X
Tap here to go to the mobile version of the site.

Support Forum

Thousands of JonuiCouupon type files are being written into AppData/Local/Mozilla/Firefox/Profiles/.../cache2/entries.

Posted

Something had infected my computer. With help I've removed most of the bad effects, but what remains is files of type JonuiCouupon being written into the Firefox Profiles area. When I delete the Profile, it creates a new one and starts writing them again. 38,000 files in the last week, totaling 330 MB.

Something had infected my computer. With help I've removed most of the bad effects, but what remains is files of type JonuiCouupon being written into the Firefox Profiles area. When I delete the Profile, it creates a new one and starts writing them again. 38,000 files in the last week, totaling 330 MB.

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape 15.9.20069
  • Amazon MP3 Downloader Plugin 1.0.17
  • Facebook Video Calling Plugin
  • GEPlugin
  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.51.2 for Mozilla browsers
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • SOE Web Installer
  • Adobe Shockwave for Director Netscape plug-in, version 12.1.8.158
  • 5.1.40728.0
  • Unity Player 4.5.1f3
  • NPWLPG
  • iTunes Detector Plug-in

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0

More Information

FredMcD
  • Top 10 Contributor
4248 solutions 59438 answers

You may have ad / mal-ware. Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.

You may have ad / mal-ware. Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article. Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.

Question owner

I've been working with a guy from Malwarebytes Support who resolved the many other issues I've had with the same problem so it stopped heavily effecting my browsing experience. But the file writes remain. I've probably run 10 different scanners, a few of them multiple times. But this problem with the "coupon" files continually being written to my hard drive has not gone away.

This started in August, 2015. I've run MBAM, Farbar (FRST), FRST (again), Junkware Removal Tool, ESET, Dr. Web CureIt!, and Farbar again.

I've been working with a guy from Malwarebytes Support who resolved the many other issues I've had with the same problem so it stopped heavily effecting my browsing experience. But the file writes remain. I've probably run 10 different scanners, a few of them multiple times. But this problem with the "coupon" files continually being written to my hard drive has not gone away. This started in August, 2015. I've run MBAM, Farbar (FRST), FRST (again), Junkware Removal Tool, ESET, Dr. Web CureIt!, and Farbar again.
the-edmeister
  • Top 25 Contributor
  • Moderator
5399 solutions 40161 answers

Have you tried clearing your cache?

  1. Click the menu button New Fx Menu , choose History, and then "Clear Recent History...".
  2. Under "Time range to clear", select "Everything".
  3. Now, click the arrow next to Details to toggle the Details list active.
  4. From the details list, check-mark Cache and uncheck everything else.
  5. Then click the "Clear Now" button.
Have you tried clearing your cache? #Click the menu button [[Image:New Fx Menu]], choose History, and then "Clear Recent History...". #Under "Time range to clear", select "Everything". #Now, click the arrow next to Details to toggle the Details list active. #From the details list, check-mark ''Cache'' and uncheck everything else. #Then click the "Clear Now" button.
FredMcD
  • Top 10 Contributor
4248 solutions 59438 answers

Just in case, I found https://www.bing.com/search?q=JonuiCouupon&pc=MOZI how to remove.

Just in case, I found https://www.bing.com/search?q=JonuiCouupon&pc=MOZI how to remove.
cor-el
  • Top 10 Contributor
  • Moderator
17482 solutions 158000 answers

That is the location that Firefox uses for the disk cache and it is normal that it fills to a few hundred megabytes. You can inspect the disk cache via the about:cache page.

What makes you think that that are all JonuiCouupon type files?

That is the location that Firefox uses for the disk cache and it is normal that it fills to a few hundred megabytes. You can inspect the disk cache via the about:cache page. What makes you think that that are all JonuiCouupon type files?

Question owner

1) I ran another scan, SUPERAntiSpyware, as suggested on the Mozilla help as suggested above. After a reboot and a few hours, I have about 4,000 new files copied to my hard drive.

2) I cleared the history, as suggested. No help.

3) Searching for JunuiCouupon is worthless. There's too many optimized sites which suggest meaningless fixes. Maybe one is the one I need, but it's a needle in a haystack, and I'm not willing to run any old program that's suggested in that manner and/or pay for a fix as they are non-specific to my problem.

4) Since my last scan, removal of bad files (mostly cookies) and reboot, a new profile was created in my AppData/Local/Firefox/Profiles folder, and in that Profile's cache2/entries folder, 3,427 files of Type "JunuiCouupon" have been copied into it. Using Windows Explorer to tell me that info.

1) I ran another scan, SUPERAntiSpyware, as suggested on the Mozilla help as suggested above. After a reboot and a few hours, I have about 4,000 new files copied to my hard drive. 2) I cleared the history, as suggested. No help. 3) Searching for JunuiCouupon is worthless. There's too many optimized sites which suggest meaningless fixes. Maybe one is the one I need, but it's a needle in a haystack, and I'm not willing to run any old program that's suggested in that manner and/or pay for a fix as they are non-specific to my problem. 4) Since my last scan, removal of bad files (mostly cookies) and reboot, a new profile was created in my AppData/Local/Firefox/Profiles folder, and in that Profile's cache2/entries folder, 3,427 files of Type "JunuiCouupon" have been copied into it. Using Windows Explorer to tell me that info.
cor-el
  • Top 10 Contributor
  • Moderator
17482 solutions 158000 answers

The files in the entries folder are files in the disk cache that have a name that consists of a special SHA1 hash of 80 characters. I'm sure that other applications like Windows Explorer don't know about these files and can identify them with any name. You can also see this by files like prefs.js that Windows is calling JScript files and Windows will try to run as JScript files when double-clicked although they are special JavaScript files that are interpreted and not even run as a JavaScript files by Firefox. You should always be cautious with how Windows identifies specific file types and avoid double-clicking them, but always use the right-click context menu in case of doubt what application Windows would use.

The files in the entries folder are files in the disk cache that have a name that consists of a special SHA1 hash of 80 characters. I'm sure that other applications like Windows Explorer don't know about these files and can identify them with any name. You can also see this by files like prefs.js that Windows is calling JScript files and Windows will try to run as JScript files when double-clicked although they are special JavaScript files that are interpreted and not even run as a JavaScript files by Firefox. You should always be cautious with how Windows identifies specific file types and avoid double-clicking them, but always use the right-click context menu in case of doubt what application Windows would use.

Question owner

My feeling is that all the JonuiCouupon files are ads. Previous scans and removals of ad software prevents their display, but the ads are being written to my hard drive at a very fast rate. The names are a hash of 40 characters in this case.

My feeling is that all the JonuiCouupon files are ads. Previous scans and removals of ad software prevents their display, but the ads are being written to my hard drive at a very fast rate. The names are a hash of 40 characters in this case.
cor-el
  • Top 10 Contributor
  • Moderator
17482 solutions 158000 answers

The location in \AppData\Local\Mozilla\Firefox\ is only used by Firefox for the disk cache.

  • C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<profile>\cache2\entries

The files have a special header at the start of the file, so you can't easily open them other than in a hex view utility. Firefox constantly write files to the disk cache. You can try to disable the Firefox disk cache to see if there are still files written.

You can set browser.cache.disk.enable to false on the about:config page.

You can open the about:config page via the location/address bar. You can accept the warning and click "I'll be careful" to continue.

The location in \AppData\Local\Mozilla\Firefox\ is only used by Firefox for the disk cache. *C:\Users\&lt;user&gt;\AppData\Local\Mozilla\Firefox\Profiles\&lt;profile&gt;\cache2\entries The files have a special header at the start of the file, so you can't easily open them other than in a hex view utility. Firefox constantly write files to the disk cache. You can try to disable the Firefox disk cache to see if there are still files written. You can set <b>browser.cache.disk.enable</b> to false on the <b>about:config</b> page. You can open the <b>about:config</b> page via the location/address bar. You can accept the warning and click "I'll be careful" to continue. *http://kb.mozillazine.org/about:config

Modified by cor-el

Question owner

Disabling the disk cache seems to have stopped the files. At least to this location. Are there any consequences to disabling the disk cache?

Disabling the disk cache seems to have stopped the files. At least to this location. Are there any consequences to disabling the disk cache?
cor-el
  • Top 10 Contributor
  • Moderator
17482 solutions 158000 answers

Helpful Reply

If you do not use the disk cache then Firefox can only use the memory cache and Firefox needs to request files that aren't cached from the server, so you likely have more internet traffic and a slower browsing experience. As you can see that this are normal files in the Firefox disk cache and nothing to worry about. That is how the disk cache works and other software doesn't know about what files are stored in that location. So do not let this confuse you.

If you do not use the disk cache then Firefox can only use the memory cache and Firefox needs to request files that aren't cached from the server, so you likely have more internet traffic and a slower browsing experience. As you can see that this are normal files in the Firefox disk cache and nothing to worry about. That is how the disk cache works and other software doesn't know about what files are stored in that location. So do not let this confuse you.

Question owner

Thank you for the replies and suggestions. I want to make sure I understand.

I'm sure that JonuiCouupon is a malware that had several different names that served annoying ads and hijacked my Firefox browsing experience to the point of it being nearly unusable. I successfully removed it, with help.

Are you saying that JonuiCouupon has just redefined the file type, and the files written to the Profile cache by Firefox are benign and/or helpful? Are you sure that the volume of files being written there is normal? I'm talking 30,000 to 40,000 files per week.

I'd turn the cache back on if this were so.

Thank you for the replies and suggestions. I want to make sure I understand. I'm sure that JonuiCouupon is a malware that had several different names that served annoying ads and hijacked my Firefox browsing experience to the point of it being nearly unusable. I successfully removed it, with help. Are you saying that JonuiCouupon has just redefined the file type, and the files written to the Profile cache by Firefox are benign and/or helpful? Are you sure that the volume of files being written there is normal? I'm talking 30,000 to 40,000 files ''per week''. I'd turn the cache back on if this were so.
cor-el
  • Top 10 Contributor
  • Moderator
17482 solutions 158000 answers

If Windows knows about JonuiCouupon then it is likely that you still have or had this software on your computer. This doesn't necessarily mean that all files identified as JonuiCouupon are actually files that belong to JonuiCouupon. You would have to remove all traces of this software and do a registry cleanup to restore the proper reporting of affected file extensions.

Did you search the registry for JonuiCouupon to see what comes up?

You can try to ask advice at a malware or Windows oriented forum if you need further help to cleanup your computer.

If Windows knows about JonuiCouupon then it is likely that you still have or had this software on your computer. This doesn't necessarily mean that all files identified as JonuiCouupon are actually files that belong to JonuiCouupon. You would have to remove all traces of this software and do a registry cleanup to restore the proper reporting of affected file extensions. Did you search the registry for JonuiCouupon to see what comes up? You can try to ask advice at a malware or Windows oriented forum if you need further help to cleanup your computer. *https://support.mozilla.org/kb/troubleshoot-firefox-issues-caused-malware