Where does this thing appear -- only in Firefox?

When does it appear, for example:

1. At startup
2. Any time you click the Home button or launch a new window (Ctrl+n)
3. Any time you open a new tab (Ctrl+t)
4. Replaces your default search engine
5. Something else

That will help us give you shorter lists of next things to try...

It happens or "appears" when I'm moving from one tap to another. And I've now tried 3 different program that are supposed to find the gd program. I've searched extensions and add-ons (I don't any of either,) And looked for programs that had been added recentlyand I'm not finding it. The suggestions I've read assume you have extensions and add-ons. That's part of what I can.t understand. The gd virus has to be attached to something. I'm at a complete loss. Sort of a fitting way to end a really horrible day.

celan2go said

It happens or "appears" when I'm moving from one tap to another.

How do you move from one tab to another. For example, click the next tab on the tab bar, press Ctrl+tab, etc.

Where does it appear? For example, shows up in place of the page you expect in the tab, pops up in a new window, etc.

Hmmm, I click on the tab, and it appears. I have absolutely no idea what you're talking about "moving for one tab to another. For example, click the next tab on the tab bar, press Ctrl+tab, etc." It sounds like you've added a step or two to go to a new tab.

As for where it appears, it fills the screen and makes it impossible to do anything else besides cursing it and the lack of articles with detailed instructions on how to get rid of the gd browser hijacking virus, that actually works, or any of the 7 or so malware programs that don't see anything wrong, despite having the f'ing hijacked browser showing itself very clearly on my computer.

There are some malware distribution pages that trigger full screen to make it difficult to avoid downloading their malware add-on. One possibility is that for some reason you keep ending up on one of those pages. But it also could be something installed into Firefox.

(1) Open the Windows Control Panel, Uninstall a Program.

After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.

Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.

(2) Check for a Firefox program folder infection. That would be in one of these locations (varies for 32-bit / 64-bit):

• C:\Program Files\Mozilla Firefox\defaults\pref
• C:\Program Files (x86)\Mozilla Firefox\defaults\pref

A file named channel-prefs.js is normal. Any other file is suspicious. Remove any such files to a neutral location for further analysis at your leisure, or bury them in the Recycle Bin. Please do not double-click .js files as that will execute them as Windows system scripts. You can right-click > Edit or right-click > Open With to view them in Notepad.

If you found a program folder infection, exit Firefox before proceeding.

(3) Open Firefox's Add-ons page using either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• in the Windows "Run" dialog, type or paste
  firefox.exe "about:addons"

In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions. All extensions are optional; the troublemaker might not be obvious from its name.

Any improvement?

(4) You can search for remaining issues with the scanning/cleaning tools listed in this support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

Success?

OK I think I might have found it. In the "Uninstall or change program" I found two Firefox program files:

Mozilla Firefox 57.0.4, (x64 en-US) Mozilla Firefox 57.0.4, (x86 en-US)

So I figure one of these is the virus. Which one please? And inadvance, thank you for all your help!

One other thing, I have ni idea if this is usual or not, but when I open the "Add-ons page, I only have three. Two are video -related files and the third is Norton Identity Safe. All of the add-ons are disabled, and both video-related add-ons have never been activated.

As for extensions, Norton Identity Safe is my only extension and it's also disabled.

I wouldn't think that program that aren't activated could be the problem. And  it would be seriously ironic if the Norton Identity Safe  (or Noton related Security software was the culprit

celan2go said

In the "Uninstall or change program" I found two Firefox program files:
Mozilla Firefox 57.0.4, (x64 en-US)
Mozilla Firefox 57.0.4, (x86 en-US)

The first is 64-bit Firefox, the second 32-bit Firefox. Usually one replaces the other, so one might be obsolete. ??

celan2go said

...when I open the "Add-ons page, I only have three. Two are video -related files and the third is Norton Identity Safe. All of the add-ons are disabled, and both video-related add-ons have never been activated.

What are the video-related extensions? Can you remove them if you never activated them?

OK Jscher2000 you have inject a bit of sanity into ,my online life! Thank you so much for all your help! One last question re: which Firefox should I delete? Based on what you wrote it seems I should get rid of "Mozilla Firefox 57.0.4, (x86 en-US)" since you mentioned that 64-bit Firefox replaces 32-bit Firefox. You don't make any mention of a 86-bit Firefox. I do know the "real" browser is up to date.

The video thing are gone.

Thanks again for suffering the clueless!

x86 refers to 32-bit. It's based on Intel's processor numbering from the old days (e.g., 80286, 80386, 80486).

Do you have multiple installations? It's possible the 64-bit installer replaced the files from the 32-bit install but didn't remove the old entry from the section of the Windows Registry from which Uninstall a Program builds its list. You can check whether you have folders in both of these places:

• {64-bit programs folder} C:\Program Files\Mozilla Firefox\
• {32-bit programs folder} C:\Program Files (x86)\Mozilla Firefox\

Thanks again for all your help. a Reset/ refresh and several more malware scans by different programs seems to have "cured" me of that plague! Now if I could innoculate myself as the "Microsoft 'your computer has been infected...etc," malware I'd be extreme;y happy. But I wonm't get carried away.