X
Tap here to go to the mobile version of the site.

Support Forum

How to stop Omniboxes virus from hijacking Firefox?

Posted

I don't know how, but for some reason this Omniboxes.com virus hijacked my Firefox and I can't get rid of. What happens is that it forces Firefox to always go to Omniboxes.com when I open it up. The weird thing is that it only happens THE FIRST TIME. My homepage is set correctly: I can go to my homepage when I click on the button, and it also does so when I open up a new window. Right-clicking on Firefox and going to Properties also revealed the target destination is set correctly.

In addition I've deleted the harmful program from the software manager already, and ran the Malwarebytes program (and Quarantined harmful files). I've also checked Task Manager but no shady programs seem to be running in the background.

Anyone know how to fix this? As said, the weird thing is it ONLY happens once on startup, never after that as long as I have Firefox open. I've also got a few add-ons and extensions running (confirmed safe), so I'm not a fan of resetting Firefox.

I don't know how, but for some reason this Omniboxes.com virus hijacked my Firefox and I can't get rid of. What happens is that it forces Firefox to always go to Omniboxes.com when I open it up. The weird thing is that it only happens THE FIRST TIME. My homepage is set correctly: I can go to my homepage when I click on the button, and it also does so when I open up a new window. Right-clicking on Firefox and going to Properties also revealed the target destination is set correctly. In addition I've deleted the harmful program from the software manager already, and ran the Malwarebytes program (and Quarantined harmful files). I've also checked Task Manager but no shady programs seem to be running in the background. Anyone know how to fix this? As said, the weird thing is it ONLY happens once on startup, never after that as long as I have Firefox open. I've also got a few add-ons and extensions running (confirmed safe), so I'm not a fan of resetting Firefox.

Chosen solution

Well, I had another look at settings in the about:config menu and actually found the line that was hijacking my homepage. Must've missed it the first time. I changed it and Firefox works correctly now.

Nonetheless, thank you for all the help, the problem is solved now.

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.31.2 for Mozilla browsers
  • The plugin allows you to have a better experience with Microsoft Lync
  • The plugin allows you to have a better experience with Microsoft SharePoint
  • Shockwave Flash 17.0 r0
  • 5.1.30514.0
  • VLC media player Web Plugin 2.1.3

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0

More Information

John99 971 solutions 13138 answers

Helpful Reply

It may have modified the start link for Firefox. To check use Winkey+R to get a run box and type in firefox.exe does that start Firefox correctly ?

Check your Firefox icon's properties by right clicking it has it been modified and Onmibox added on the end ? If remove that or create a new icon.

As you have had adware or malware also look at

It may have modified the start link for Firefox. To check use Winkey+R to get a run box and type in ''firefox.exe'' does that start Firefox correctly ? Check your Firefox icon's properties by right clicking it has it been modified and Onmibox added on the end ? If remove that or create a new icon. As you have had adware or malware also look at * [[Remove a toolbar that has taken over your Firefox search or home page]] * [[Troubleshoot Firefox issues caused by malware]]

Question owner

Running firefox.exe opens the correct homepage, except when I have Firefox closed, that's the thing.

As I had stated, Firefox icon's properties are correct, it reads "C:\Program Files (x86)\Mozilla Firefox\firefox.exe".

Those other links are of no help. I've removed every trace of the malware already, except for this. It's the only thing that remains.

Running firefox.exe opens the correct homepage, except when I have Firefox closed, that's the thing. As I had stated, Firefox icon's properties are correct, it reads "C:\Program Files (x86)\Mozilla Firefox\firefox.exe". Those other links are of no help. I've removed every trace of the malware already, except for this. It's the only thing that remains.
Scribe 725 solutions 3456 answers

Hi, it's in there somewhere! See if there's anything in this article that will help.

Also make sure it's not in the PC's Startup Folder.

Hope you can fix it.

Hi, it's in there somewhere! See if there's anything in [http://malwaretips.com/blogs/remove-omniboxes-virus/ this article] that will help. Also make sure it's not in the PC's Startup Folder. Hope you can fix it.

Question owner

Did the things in that article, didn't help.

Also checked the list of services and programmes that activate on start-up, it wasn't there either. Any other options?

Did the things in that article, didn't help. Also checked the list of services and programmes that activate on start-up, it wasn't there either. Any other options?
John99 971 solutions 13138 answers

If the homepage is correct and so is the start icon not sure what may have changed to do that. Create a new additional Firefox profile and try that. If that fails to open correctly maybe you have some modified Firefox and will need to try a clean reinstall.


Certain Firefox problems can be solved by performing a Clean reinstall. This means you remove Firefox program files and then reinstall Firefox. Please follow these steps:

Note: You might want to print these steps or view them in another browser.

  1. Download the latest Desktop version of Firefox from mozilla.org (or choose the download for your operating system and language from this page) and save the setup file to your computer.
  2. After the download finishes, close all Firefox windows (or open the Firefox menu New Fx Menu and click the close button Close 29 ).
  3. Delete the Firefox installation folder, which is located in one of these locations, by default:
    • Windows:
      • C:\Program Files\Mozilla Firefox
      • C:\Program Files (x86)\Mozilla Firefox
    • Mac: Delete Firefox from the Applications folder.
    • Linux: If you installed Firefox with the distro-based package manager, you should use the same way to uninstall it - see Install Firefox on Linux. If you downloaded and installed the binary package from the Firefox download page, simply remove the folder firefox in your home directory.
  4. Now, go ahead and reinstall Firefox:
    1. Double-click the downloaded installation file and go through the steps of the installation wizard.
    2. Once the wizard is finished, choose to directly open Firefox after clicking the Finish button.

More information about reinstalling Firefox can be found here.

WARNING: Do not use a third party uninstaller as part of this process. Doing so could permanently delete your Firefox profile data, including but not limited to, extensions, cache, cookies, bookmarks, personal settings and saved passwords. These cannot be easily recovered unless they have been backed up to an external device! See Back up and restore information in Firefox profiles.

Please report back to say if this helped you!

Thank you.

If the homepage is correct and so is the start icon not sure what may have changed to do that. Create a new additional Firefox profile and try that. If that fails to open correctly maybe you have some modified Firefox and will need to try a clean reinstall. * see [[Firefox keeps crashing at startup#w_try-a-clean-install]]'''_try-a-clean-install''' * EDIT adding link to [[Use the Profile Manager to create and remove Firefox profiles]] ------- Certain Firefox problems can be solved by performing a ''Clean reinstall''. This means you remove Firefox program files and then reinstall Firefox. Please follow these steps: '''Note:''' You might want to print these steps or view them in another browser. #Download the latest Desktop version of Firefox from [https://www.mozilla.org mozilla.org] (or choose the download for your operating system and language from [https://www.mozilla.org/firefox/all/ this page]) and save the setup file to your computer. #After the download finishes, close all Firefox windows (or open the Firefox menu [[Image:New Fx Menu]] and click the close button [[Image:Close 29]]). #Delete the Firefox installation folder, which is located in one of these locations, by default: #*'''Windows:''' #**C:\Program Files\Mozilla Firefox #**C:\Program Files (x86)\Mozilla Firefox #*'''Mac:''' Delete Firefox from the Applications folder. #*'''Linux:''' If you installed Firefox with the distro-based package manager, you should use the same way to uninstall it - see [[Installing Firefox on Linux]]. If you downloaded and installed the binary package from the [http://www.mozilla.org/firefox#desktop Firefox download page], simply remove the folder ''firefox'' in your home directory. #Now, go ahead and reinstall Firefox: ##Double-click the downloaded installation file and go through the steps of the installation wizard. ##Once the wizard is finished, choose to directly open Firefox after clicking the Finish button. More information about reinstalling Firefox can be found [[Troubleshoot and diagnose Firefox problems#w_5-reinstall-firefox|here]]. <b>WARNING:</b> Do not use a third party uninstaller as part of this process. Doing so could permanently delete your [[Profiles|Firefox profile]] data, including but not limited to, extensions, cache, cookies, bookmarks, personal settings and saved passwords. <u>These cannot be easily recovered unless they have been backed up to an external device!</u> See [[Back up and restore information in Firefox profiles]]. <!-- Starting in Firefox 31, the Firefox uninstaller no longer lets you remove user profile data.Ref: Bug 432017 and https://support.mozilla.org/kb/uninstall-firefox-from-your-computer/discuss/5279 [Fx31] Windows uninstaller will no longer offer the option to remove personal data --> Please report back to say if this helped you! Thank you.

Modified by John99

Question owner

How do I make a new profile? I haven't tried that yet.

I've been using this Firefox for a while now, but only recently has it started doing this, so I doubt I have a modified install.

I know a clean install is an option, but I'd rather avoid that. I've got quite a few add-ons and userscripts at the moment. I would really like to avoid losing them.

How do I make a new profile? I haven't tried that yet. I've been using this Firefox for a while now, but only recently has it started doing this, so I doubt I have a modified install. I know a clean install is an option, but I'd rather avoid that. I've got quite a few add-ons and userscripts at the moment. I would really like to avoid losing them.
John99 971 solutions 13138 answers

Hi again Rendabomb, Both my previous suggestions should be ok to follow.

Sorry I omitted the link about creating new profiles.I have now added it.

The clean install will not remove extensions or change settings. (As long as you follow the instructions, and do not remove the profile or use any third party uninstaller.)

The new profile is similar to the reset but leaves your previous settings easily available and unaltered. Firefox gives you a choice of which profile to use once you have the additional profile.

Hi again Rendabomb, Both my previous suggestions should be ok to follow. Sorry I omitted the link about creating new profiles.I have now added it. * [[Use the Profile Manager to create and remove Firefox profiles]] The clean install will not remove extensions or change settings. (As long as you follow the instructions, and do not remove the profile or use any third party uninstaller.) The new profile is similar to the reset but leaves your previous settings easily available and unaltered. Firefox gives you a choice of which profile to use once you have the additional profile.
jscher2000
  • Top 10 Contributor
8692 solutions 71055 answers

Some malware creates scheduled tasks. I don't know whether Windows supports starting an application as triggering a task, but you could check for such a thing here:

Control Panel > System and Security > Administrative Tasks > Schedule Tasks

or

Start menu > All Programs > Administrative Tools > Task Scheduler

Using the time filter, you may be able to discover a recently run task that is related to this problem.

Some malware creates scheduled tasks. I don't know whether Windows supports starting an application as triggering a task, but you could check for such a thing here: Control Panel > System and Security > Administrative Tasks > Schedule Tasks or Start menu > All Programs > Administrative Tools > Task Scheduler Using the time filter, you may be able to discover a recently run task that is related to this problem.

Question owner

I had a look at all the scheduled and past tasks, but couldn't find anything out of the ordinary.

I also tried creating a new profiling and using that to open Firefox, and that actually seemed to work; now it wouldn't automatically go to this omniboxes scam site. Thus it appears to be a problem linked to my profile.

Now, how to fix it? I also found out the exact same thing happens in Internet Explorer now, so it seems it's not a problem exclusive with Firefox. Still, I don't care about IE so solely fixing it for Firefox would be fine.

I had a look at all the scheduled and past tasks, but couldn't find anything out of the ordinary. I also tried creating a new profiling and using that to open Firefox, and that actually seemed to work; now it wouldn't automatically go to this omniboxes scam site. Thus it appears to be a problem linked to my profile. Now, how to fix it? I also found out the exact same thing happens in Internet Explorer now, so it seems it's not a problem exclusive with Firefox. Still, I don't care about IE so solely fixing it for Firefox would be fine.
jscher2000
  • Top 10 Contributor
8692 solutions 71055 answers

In your old profile, did you check for a user.js file? It's an optional settings file that Firefox reads at startup and uses to override your previous session preferences. This article describes how to track it down: How to fix preferences that won't save.

In your old profile, did you check for a user.js file? It's an optional settings file that Firefox reads at startup and uses to override your previous session preferences. This article describes how to track it down: [[How to fix preferences that won't save]].

Question owner

I searched for a user.js in my profile folder, but there was none. I also looked at the prefs.js file, and there all the settings seem correct.

Extremely weird, my homepage preference just gets overwritten once on startup, for both Firefox and IE.

I searched for a user.js in my profile folder, but there was none. I also looked at the prefs.js file, and there all the settings seem correct. Extremely weird, my homepage preference just gets overwritten once on startup, for both Firefox and IE.
jscher2000
  • Top 10 Contributor
8692 solutions 71055 answers

I think you skipped over the "Clean Reinstall" procedure. It is possible to create an override file in Firefox's program folders, often called mozilla.cfg but it can be named other things. If you can't find anything like that manually, then the Clean Reinstall would be the most efficient next step.

To search for a preference file manually: See this article on where the files go: http://kb.mozillazine.org/Locking_preferences

For future reference if needed:

Clean Reinstall

We use this name, but it's not about removing your settings, it's about making sure the program files are clean. As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed.

(1) Download a fresh installer for Firefox 36.0.1 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.)

(2) Exit out of Firefox.

(3) Rename the program folder

(64-bit Windows folder names)

C:\Program Files (x86)\Mozilla Firefox

to

C:\Program Files (x86)\OldFirefox

(32-bit Windows folder names)

C:\Program Files\Mozilla Firefox

to

C:\Program Files\OldFirefox

(4) Run the installer you downloaded in #1. It should automatically connect to your existing settings.

Does Firefox start up correctly with just the default program files?

Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders:

  • \OldFirefox\Plugins
  • \OldFirefox\browser\plugins
I think you skipped over the "Clean Reinstall" procedure. It is possible to create an override file in Firefox's program folders, often called mozilla.cfg but it can be named other things. If you can't find anything like that manually, then the Clean Reinstall would be the most efficient next step. ''To search for a preference file manually:'' See this article on where the files go: http://kb.mozillazine.org/Locking_preferences For future reference if needed: '''Clean Reinstall''' We use this name, but it's not about removing your settings, it's about making sure the program files are clean. As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed. (1) Download a fresh installer for Firefox 36.0.1 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.) (2) Exit out of Firefox. (3) Rename the program folder ''(64-bit Windows folder names)'' C:\Program Files (x86)\Mozilla Firefox to C:\Program Files (x86)\OldFirefox ''(32-bit Windows folder names)'' C:\Program Files\Mozilla Firefox to C:\Program Files\OldFirefox (4) Run the installer you downloaded in #1. It should automatically connect to your existing settings. Does Firefox start up correctly with just the default program files? Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders: * \OldFirefox\Plugins * \OldFirefox\browser\plugins

Question owner

Sorry for not replying in a while, but I tried the Clean Reinstall and it didn't work.

Any other options left?

Sorry for not replying in a while, but I tried the Clean Reinstall and it didn't work. Any other options left?
jscher2000
  • Top 10 Contributor
8692 solutions 71055 answers

Just in case your Windows has the default setting of hiding the .js file extension, can you find a "user" file of type JScript in your (problem) profile folder? That would be the user.js file.

Just in case your Windows has the default setting of hiding the .js file extension, can you find a "user" file of type JScript in your (problem) profile folder? That would be the user.js file.

Question owner

I didn't find any user.js file, but I did have a look at the prefs file, and there I found these lines of code:

user_pref("browser.startup.homepage", "https://www.google.nl/webhp?hl=en"); user_pref("browser.startup.homepage_override.buildID", "20150402191859"); user_pref("browser.startup.homepage_override.mstone", "37.0.1");

Maybe this is the problem? I deleted the last two lines and saved the document, but they seem to reappear?

I didn't find any user.js file, but I did have a look at the ''prefs'' file, and there I found these lines of code: user_pref("browser.startup.homepage", "https://www.google.nl/webhp?hl=en"); user_pref("browser.startup.homepage_override.buildID", "20150402191859"); user_pref("browser.startup.homepage_override.mstone", "37.0.1"); Maybe this is the problem? I deleted the last two lines and saved the document, but they seem to reappear?
FredMcD
  • Top 10 Contributor
4246 solutions 59390 answers

Is that what you want as your home page?

These can help you;

Bookmark and use this; Mozilla Search Reset {web link} This add-on is very simple: on installation, it backs up and then resets your search preferences and home page to their default values, and then uninstalls itself. This affects the search bar, URL bar searches, and the home page.


Settings Guard for Firefox {web link} Detects and resets changes to settings that are frequently done by add-ons and application installers.

Is that what you want as your home page? These can help you; Bookmark and use this; '''[https://addons.mozilla.org/en-US/firefox/addon/searchreset/ Mozilla Search Reset]''' {web link} This add-on is very simple: on installation, it backs up and then resets your search preferences and home page to their default values, and then uninstalls itself. This affects the search bar, URL bar searches, and the home page. ---------------- '''[https://addons.mozilla.org/en-US/firefox/addon/settings-guard Settings Guard for Firefox]''' {web link} Detects and resets changes to settings that are frequently done by add-ons and application installers.
jscher2000
  • Top 10 Contributor
8692 solutions 71055 answers

Does this problem occur if you start Firefox from the Start menu search box by typing or pasting the following:

firefox.exe
Does this problem occur if you start Firefox from the Start menu search box by typing or pasting the following: firefox.exe

Chosen Solution

Well, I had another look at settings in the about:config menu and actually found the line that was hijacking my homepage. Must've missed it the first time. I changed it and Firefox works correctly now.

Nonetheless, thank you for all the help, the problem is solved now.

Well, I had another look at settings in the about:config menu and actually found the line that was hijacking my homepage. Must've missed it the first time. I changed it and Firefox works correctly now. Nonetheless, thank you for all the help, the problem is solved now.
FredMcD
  • Top 10 Contributor
4246 solutions 59390 answers

That was very good work. Well Done. Please flag your last post as Solved Problem so other will know.

What was the about:config setting you found?

That was very good work. Well Done. Please flag your last post as '''Solved Problem''' so other will know. What was the '''about:config''' setting you found?

Question owner

I don't know the exact line anymore, but it had homepage, override and redirect in it. Pretty obvious actually.

I don't know the exact line anymore, but it had ''homepage'', ''override'' and ''redirect'' in it. Pretty obvious actually.