Why would Malwarebytes shows potential threat to Firefox Profile
Recently I installed Malwarebytes (free version) and after scan it detect Firefox profile. What could be the threat by Firefox I can't understand?
Any advice, suggestion or help will be appreciated.
Thank you PS may be after posting I will be able to post screen shots.
Chosen solution
I think the problem is, you restarted Firefox before deleting user.js. Firefox imports user.js into prefs.js at every startup. So you'll need to clear those preferences (about:config or direct edit of prefs.js) to finally eliminate them.
Read this answer in context 👍 0All Replies (6)
Have you inspected your user.js file to see whether it is the source of the Babylon entries?
Please also note that there apparently are several related but differently named programs that are related to this issue. If you haven't scrutinized your recent installs in the Windows Control Panel, Uninstall a Program, I suggest checking. Clicking the "Installed on" column heading to group by date is useful for uncovering bundled items you may not have realized you were installing.
I have just inspected user.js and found the following, should I delete this js file?
user_pref("extensions.BabylonToolbar.autoRvrt", "false"); user_pref("extensions.BabylonToolbar_i.newTab", false); user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=50dc0e15000000000000001d0944a885&q="); user_pref("extensions.BabylonToolbar.id", "50dc0e15000000000000001d0944a885"); user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); user_pref("extensions.BabylonToolbar.instlDay", "15596"); user_pref("extensions.BabylonToolbar.vrsn", "1.6.9.12"); user_pref("extensions.BabylonToolbar.vrsni", "1.6.9.12"); user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.9.1219:57:05"); user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); user_pref("extensions.BabylonToolbar.aflt", "babsst"); user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); user_pref("extensions.BabylonToolbar.tlbrId", "base"); user_pref("extensions.BabylonToolbar.instlRef", "sst"); user_pref("extensions.BabylonToolbar.dfltLng", "en"); user_pref("extensions.BabylonToolbar.excTlbr", false); user_pref("extensions.BabylonToolbar.admin", false); user_pref("extensions.BabylonToolbar_i.babTrack", "affID=110195&tt=3712_1"); user_pref("extensions.BabylonToolbar_i.babExt", ""); user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); user_pref("extensions.mixidj.tlbrSrchUrl", ""); user_pref("extensions.mixidj.id", "50dc0e15000000000000001d0944a885"); user_pref("extensions.mixidj.appId", "{A2773ED4-83BD-488A-A186-73590706C916}"); user_pref("extensions.mixidj.instlDay", "15837"); user_pref("extensions.mixidj.vrsn", "1.8.18.8"); user_pref("extensions.mixidj.vrsni", "1.8.18.8"); user_pref("extensions.mixidj.vrsnTs", "1.8.18.88:55:45"); user_pref("extensions.mixidj.prtnrId", "mixidj"); user_pref("extensions.mixidj.prdct", "mixidj"); user_pref("extensions.mixidj.aflt", "babsst"); user_pref("extensions.mixidj.smplGrp", "none"); user_pref("extensions.mixidj.tlbrId", "mdelta"); user_pref("extensions.mixidj.instlRef", "sst"); user_pref("extensions.mixidj.dfltLng", "en"); user_pref("extensions.mixidj.excTlbr", false); user_pref("extensions.mixidj.ffxUnstlRst", false); user_pref("extensions.mixidj.admin", false); user_pref("extensions.mixidj.autoRvrt", "false"); user_pref("extensions.mixidj.rvrt", "false"); user_pref("extensions.mixidj.newTab", false);
Yes, your user.js appears to be nothing you want. And another culprit is listed: mixidj!
Hi, I have deleted user.js but now Babylon appears in pref.js see below. Does this mean Babylon extension is somewhere?
user_pref("extensions.BabylonToolbar.admin", false); user_pref("extensions.BabylonToolbar.aflt", "babsst"); user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); user_pref("extensions.BabylonToolbar.autoRvrt", "false"); user_pref("extensions.BabylonToolbar.dfltLng", "en"); user_pref("extensions.BabylonToolbar.excTlbr", false); user_pref("extensions.BabylonToolbar.id", "50dc0e15000000000000001d0944a885"); user_pref("extensions.BabylonToolbar.instlDay", "15596"); user_pref("extensions.BabylonToolbar.instlRef", "sst"); user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); user_pref("extensions.BabylonToolbar.tlbrId", "base"); user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=50dc0e15000000000000001d0944a885&q="); user_pref("extensions.BabylonToolbar.vrsn", "1.6.9.12"); user_pref("extensions.BabylonToolbar.vrsni", "1.6.9.12"); user_pref("extensions.BabylonToolbar_i.babExt", ""); user_pref("extensions.BabylonToolbar_i.babTrack", "affID=110195&tt=3712_1"); user_pref("extensions.BabylonToolbar_i.newTab", false); user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.9.1219:57:05");
Chosen Solution
I think the problem is, you restarted Firefox before deleting user.js. Firefox imports user.js into prefs.js at every startup. So you'll need to clear those preferences (about:config or direct edit of prefs.js) to finally eliminate them.
Hi, thank you for your help and all others too. I have deleted the Pref.js started Firefox and when typed Babylon there is no more entries. Refer screen shot.
It seems by the help of you guys over there I finally learned something and solved the problem.
Big thanks goes to Firefox help.
