config file being infected
Firefox 12.0. Window Vista Business SP2.
My new tab page is being reset to "http://u-search.net/?a=1&e=1".
First I assumed this was a one-off and went into "tools", "options", "general" tab, "home page" and reset it back to my usual preference "about:blank".
The next time I restarted Firefox it had reverted to the u-search entry again.
I've spent the afternoon scouring the net for a solution and was advised, amongst other things, to check various entries in "about:config". Sure enough there were seven different u-search entries (listed below), which I modified back to default settings. Yet the config file entries all reverted back to u-search on restart.
browser.newtab.url : http://u-search.net/?a=1&e=1 browser.search.defaultengine : u-Search browser.search.defaultenginename : u-Search browser.search.defaulturl : http://u-search.net/?a=1&e=2&q= browser.search.order.1 : u-Search browser.startup.homepage : http://u-search.net/?a=1&e=1 keyword.URL : http://u-search.net/?a=1&e=2&q=
Additional System Details
Every time Firefox opened
This started when...
- User Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
Here's a list of the processes I have tried and in this order:
1) Full scan with Comodo antivirus (no threats found)
2) Full scan with Spybot Search & Destroy (no threats found)
3) Used Spybot to cleanup registry (result: nothing to clean)
4) Used regedit32 to search the entire registry for "u-search" (nothing found)
5) Looked through Program Files folder for anything unexpected (nothing found)
6) Looked though Program Data folder for anything unexpected (nothing found)
7) Looked through App Data folders for same - again nothing unusual.
8) Clear entire Firefox history including cache and cookies
9) Reset all entries in about:config
10) Restart firefox in safe-mode
Still the problem persists. This entire list of troubleshooting had no effect whatsoever.
Does anyone have any suggestions as to how to stop u-search from installing itself in the config file?
This also raises another question: How come I am not able to lock the config file, or protect it from manipulation by external programs? For example, spybot will warn me if something tries to change the registry and asks me if it is ok to proceed - surely something similar should be applied to the Firefox config file too, no?
It sounds like you got infected with a malicious Third-Party Add-on.
First, update to Firefox 15.0.1. Update Firefox to the latest version
Then, try to Reset Firefox Refresh Firefox - reset add-ons and settings
Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).
- Do not click the Reset button on the Safe mode start window or otherwise make changes.
You can check for problems with preferences and try to rename or delete the prefs.js file and possible numbered prefs-##.js files and a possible user.js file to reset all prefs to the default values.
Thanks very much. I did exactly as prescribed and yes, no sign of u-search.
I do still believe there would be benefit in optionally allowing users to accept or reject changes to the config file(s).
I also believe your prescribed suggestions should be presented prior to other problem users entering their own questions (e.g. this support site already recommended some checks before I asked my question - latest update and Firefox reset could potentially be added to that list, perhaps?)
Modified by 4everdesign