How can I get rid of whatever hijacked my Firefox home page and substituted a Bank of America login page?
How can I get rid of whatever hijacked my Firefox 12 home page and substituted a "Bank of America" login page? I have reset my home page in Options, but that doesn't help. I suspect there is a rogue entry in my Windows Vista Registry. I tried to get rid of it with several antivirus programs, including MS Security Essentials, Avast, Spyware Doctor and Malwarebytes, but none removed the offending hijacker. Help would be appreciated.
Additional System Details
Every time Firefox opened
This started when...
Three or four days ago, but I'm not sure of the circumstances. Could have been after logging in to Google Talk.
- Shockwave Flash 11.2 r202
- Picasa plugin
- NPRuntime Script Plug-in Library for Java(TM) Deploy
- Next Generation Java Plug-in 10.4.1 for Mozilla browsers
- Nitro PDF Plug-in for Firefox and Chrome
- Google Update
- iTunes Detector Plug-in
- The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
- The plug-in allows you to open and edit files using Microsoft Office applications
- Office Authorization plug-in for NPAPI browsers
- User Agent: Mozilla/5.0 (Windows NT 6.0; rv:12.0) Gecko/20100101 Firefox/12.0
for a likely solution see the How to fix preferences that won't save help article, especially the part about the user.js file in your profile folder!
Madperson: You were correct: the offending line of code was in the user.js file. After deleting it, the problem was solved. Many, many thanks!
I did that fix but it just keeps coming back after a while!!!
hello jf, it's likely that some sort of malware is still active on your pc. please run a full scan of your system with different tools...
Do you know what the malware is? I have run 2 different scans and it still reverts back to the bank of america website.
hello, i'm not exactly sure what kind of malware it is - but according to this forum, running combofix did got rid of the infection: http://www.techspot.com/community/top.../#post-1179169
Create a new profile as a test to check if your current profile is causing the problems.
See "Basic Troubleshooting: Make a new profile":
There may be extensions and plugins installed by default in a new profile, so check that in "Tools > Add-ons > Extensions & Plugins" in case there are still problems.
If the new profile works then you can transfer some files from the old profile to that new profile, but be careful not to copy corrupted files.