Firefox Support Forum

Hi guys,

I don't know when and how exactly this thing was added to my firefox behind my back, I don't like it, I don't like Baidu Pan either but I have to use it.

I checked the extensions and add-ons, nothing suspicious was found.

Can you please help me remove it?

I found some infos but I do not trust myself just deleting the files in question since they ared all over my system. The following I found per malwarebytes which found the pups every day up to now:

PUP.Optional.DefaultSearch is Malwarebytes’ detection name for a family of browser hijackers targeting Chrome, Firefox and Internet Explorer. Symptoms The browsers’ default search engine was changed to one that belonged to the threat-actors. I am german so probably I need your patience in helping me to clean my system resp. Mozilla.

Looking forward Ingrid

Hello. Im new to the Mozilla Support community

I am running a Japanese Windows XP SP3 on VMWare Workstation 16, i have downloaded a old version of firefox, due to newer versions not working on xp

And heres the issue: Firefox keeps opening tabs randomly which are related to pornographic websites like xxnx, pornhub, evilangel n' etc..

Heres things ive tried, but didnt work: -Install tdsskiller & scan -Scan with Avast Antivirus -Uninstalling Firefox and delete registry entries -Getting IE8 or G**gle Chr*me for Windows XP SP3

Any way to resolve this problem? i can't watch these things!

I'm running 96.0.3 on a fully patched Win 10 Pro system - both O/S and programs. When Firefox is running I'm getting these pop-up error messages randomly with changing content. They stay on screen for some seconds and then go away. Message states it's from (via) 5.back2yard.biz. I put that in my hosts file and I'm still getting them. My network is a cable modem hooked to Xfinity and then cable connected to another fully newer patched router. All addresses are 10. range. I ran both a Malwarebytes scan and a Windows Security scan - both are clean.

I'm unable to upload a small image after a hour so I'll give up on that right now.

Hello Mozilla community! Merry Christmas!

I have noticed since yesterday (but maybe it is related to the 95.0.2 Firefox update) that Firefox tries to access some weird websites each time it starts.

The websites Firefox tries to access are various (non-exhaustive list):

• itchytidying.com
• jollytestpartying.com
• dateddeed.com
• censusmiles.com
• unpleasantconcrete.com
• pacifyrespirator.com
• (...)

Kaspersky Internet Security blocks all those access attempts and notifies me with a "Download denied" event and a "Probability of unauthorized software download" message (see uploaded image).

I immediately suspected one of my Firefox extensions, so I disabled them all... But the issue kept on occurring. Could Firefox be infected? (I ran Kaspersky Internet Security through my whole PC, and it found nothing ; I did the same with the free version of MalwareBytes ; nothing again).

I find it hard to believe that this behavior is normal and that these alerts are false positives from Kaspersky Internet Security... What do you think guys?

Regards, Jerome.

bp-186b028e-4571-4ea8-8dd6-e13c40211120

bp-b9a18a59-0808-43e2-a103-0c4580211120

bp-88a97ccf-6ac8-4669-9265-a1e3b0211120

bp-1c47ef47-258a-4ad6-92ee-97aee0211120

bp-8652fdde-3903-4415-8dc8-10cf20211120

bp-13ade298-bb74-45ca-8912-af80c0211120

Long story short: Whenever I open Firefox, apparently a Russian search engine named 'Poshukach' hijacks my homepage and doesn't let me use google(Image attached). Now to solve this I scoured the Internet. I refreshed Firefox, ran malware scans and even re-installed windows. Still it doesn't go away. I installed Firefox in another device with the same account but to no avail. They while roaming through Firefox settings I noticed in the top that it says 'Your browser settings is managed by your organization' or something like that. So, I figured bad guys took control of my browser's settings disguising as my so called "organization" So, I need help from Firefox's end to solve this. Remove this Organization management stuff from my account. I want my control back. Otherwise, I am afraid I gotta stop using Firefox altogether due to privacy reasons

good day. two days ago I was infected by poshukach probably when downloading Opera browser or a torrente file. So, whenever I initiate firefox I am redirected to poshukach browser instead. Question is: how can I get rid of poshukach? Thanks a lot

Each morning, when I first cold boot my computer, the moment I open my Firefox browser, I receive numerous (10+) identical error messages from Bitdefender:

Suspicious connection blocked: Feature: Online Threat Prevention

firefox.exe attempted to establish a connection relying on an unmatching security certificate to content-signature-2.cdn.mozilla.net. We blocked the connection to keep your data safe since the used certificate was issued for a different web address than the targeted one.

Question: Is this ACTUALLY coming from Firefox? If so, please match your security certificates! If that's impossible due to a technical issue, then please email me your confirmation so that I can add an exception to Bitdefender.

Question: If it's not coming from Firefox, please email me, letting me know what additional system information you require so that we can get to the bottom of who/what is masquerading as Firefox while attempting to establish an unauthorized Internet connection from my computer.

HP Envy laptop, Windows 10 OS, latest update.

This has been occurring for several months.

Thank you for your time.

I mistakenly loaded a browser called Freshy Search. I was trying to access a CarMax type program, and Freshy downloaded. I now get the Freshy search window every time I open a new tab on Firefox. I want to delete Freshy from my computer. Thanks

Last night my Firefox 94.0.2 was hacked. When running Firefox, it would lock up my desktop. It disabled Norton Security, it disable other installed security software, and it disabled Windows System Restore. The hacker put up a message claiming to be Microsoft Support, with a phone number to call for help. This was a scam. I ran Firefox refresh, and that removed the hacker's program from Firefox, but then I had to do a full repair of my Window's installation. To protect my system, and prevent this from happening again, I added "xpinstall.enabled = false" into about.config. Please let me know if this will prevent a web site from installing a dangerous hack into Firefox, or if there is something else that I need to do. I have used Firefox for years, and have never encountered this problem before. Firefox is my favorite browser, but I am now afraid to use it. Please advise me what to do. Thanks, Jim

I've noticed this happening in the past week. Example #1 I used Google search to look for Japanese dogs & clicked on Wikipedia In addition a tab on debt popped up on its own. Here's a link to it: https://go.debthelpguide.com/api/offer

Example #2 I logged into citi.com to check my credit card activity In addition a tab which was of a sexual nature popped up on its own. I was so shocked I didn't think of saving a link for it.

It doesn't happen on all tabs I am using. Thank you in advance for your help.

I have incurred a browser hijacker that I can't seem to get rid of as no anti virus that I've tried will recognise it. The hijacker is defaultsearch.nchuser. The 'Refresh Firefox button is not working at the moment. Please help me to remove this pest. Thank you.

Hallo everyone! i have now a couple of days (search marquis) coming up when i start Mozilla :( I have on my Macbook MacAffe protection, but i dont know how to get out this Search Marquis ... Pls can anybody help me with that ?

Hi.I would like to know how i can stop this site from constantley trying to connect with my P.C.luckeley my firewall stops it but eventully they will succeed.Iplayed it a long time ago.I stopt,deleted my account but they keep attacing several times a day.I,ll be gratefull with any help\advise about this.i tryed acsessing the page sourse and i think i,ve only made it worse.

I want to opt out of the new (slower than molasses) "trusted partner redirect" Firefox gave me ONE chance for 3 seconds before closing the option window.

This has resulted in slowing down an already too slow event in Firefox. This is why users are going to chrome.

It's a great idea as an option. Not a great idea to force it on users.

Thanks for your help,

Following site is immediately hijacked to a scam site asking for login apparently to access private info. It happens with Firefox (only) whenever security setups are set "not to track", "not to prompt for passwords", "not to prompt for credit cards" "no history" "reset of cookies at logout" etc.. then the site below: http://thaimassage-herborn.de/ is redirected to SCAM SITE: https://xb7.serverdomain.org/admin/index.php appearing as "Adminpanel" asking for Login etc..

At the same time following site is partially blocked on the news banner pictures, with a white sheet over them, whenever down scroll is hit. https://www.tgrthaber.com.tr/

Only by resetting firefox deals with the issues. But ofcourse with the reason, above security settings removed.

Virusscanner was not able to detect this hijacking or the reason behind.

Is this a firefox software issue? Is there a way to resolve this? Thank you already for any support or suggestions to resolve.

My computer was totally locked, even after I did hard reboot. Message on screen said to call "Microsoft" to unlock. It was not MS, but a company that "represented" MS. I don't know how they did gained access or if they are legitimate or scammers. Name of company is "Instantlivehelps" or Supreme Store. They wanted $350 to unlock the computer, which I have not yet paid. I have firefox, windows 10, and Norton 360 with lifelock and a secure VPN. Is there anything about Firefox that could have helped prevent this and if so, what can I do? I run a store off, so I have to be accessible. Also, I am very much a novice at this. Thanks.

Firefox updated yesterday to ver 90.0.1 (64-bit). Today when I open Firefox browser, Malwarebytes blocks an exploit with thiis message: Malwarebytes www.malwarebytes.com

-Log Details- Protection Event Date: 7/21/21 Protection Event Time: 1:37 PM Log File: 577494dc-ea4a-11eb-a649-54bf641896a0.json

-Software Information- Version: 4.4.2.123 Components Version: 1.0.1358 Update Package Version: 1.0.43331 License: Premium

-System Information- OS: Windows 10 (Build 19043.1110) CPU: x64 File System: NTFS User: System

-Exploit Details- File: 0 (No malicious items detected)

Exploit: 1 Malware.Exploit.Agent.Generic, , Blocked, 0, 392684, 0.0.0, ,

-Exploit Data- Affected Application: Mozilla Firefox (and add-ons) Protection Layer: Protection Against OS Security Bypass Protection Technique: Exploit ROP gadget attack blocked File Name: URL:

(end)

When I open in safe mode, no problem. I can not find the extension causing the problem