pups prefs.js keep coming back found by malwarebytes plus several tries to hack my email account
I found some infos but I do not trust myself just deleting the files in question since they ared all over my system. The following I found per malwarebytes which found the pups every day up to now:
PUP.Optional.DefaultSearch is Malwarebytes’ detection name for a family of browser hijackers targeting Chrome, Firefox and Internet Explorer. Symptoms The browsers’ default search engine was changed to one that belonged to the threat-actors. I am german so probably I need your patience in helping me to clean my system resp. Mozilla.
Looking forward Ingrid
Réiteach roghnaithe
Hi Ingrid, along the lines of cor-el's last reply, can you find these preferences if you check internally in Firefox itself:
(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button accepting the risk.
(2) In the search box in the page, type or paste this search pattern: newtab*url
Firefox should filter the list and show any current matches.
Do you see either of the ones cor-el discovered in your pastebin file?
cor-el said
Could be about these lines in the YABwy5Hk file: user_pref("browser.newtab.url", "https://defaultsearch.co/homepage?hp=1&pId=CH180901FF&iDate=2020-07-07 12:48:23&bName=&bitmask=0600"); user_pref("browser.newtabpage.url", "https://defaultsearch.co/homepage?hp=1&pId=CH180901FF&iDate=2020-07-07 12:48:23&bName=&bitmask=0600");
Note: these preferences are ignored by Firefox, so they are harmless, but Malwarebytes still doesn't like them.
(3) To remove an unwanted alien preference, click the trash can icon at the end of the row.
Firefox will change the row to showing a bar to re-add the preference. Ignore that bar, you don't want to re-add it.
More info on about:config: Configuration Editor for Firefox.
Hopefully that will flush it and make Malwarebytes happy.
Read this answer in context 👍 0All Replies (4)
Hello,
I am glad to hear that your problem has been resolved. If you haven't already, please select the answer that solves the problem. This will help other users with similar problems find the solution.
Thank you for contacting Mozilla Support.
iethomas said
Beside the current Profile - ESR - there are three others. Why are they there and should I keep or delete them?
You can keep or remove them if you don't need/want them.
iethomas said
One last question: Beside the current Profile - ESR - there are three others. Why are they there and should I keep or delete them?
Hi Ingrid, where do you see multiple profiles? Is that on the about:profiles page?
If there is a profile that none of your currently running installations of Firefox are using, that page will allow you to delete it.
New profiles may be created if a different flavor of Firefox is installed, or an older version, or if your profile is locked when Firefox starts up. We would just be guessing as to exactly what occurred on your computer. If you're not sure, you can use the "Open Folder" button for the "Root directory" for profiles that are not in use to see how old its files are.
You can check the compatibility.ini file in a profile to see what Firefox version and installation path last used the profile.
I see them in the about:profiles page and I decided to delete all three.
Thanks again for all your help.