X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How can I get rid of whatever hijacked my Firefox home page and substituted a Bank of America login page?

Posted

How can I get rid of whatever hijacked my Firefox 12 home page and substituted a "Bank of America" login page? I have reset my home page in Options, but that doesn't help. I suspect there is a rogue entry in my Windows Vista Registry. I tried to get rid of it with several antivirus programs, including MS Security Essentials, Avast, Spyware Doctor and Malwarebytes, but none removed the offending hijacker. Help would be appreciated.

Chosen solution

for a likely solution see the How to fix preferences that won't save help article, especially the part about the user.js file in your profile folder!

Read this answer in context 1

Additional System Details

This happened

Every time Firefox opened

This started when...

Three or four days ago, but I'm not sure of the circumstances. Could have been after logging in to Google Talk.

Installed Plug-ins

  • Shockwave Flash 11.2 r202
  • Picasa plugin
  • 5.1.10411.0
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 10.4.1 for Mozilla browsers
  • Nitro PDF Plug-in for Firefox and Chrome
  • Google Update
  • iTunes Detector Plug-in
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • GEPlugin
  • The plug-in allows you to open and edit files using Microsoft Office applications
  • Office Authorization plug-in for NPAPI browsers
  • 2.0.0048.0
  • 1.9.0009.1

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0; rv:12.0) Gecko/20100101 Firefox/12.0

More Information

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

Chosen Solution

for a likely solution see the How to fix preferences that won't save help article, especially the part about the user.js file in your profile folder!

Question owner

Madperson: You were correct: the offending line of code was in the user.js file. After deleting it, the problem was solved. Many, many thanks!

jfrancisco 0 solutions 2 answers

I did that fix but it just keeps coming back after a while!!!

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

hello jf, it's likely that some sort of malware is still active on your pc. please run a full scan of your system with different tools...

Troubleshoot Firefox issues caused by malware

jfrancisco 0 solutions 2 answers

Do you know what the malware is? I have run 2 different scans and it still reverts back to the bank of america website.

philipp
  • Top 10 Contributor
  • Moderator
2042 solutions 8887 answers

hello, i'm not exactly sure what kind of malware it is - but according to this forum, running combofix did got rid of the infection: http://www.techspot.com/community/top.../#post-1179169

cor-el
  • Top 10 Contributor
  • Moderator
10740 solutions 96657 answers

Create a new profile as a test to check if your current profile is causing the problems.

See "Basic Troubleshooting: Make a new profile":

There may be extensions and plugins installed by default in a new profile, so check that in "Tools > Add-ons > Extensions & Plugins" in case there are still problems.

If the new profile works then you can transfer some files from the old profile to that new profile, but be careful not to copy corrupted files.

See: