X
Tap here to go to the mobile version of the site.

Support Forum

config file being infected

Posted

Firefox 12.0. Window Vista Business SP2.

My new tab page is being reset to "http://u-search.net/?a=1&e=1".

First I assumed this was a one-off and went into "tools", "options", "general" tab, "home page" and reset it back to my usual preference "about:blank".

The next time I restarted Firefox it had reverted to the u-search entry again.

I've spent the afternoon scouring the net for a solution and was advised, amongst other things, to check various entries in "about:config". Sure enough there were seven different u-search entries (listed below), which I modified back to default settings. Yet the config file entries all reverted back to u-search on restart.

browser.newtab.url : http://u-search.net/?a=1&e=1 browser.search.defaultengine : u-Search browser.search.defaultenginename : u-Search browser.search.defaulturl : http://u-search.net/?a=1&e=2&q= browser.search.order.1 : u-Search browser.startup.homepage : http://u-search.net/?a=1&e=1 keyword.URL : http://u-search.net/?a=1&e=2&q=

Firefox 12.0. Window Vista Business SP2. My new tab page is being reset to "http://u-search.net/?a=1&e=1". First I assumed this was a one-off and went into "tools", "options", "general" tab, "home page" and reset it back to my usual preference "about:blank". The next time I restarted Firefox it had reverted to the u-search entry again. I've spent the afternoon scouring the net for a solution and was advised, amongst other things, to check various entries in "about:config". Sure enough there were seven different u-search entries (listed below), which I modified back to default settings. Yet the config file entries all reverted back to u-search on restart. browser.newtab.url : http://u-search.net/?a=1&e=1 browser.search.defaultengine : u-Search browser.search.defaultenginename : u-Search browser.search.defaulturl : http://u-search.net/?a=1&e=2&q= browser.search.order.1 : u-Search browser.startup.homepage : http://u-search.net/?a=1&e=1 keyword.URL : http://u-search.net/?a=1&e=2&q=

Chosen solution

It sounds like you got infected with a malicious Third-Party Add-on.

First, update to Firefox 15.0.1. Update Firefox to the latest version

Then, try to Reset Firefox Refresh Firefox - reset add-ons and settings

Read this answer in context 3

Additional System Details

This happened

Every time Firefox opened

This started when...

Noticed today

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

More Information

Here's a list of the processes I have tried and in this order:
1) Full scan with Comodo antivirus (no threats found)
2) Full scan with Spybot Search & Destroy (no threats found)
3) Used Spybot to cleanup registry (result: nothing to clean)
4) Used regedit32 to search the entire registry for "u-search" (nothing found)
5) Looked through Program Files folder for anything unexpected (nothing found)
6) Looked though Program Data folder for anything unexpected (nothing found)
7) Looked through App Data folders for same - again nothing unusual.
8) Clear entire Firefox history including cache and cookies
9) Reset all entries in about:config
10) Restart firefox in safe-mode
Still the problem persists. This entire list of troubleshooting had no effect whatsoever.
Does anyone have any suggestions as to how to stop u-search from installing itself in the config file?
This also raises another question: How come I am not able to lock the config file, or protect it from manipulation by external programs? For example, spybot will warn me if something tries to change the registry and asks me if it is ok to proceed - surely something similar should be applied to the Firefox config file too, no?

Tyler Downer
  • Top 25 Contributor
  • Administrator
  • Moderator
1271 solutions 8403 answers

Chosen Solution

It sounds like you got infected with a malicious Third-Party Add-on.

First, update to Firefox 15.0.1. Update Firefox to the latest version

Then, try to Reset Firefox Refresh Firefox - reset add-ons and settings

It sounds like you got infected with a malicious Third-Party Add-on. First, update to Firefox 15.0.1. [[Update Firefox to the latest version]] Then, try to Reset Firefox [[Reset Firefox – easily fix most problems]]
cor-el
  • Top 10 Contributor
  • Moderator
12895 solutions 118298 answers

Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).

  • Do not click the Reset button on the Safe mode start window or otherwise make changes.

You can check for problems with preferences and try to rename or delete the prefs.js file and possible numbered prefs-##.js files and a possible user.js file to reset all prefs to the default values.

Start Firefox in <u>[[Safe Mode|Safe Mode]]</u> to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance). *Do not click the Reset button on the Safe mode start window or otherwise make changes. *https://support.mozilla.org/kb/Safe+Mode *https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes You can check for problems with preferences and try to rename or delete the prefs.js file and possible numbered prefs-##.js files and a possible user.js file to reset all prefs to the default values. *http://kb.mozillazine.org/Resetting_preferences *http://kb.mozillazine.org/Preferences_not_saved

Question owner

Thanks very much. I did exactly as prescribed and yes, no sign of u-search.

I do still believe there would be benefit in optionally allowing users to accept or reject changes to the config file(s).

I also believe your prescribed suggestions should be presented prior to other problem users entering their own questions (e.g. this support site already recommended some checks before I asked my question - latest update and Firefox reset could potentially be added to that list, perhaps?)

Thanks again.

Thanks very much. I did exactly as prescribed and yes, no sign of u-search. I do still believe there would be benefit in optionally allowing users to accept or reject changes to the config file(s). I also believe your prescribed suggestions should be presented prior to other problem users entering their own questions (e.g. this support site already recommended some checks before I asked my question - latest update and Firefox reset could potentially be added to that list, perhaps?) Thanks again.

Modified by 4everdesign