X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

config file being infected

Posted

Firefox 12.0. Window Vista Business SP2.

My new tab page is being reset to "http://u-search.net/?a=1&e=1".

First I assumed this was a one-off and went into "tools", "options", "general" tab, "home page" and reset it back to my usual preference "about:blank".

The next time I restarted Firefox it had reverted to the u-search entry again.

I've spent the afternoon scouring the net for a solution and was advised, amongst other things, to check various entries in "about:config". Sure enough there were seven different u-search entries (listed below), which I modified back to default settings. Yet the config file entries all reverted back to u-search on restart.

browser.newtab.url : http://u-search.net/?a=1&e=1 browser.search.defaultengine : u-Search browser.search.defaultenginename : u-Search browser.search.defaulturl : http://u-search.net/?a=1&e=2&q= browser.search.order.1 : u-Search browser.startup.homepage : http://u-search.net/?a=1&e=1 keyword.URL : http://u-search.net/?a=1&e=2&q=

Chosen solution

It sounds like you got infected with a malicious Third-Party Add-on.

First, update to Firefox 15.0.1. Update Firefox to the latest version

Then, try to Reset Firefox Reset Firefox – easily fix most problems

Read this answer in context 3

Additional System Details

This happened

Every time Firefox opened

This started when...

Noticed today

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

More Information

Here's a list of the processes I have tried and in this order:
1) Full scan with Comodo antivirus (no threats found)
2) Full scan with Spybot Search & Destroy (no threats found)
3) Used Spybot to cleanup registry (result: nothing to clean)
4) Used regedit32 to search the entire registry for "u-search" (nothing found)
5) Looked through Program Files folder for anything unexpected (nothing found)
6) Looked though Program Data folder for anything unexpected (nothing found)
7) Looked through App Data folders for same - again nothing unusual.
8) Clear entire Firefox history including cache and cookies
9) Reset all entries in about:config
10) Restart firefox in safe-mode
Still the problem persists. This entire list of troubleshooting had no effect whatsoever.
Does anyone have any suggestions as to how to stop u-search from installing itself in the config file?
This also raises another question: How come I am not able to lock the config file, or protect it from manipulation by external programs? For example, spybot will warn me if something tries to change the registry and asks me if it is ok to proceed - surely something similar should be applied to the Firefox config file too, no?

Tyler Downer
  • Administrator
  • Moderator
1164 solutions 6634 answers

Chosen Solution

It sounds like you got infected with a malicious Third-Party Add-on.

First, update to Firefox 15.0.1. Update Firefox to the latest version

Then, try to Reset Firefox Reset Firefox – easily fix most problems

cor-el
  • Top 10 Contributor
  • Moderator
10740 solutions 96657 answers

Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).

  • Do not click the Reset button on the Safe mode start window or otherwise make changes.

You can check for problems with preferences and try to rename or delete the prefs.js file and possible numbered prefs-##.js files and a possible user.js file to reset all prefs to the default values.

Question owner

Thanks very much. I did exactly as prescribed and yes, no sign of u-search.

I do still believe there would be benefit in optionally allowing users to accept or reject changes to the config file(s).

I also believe your prescribed suggestions should be presented prior to other problem users entering their own questions (e.g. this support site already recommended some checks before I asked my question - latest update and Firefox reset could potentially be added to that list, perhaps?)

Thanks again.

Modified by 4everdesign