Vonteera Browser hijacker in about:config, how to remove?
Hello,
I have been infected by a Browser Hijacker, which posts ads on websites. It shows "ads by Volaro" and by doing some reading on the net, Vonteera is involved/ the cause. I have tried to clean the registry and removed several suspicious files from the respective folders in my profile, cleared the pref.js in Mozilla several times, no effect. In the about:config, I have noticed two Vonteera processes, namely:
vonteera.randurls;{"tp|www.adnets|info|:srv1|do":1,"tps|www.adnetworkus|com|:srv1|analytics":1} vonteera.randurlsdate;1415467507208
They keep coming back, even if I reset them. I am pretty sure they are the cause of evil. Any idea how to circumvent this?
Chosen solution
I ran several Virus scanners (AdWCleaner, Malwarebytes, Hitman..etc), at the end ESET did it and found/ deleted the responsible files. Along the process, I seem to have harmed my Firefox profile to some extend, as some Add Ins were not running anymore. I had to reinstall Firefox completely, a simple reset did not help. Anyways, all good now and back in service! So if you catch Vonteera/ Ads by Volaro, try ESET and be prepared to reinstall FF.
Read this answer in context 👍 1All Replies (7)
Those preferences probably are created by an add-on. Here's what I suggest for tracking it down:
(1) Open the Windows Control Panel, Uninstall a Program. After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Take out as much trash as possible here.
(2) Then, in Firefox, open the Add-ons page using either:
- Ctrl+Shift+a
- "3-bar" menu button (or Tools menu) > Add-ons
In the left column, click Plugins. Set nonessential and unrecognized plugins to "Never Activate".
In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
(3) Search for remaining issues with the scanning/cleaning tools listed in our support article: Troubleshoot Firefox issues caused by malware. Note that the tools are free and take considerable time to run. If they seem to finish quickly and then ask for payment, you might have a Fake AV infection. Please use the specialized forums listed in the article in that case.
Success?
You can go clean out the preferences later at your leisure.
Thanks for the quick reply! Unfortunately, no success. I tried all the steps before, I have no dodgy entries neither in the runing tasks, processes, Firefox extensions, plugins etc. (I have all of them in "Ask before executing" mode). Also ran Malwarebytes and AdwCleaner, still the same issue. The Browser shows the "right" ads and then switches to the "hijacked" mode after a short moment with wrong ads and banners.
Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.
You can try these free programs to scan for malware, which work with your existing antivirus software:
- Microsoft Safety Scanner
- MalwareBytes' Anti-Malware
- Anti-Rootkit Utility - TDSSKiller
- AdwCleaner (for more info, see this alternate AdwCleaner download page)
- Hitman Pro
- ESET Online Scanner
Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.
Further information can be found in the Troubleshoot Firefox issues caused by malware article.
Did this fix your problems? Please report back to us!
I tried all of the steps described in the post, unfortunately without success. Will post in an Anti Virus forum and relay the reply here
Chosen Solution
I ran several Virus scanners (AdWCleaner, Malwarebytes, Hitman..etc), at the end ESET did it and found/ deleted the responsible files. Along the process, I seem to have harmed my Firefox profile to some extend, as some Add Ins were not running anymore. I had to reinstall Firefox completely, a simple reset did not help. Anyways, all good now and back in service! So if you catch Vonteera/ Ads by Volaro, try ESET and be prepared to reinstall FF.
Well done.