearchRestore" file re-appears.

Do you want to share your extensions list? You can copy/paste it from the Troubleshooting Information page. Either:

• "3-bar" menu button > "?" Help > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter

Scroll down past "Application Basics" and "Firefox Features" to "Extensions". Then you can select and copy the table that follows (not the entire page, please, that's too much information) using either Ctrl+c or right-click > Copy and then paste it into a reply. It will be messy, but we're used it.

Do I need to drop the whole folder into Google Drive for the XPI File and Firefox HTML Document to show?

I don't use Google Drive very much. Either the folder or the two individual files.

finlandsberet said

I decided to look in the properties of the XPI File, and I found that in the permissions, the file has been given full access. I've included a screenshot to better explain what I mean. Would it help if I were to deny the file all of these permissions? EDIT: I've just checked the Firefox HTML Document, and it too has the same permissions as the XPI File. In addition, the folder as a whole only has "Special permissions" allowed. Should I remove all permissions? Would that help at all?

When a folder is created, it usually inherits the permissions of its containing folder. So those permissions may be completely normal for folders in that location. Would it help to change them? I don't know if you can deny Windows/Firefox the ability to open items in the folder without blocking your own ability to delete it...

jscher2000 said

finlandsberet said

I just got on my laptop this morning and decided to do a little test; I searched "SearchRestore" in C: before opening Firefox, and there wasn't any such folder there. It was only after opening Firefox and getting the same imitation tab as in my very first screenshot that the "SearchRestore" file re-appears.

Do you want to share your extensions list? You can copy/paste it from the Troubleshooting Information page. Either:

• "3-bar" menu button > "?" Help > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter

Scroll down past "Application Basics" and "Firefox Features" to "Extensions". Then you can select and copy the table that follows (not the entire page, please, that's too much information) using either Ctrl+c or right-click > Copy and then paste it into a reply. It will be messy, but we're used it.

Do I need to drop the whole folder into Google Drive for the XPI File and Firefox HTML Document to show?

I don't use Google Drive very much. Either the folder or the two individual files.

finlandsberet said

I decided to look in the properties of the XPI File, and I found that in the permissions, the file has been given full access. I've included a screenshot to better explain what I mean. Would it help if I were to deny the file all of these permissions? EDIT: I've just checked the Firefox HTML Document, and it too has the same permissions as the XPI File. In addition, the folder as a whole only has "Special permissions" allowed. Should I remove all permissions? Would that help at all?

When a folder is created, it usually inherits the permissions of its containing folder. So those permissions may be completely normal for folders in that location. Would it help to change them? I don't know if you can deny Windows/Firefox the ability to open items in the folder without blocking your own ability to delete it...

Firstly, here are my extensions as shown in about:support :

Extensions Name Version Enabled ID Avira Browser Safety 2.6.4.19801 true abs@avira.com Avira SafeSearch Plus 1.6.10.538 false safesearchplus2@avira.com Mozilla Partner Defaults 1.0.1 false partnerdefaults@mozilla.com Security Software

I'm sorry, but I'm not sure how to add the folder or files to Google Drive; all I can do is provide more screenshots of the folder and files once more. I've run both antivirus and malware scans on the folder and my entire system, and nothing has come-up as suspicious. If this can't be resolved or fixed, then I get the feeling my only option is to keep deleting the imitation tab whenever I see it and hope that this is fixed when Firefox next updates.

EDIT: I understand I've asked a few times, but if I go to about:support, would it be worth it to refresh Firefox from there?

It might help to use Refresh if this problem is caused by one of the settings or add-ons that would be removed. See: Refresh Firefox - reset add-ons and settings.

What is the extension "Security Software"?

Is it correct that the ONLY extension which is not disabled (the only one that has true in the Enabled column) is "Avira Browser Safety"? Try disabling that one at the end of the day as a test and see whether it changes how Firefox starts up.