Do a clean reinstall and delete the Firefox program before (re)installing a fresh copy of the current Firefox release.

• Download the full Firefox installer and save the file to the desktop
  http://www.mozilla.org/en-US/firefox/all.html

If possible uninstall your current Firefox version to cleanup the Windows registry and settings in security software.

• Do NOT remove "personal data" when you uninstall your current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions.

Remove the Firefox program before installing that newly downloaded copy of the Firefox installer.

• (32 bit Windows) "C:\Program Files\Mozilla Firefox\"
• (64 bit Windows) "C:\Program Files (x86)\Mozilla Firefox\"

• It is important to delete the Firefox program to remove all the files and make sure that there are no problems with files that were leftover after uninstalling.
• http://kb.mozillazine.org/Uninstalling_Firefox

Your bookmarks and other personal data are stored in the Firefox profile folder and won't be affected by an uninstall and (re)install, but make sure that "remove personal data" is NOT selected when you uninstall Firefox.

If you keep having problems then also create a new profile.

• http://kb.mozillazine.org/Profile_folder_-_Firefox
• http://kb.mozillazine.org/Profile_backup

• http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Clean_reinstall

cheetah13,

The technical term for this is "Stealing Focus"  :-)

I've checked the bugzilla (this was known many revisions ago and closed out). Not sure if it's cropping back up. (thus the nofocus/noaccess script fix no longer works). __________________________________________________________________________

1st, a very quick/non-technical "work around" is to hit F6.

This is a toggle for the URL bar (and whatever application you were just using). Of course this does not "Fix" the issue at hand (it stealing and you typing). ---but will get you by.

Another way to *STOP* this is to install *No Script* from the AddOns Repository. https://addons.mozilla.org/en-US/firefox/addon/noscript/

Again, the "Rogue" is still installed, but NoScript will prevent it from working. __________________________________________________________________________ Therefore you eventually want to make sure this is *GONE*

What's almost certainly happened is that a script is messing with it (nefarious or not). I'd almost bet on this.

Probably a "Script KIddie"---that didn't properly code the script. (the fact it's stealing focus into the URL bar is the giveaway for me).

__________________________________________________________________________

What I would do is to restart the browser in "Safe Mode" and see if this behavior continues to occur (most likely will not--as if it was a "Program" installed--behavior would continue--and Kaspersky should have caught the "Malware".

To start in safe mode: (top menu bar) "Help"--->Restart with add-ons disabled.

If the behavior stops, it's AddOn related/Jscript __________________________________________________________________________

• HOWEVER*---this does not mean the extensions "you" installed (especially from the Mozilla AddOns Database---causing this).

Next, check your installs. I'm assuming you're using Windows. Quickest/Best way to open Windows Installer/UNinstaller is to click Start-->Run then type

appwiz.cpl

The widow will pop open immediately. See if you see anything suspicious. Strange "Toolbar Addon" type stuff. OF course uninstall it.

__________________________________________________________________________ Finally, if you like, you can use "HiJack This" to see what "BHO's" are installed--called "Browser Help Objects"

Pretty much any download hosting site you can find this. FileHIppo/MajorGeeks,Bleeping Computer, etc.

Here's Bleeping Computer http://www.bleepingcomputer.com/download/hijackthis/

Simply do a scan and see what's installed. Open HiJack This. ---Click "Scan" (note:it's normal for it to "Hang" for 5-10 seconds before it completes---don't worry if it does that. ---Click "Save Log" (it's the same button you clicked for "Scan"

--save the file where you can most easily find/open (note-it should pop open for you--but if something nefarious installed--might prevent this).

Copy Paste the entire file.

Example of how "HiJack this" looks. (copy paste the entire contents). For Brevity sake...I chopped mine just to show what you'll see

NOTE:IT WILL BE DIFFERENT THAN WHAT YOU SEE HERE---THIS IS MY COMPUTER SET UP--PROGRAMS I'VE INSTALLED.

What you want to look for is any "BHO" that doesn't look valid. It should be "obvious" (ie. will be tied to a program that you either didn't install---*OR* recently installed and it installed an Extension not working.

I deleted all my Kaspersky FF Extensions...thus why you see only the IE folder.

__________________________________________________________________________ C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe C:\Program Files\CrashPlan\CrashPlanService.exe C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe C:\Program Files\WGA Remover\wgaremover.exe C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe C:\Program Files\PeerBlock\peerblock.exe

O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll O2 - BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll

__________________________________________________________________________ Be sure to do a "System Restore" in MSFT. Before making changes (just in case).

__________________________________________________________________________ If you don't feel comfortable deleting yourself, you can "Print to text file" the logs and I can tell you immediately if there's a rogue BHO.

FYI-Also post the results on "Bleeping Computer" for help. To download a file you don't need to register. To post of course you do.

__________________________________________________________________________ If you don't trust links from others. *grin* (a simple Google search will show you "everyone" uses it).

But, if you want a manual fix.

If it is malware, the file will (most likely) *NOT* be located in the "Extensions" folder, but located in Programs folder.

You didn't mention what version of Kaspersky you're using. However if you're running the "Suite" (firewall, antivirus,etc.) Kaspersky installs Extensions in the browser related to this..

The extensions are located in the C:\program files folders.

With Kaspersky it's C:\Program Files\Kaspersky Lab\Kaspersky(type product)\FFExt\

Extensions it installs are "Under" the FFext folder Examples

url_advisor@kaspersky.com virtual_keyboard@kaspersky.com

__________________________________________________________________________ Thus a "rouge" will most likely mimic this type install.

If your problem is rogue extension, will be located in some folder in ProgramFiles.

Should be "Obvious" (something you installed recently?). (Kaspersky could be "acting up")-if you those those extensions installed?

thanks cor-el and wheris mymindat, i tried some of the things you both advised me, and so far seems to be solved :D