Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Edit session restore file after ransomware problem

more options

So I caught the "Critical alert from microsoft" ransomware on my laptop Firefox. After some effort I managed to get rid of it by following online instructions and doing virus cleanup. After even more effort and nerves I found Firefox session backup files. By using this tool: https://www.jeffersonscher.com/ffu/scrounger.html I managed to figure out the file that seems to be the most recent. The problem is, all the tabs that I need are in category "closed tabs", and in "open tabs" I have only one page, the one that essentially is an aforementioned ransomware.

So the question is: how do I put all the "closed tabs" into "open tabs", and erase the current "open tab"?

So I caught the "Critical alert from microsoft" ransomware on my laptop Firefox. After some effort I managed to get rid of it by following online instructions and doing virus cleanup. After even more effort and nerves I found Firefox session backup files. By using this tool: https://www.jeffersonscher.com/ffu/scrounger.html I managed to figure out the file that seems to be the most recent. The problem is, all the tabs that I need are in category "closed tabs", and in "open tabs" I have only one page, the one that essentially is an aforementioned ransomware. So the question is: how do I put all the "closed tabs" into "open tabs", and erase the current "open tab"?

Izabrano rješenje

Restore Previous Session will be missing if Firefox already restored the session or thinks it has nothing to restore.

As fun as this is, I suggest using the page of scrounged links to get your tabs back at this point.

Pročitajte ovaj odgovor sa objašnjenjem 👍 1

All Replies (5)

more options

Hi UchuuStranger, is that your current session? Can you re-open closed windows and tabs from the menu:

  • "Library" toolbar button > History > Recently Closed Windows (and within each restored window, Recently Closed Tabs)
  • (menu bar) History > Recently Closed Windows (and within each restored window, Recently Closed Tabs)

If not:

If you look in the box on the Scrounger page where you dropped the compressed file, you can see the JSON-format data that Firefox reads. Unfortunately, it is very difficult to edit. For now, it would be faster to use the links recovered by the Scrounger to re-open tabs than to try to edit the JSON data.

If you had no choice, I think -- I've never tried it -- you would do this:

(1) Save the JSON format file

(2) In a text editor, change the URL of the attack page to something harmless like https://www.example.com/ -- leave everything else "as is"

(3) "Swap" the edited file for your live one (details below)

(4) Use the History menu to re-open Recently Closed Windows and Recently Closed Tabs (using the methods described at the beginning of this post)


To try swapping in an older session history file so Firefox will load it, the standard "manual swap" method is as follows (assuming Firefox is still running):

(A) From inside Firefox, open your current Firefox settings (AKA Firefox profile) folder using either

  • "3-bar" menu button > "?" Help > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter

In the first table on the page, click the "Open Folder" button. This should launch a Windows Explorer window listing the various files and folders in your profile.

(B) Leaving that window open, switch back to Firefox and Exit, either:

  • "3-bar" menu button > "power" button Exit
  • (menu bar) File > Exit

Pause while Firefox finishes its cleanup -- a file named sessionstore.jsonlz4 should appear in the folder.

(C) Once Firefox has stopped updating things, while viewing the main level of the profile folder, right-click > Rename sessionstore.jsonlz4 to sessionstoreOLD.jsonlz4

If you see an older sessionstore.js or sessionstore.bak file, move it somewhere else or delete it.

To hide other session history files from Firefox, right-click > rename the sessionstore-backups folder to sessionstore-backupsOLD

(D) Copy in the edited JSON file you want to restore, and rename it with the name appropriate for its format:

  • Uncompressed file such as recovery.js => sessionstore.js
  • Compressed file such as recovery.jsonlz4 => sessionstore.jsonlz4

(E) Start Firefox and it should read the swapped in sessionstore file and restore whatever was in the substitute file; if you do not have Firefox set to restore your previous windows and tabs automatically, use either:

  • "3-bar" menu button > Restore Previous Session
  • (menu bar) History > Restore Previous Session
more options

"Recently closed windows" is empty. I followed all of your instructions except for the file swapping. The only thing I have doubts about is that the extension of the file I edited is neither "js" nor "jsonlz4". It is simply "json". How am I supposed to rename it then?

more options

Sometimes I don't remember how my own page works...

You will need to rename some-name-i-dont-remember.json to sessionstore.js in Step (D).

more options

Okay, I did that. The history seems to be in place now (not sure if it was there before). The tab is empty, no more suggestions to restore the ransomware page. But closed tabs and closed windows are also empty. As for "restore previous session" option, for some reason my browser is just missing it! It should be in between "New private window" and "Zoom", but I have nothing there! Is there any reason for that?

more options

Odabrano rješenje

Restore Previous Session will be missing if Firefox already restored the session or thinks it has nothing to restore.

As fun as this is, I suggest using the page of scrounged links to get your tabs back at this point.