X
Tap here to go to the mobile version of the site.

Support Forum

Firefox forgets homepage, theme addons, and some settings every time I boot my laptop. Tried many fixes but none work?

Posted

This issue started happening right after updating to Firefox 42, I think. What happens is that every time my Windows 10 laptop boots up and I start Firefox (and sometimes after signing out of and back into my Windows profile), the browser acts as if it just updated, and it also checks for addon compatibility [see image 1]. I get the "Firefox + Windows 10 = Perfect Together" page, and my homepage has been reset to "search.domaincentar.com" [see image 2],although it shows a Google logo. My theme and some miscellaneous browser settings are gone too.

I change all these settings back to the way they were, but this happens every time I reboot without fail. Here are the things I've tried: Refreshing/resetting Firefox. Creating a new Firefox profile. Deleting prefs.js and other possible culprit files in my current profile. (no user.js present) Reinstalling Firefox completely. Updating to Firefox 43 beta. Deleting the Mozilla folder from %appdata%.

...and different combinations of all the above. The bare fact is that even after a COMPLETE wipe of Firefox from my laptop, including removing all my profile info to a separate location, this keeps happening. The homepage being reset to a weird search page seems like adware or malware, but I haven't been able to detect any via scan or looking in my addons. I am truly baffled, and at your mercy.

This issue started happening right after updating to Firefox 42, I think. What happens is that every time my Windows 10 laptop boots up and I start Firefox (and sometimes after signing out of and back into my Windows profile), the browser acts as if it just updated, and it also checks for addon compatibility [see image 1]. I get the "Firefox + Windows 10 = Perfect Together" page, and my homepage has been reset to "search.domaincentar.com" [see image 2],although it shows a Google logo. My theme and some miscellaneous browser settings are gone too. I change all these settings back to the way they were, but this happens every time I reboot without fail. Here are the things I've tried: Refreshing/resetting Firefox. Creating a new Firefox profile. Deleting prefs.js and other possible culprit files in my current profile. (no user.js present) Reinstalling Firefox completely. Updating to Firefox 43 beta. Deleting the Mozilla folder from %appdata%. ...and different combinations of all the above. The bare fact is that even after a COMPLETE wipe of Firefox from my laptop, including removing all my profile info to a separate location, this keeps happening. The homepage being reset to a weird search page seems like adware or malware, but I haven't been able to detect any via scan or looking in my addons. I am truly baffled, and at your mercy.
Attached screenshots

Chosen solution

Do a malware check with several malware scanning programs on the Windows computer.

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure that you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.

See also:

Read this answer in context 1

Additional System Details

Installed Plug-ins

  • Shockwave Flash 19.0 r0

Application

  • User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0

More Information

FredMcD
  • Top 10 Contributor
4246 solutions 59401 answers

https://support.mozilla.org/en-US/kb/how-to-fix-preferences-wont-save

Note: Some software, like Advanced SystemCare with Surfing Protection, can protect files in the Firefox profile folder against changes. If you have such software then check the settings or uninstall this software.

'''https://support.mozilla.org/en-US/kb/how-to-fix-preferences-wont-save''' Note: Some software, like Advanced SystemCare with Surfing Protection, can protect files in the Firefox profile folder against changes. If you have such software then check the settings or uninstall this software.

Question owner

I don't have anything like that, but I do use Avast Antivirus, and tried booting Firefox without it on, but there was no effect. I can still make changes to the Firefox profile folder, but everything seems to reset on PC restart.

Here are some plugins I have that I didn't install myself, if any of them are the kind of software you mentioned: ABD Helper, Valence, Adobe Primetime Content Decryption Module, Cisco OpenH264 Video Codec. I doubt any of those are the issue, though.

I don't have anything like that, but I do use Avast Antivirus, and tried booting Firefox without it on, but there was no effect. I can still make changes to the Firefox profile folder, but everything seems to reset on PC restart. Here are some plugins I have that I didn't install myself, if any of them are the kind of software you mentioned: ABD Helper, Valence, Adobe Primetime Content Decryption Module, Cisco OpenH264 Video Codec. I doubt any of those are the issue, though.
FredMcD
  • Top 10 Contributor
4246 solutions 59401 answers

Start Firefox in Safe Mode {web Link} by holding down the <Shift>
(Mac Options)
key, and then starting Firefox. Is the problem still there?


Start your Computer in safe mode with networking. Then start Firefox. Try Safe web sites. Is the problem still there?

Starting The Computer In Safe Mode;
Free Online Encyclopedia

Start '''[https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode Firefox in Safe Mode]''' {web Link} by holding down the '''<Shift><br> ''(Mac Options)'' ''' key, and then starting Firefox. Is the problem still there? ------------ Start your '''Computer''' in safe mode with networking. Then start Firefox. Try '''Safe''' web sites. Is the problem still there? '''[http://encyclopedia2.thefreedictionary.com/Linux+Safe+Mode Starting The Computer In Safe Mode;<br>Free Online Encyclopedia]'''
cor-el
  • Top 10 Contributor
  • Moderator
17474 solutions 157940 answers

Chosen Solution

Do a malware check with several malware scanning programs on the Windows computer.

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure that you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.

See also:

Do a malware check with several malware scanning programs on the Windows computer. *https://support.mozilla.org/kb/troubleshoot-firefox-issues-caused-malware Please scan with all programs because each program detects different malware. All these programs have free versions. Make sure that you update each program to get the latest version of their databases before doing a scan. *Malwarebytes' Anti-Malware:<br>http://www.malwarebytes.org/mbam.php *AdwCleaner:<br>http://www.bleepingcomputer.com/download/adwcleaner/<br>http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml *SuperAntispyware:<br>http://www.superantispyware.com/ *Microsoft Safety Scanner:<br>http://www.microsoft.com/security/scanner/en-us/default.aspx *Windows Defender:<br>http://windows.microsoft.com/en-us/windows/using-defender *Spybot Search & Destroy:<br>http://www.safer-networking.org/en/index.html *Kasperky Free Security Scan:<br>http://www.kaspersky.com/security-scan You can also do a check for a rootkit infection with TDSSKiller. *Anti-rootkit utility TDSSKiller:<br>http://support.kaspersky.com/5350?el=88446 See also: *"Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

Question owner

I used all the antivirus programs on the list, except for SpyBot, because I don't really like that one. But AdwCleaner turned up some interesting things [see next post for full .txt log file]. The one I think could be a culprit was something hooked into the prefs.js file regarding startup of Firefox and a search engine, 2 of my symptoms. After reboot, the problem seemed to be gone. It is a bit confusing though, because I've deleted prefs.js multiple times and Yahoo wasn't the browser page set to Home, although it did sometimes become the default search engine after a reboot.

But either way, after another reboot, the problem came back. So I ran Malwarebytes, which turned up something [see image]. Deleted that file, and have rebooted twice now. Everything seems fine!

Any ideas on what might've caused these problems with Firefox, or what that trojan file in the image might've been? I'll check back tomorrow to let you know if the problem crops up again.

I used all the antivirus programs on the list, except for SpyBot, because I don't really like that one. But AdwCleaner turned up some interesting things '''[see next post for full .txt log file]'''. The one I think could be a culprit was something hooked into the prefs.js file regarding startup of Firefox and a search engine, 2 of my symptoms. After reboot, the problem seemed to be gone. It is a bit confusing though, because I've deleted prefs.js multiple times and Yahoo wasn't the browser page set to Home, although it did sometimes become the default search engine after a reboot. But either way, after another reboot, the problem came back. So I ran Malwarebytes, which turned up something '''[see image]'''. Deleted that file, and have rebooted twice now. Everything seems fine! Any ideas on what might've caused these problems with Firefox, or what that trojan file in the image might've been? I'll check back tomorrow to let you know if the problem crops up again.

Question owner

Here are AdwCleaner's results:

# AdwCleaner v5.022 - Logfile created 24/11/2015 at 21:10:51
# Updated 22/11/2015 by Xplode
# Database : 2015-11-22.2 [Server]
# Operating system : Windows 10 Home  (x64)
# Username : Cave Johnson2 - GLADOS
# Running from : C:\Users\Cave Johnson2\Downloads\adwcleaner_5.022.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files\kmspico
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\kmspico
[-] Folder Deleted : C:\WINDOWS\Search

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

[-] Task Deleted : AdobeAAMUpdater-1.0-GLADOS-Cave Johnson2

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\S

***** [ Web browsers ] *****

[-] [C:\Users\Cave Johnson2\AppData\Roaming\Mozilla\Firefox\Profiles\73fy2swy.default-1448077827051\prefs.js] [Preference] Deleted : user_pref("startpage.ntsearch_url", "hxxps://search.yahoo.com/search?fr=spigot-nt-ff&ei=utf-8&ilc=12&type=0&p={searchTerms}");

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1453 bytes] ##########
Here are AdwCleaner's results: <pre><nowiki># AdwCleaner v5.022 - Logfile created 24/11/2015 at 21:10:51 # Updated 22/11/2015 by Xplode # Database : 2015-11-22.2 [Server] # Operating system : Windows 10 Home (x64) # Username : Cave Johnson2 - GLADOS # Running from : C:\Users\Cave Johnson2\Downloads\adwcleaner_5.022.exe # Option : Cleaning # Support : http://toolslib.net/forum ***** [ Services ] ***** ***** [ Folders ] ***** [-] Folder Deleted : C:\Program Files\kmspico [-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\kmspico [-] Folder Deleted : C:\WINDOWS\Search ***** [ Files ] ***** ***** [ DLLs ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled tasks ] ***** [-] Task Deleted : AdobeAAMUpdater-1.0-GLADOS-Cave Johnson2 ***** [ Registry ] ***** [-] Key Deleted : HKLM\SOFTWARE\Classes\S ***** [ Web browsers ] ***** [-] [C:\Users\Cave Johnson2\AppData\Roaming\Mozilla\Firefox\Profiles\73fy2swy.default-1448077827051\prefs.js] [Preference] Deleted : user_pref("startpage.ntsearch_url", "hxxps://search.yahoo.com/search?fr=spigot-nt-ff&ei=utf-8&ilc=12&type=0&p={searchTerms}"); ************************* :: "Tracing" keys removed :: Winsock settings cleared ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1453 bytes] ##########</nowiki></pre>

Modified by cor-el

cor-el
  • Top 10 Contributor
  • Moderator
17474 solutions 157940 answers

Looks that you had an infection with Spigot software.

You can check in "Windows Control Panel > Programs" for recently installed programs to see if any suspicious software (Spigot/Conduit) shows up.

  • Control Panel > Programs > Programs and Features > Uninstall or change a program
  • Click the Installed column to sort by this heading
Looks that you had an infection with Spigot software. You can check in "Windows Control Panel > Programs" for recently installed programs to see if any suspicious software (Spigot/Conduit) shows up. *Control Panel > Programs > Programs and Features > Uninstall or change a program *Click the Installed column to sort by this heading *http://www.spigot.com/about/contact-us/uninstall-spigot-toolbar/