Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Blocked Firefox Startup page

  • 37 replies
  • 1 has this problem
  • 42 views
  • Last reply by cor-el

more options

Hi, It seem that the Firefox.exe was hacked on my PC. Namely, there is no way to get rid of some Turkish webpages like https://www[.]ahaberci[.]com/sifresiz-trabzonspor-konyaspor-canli-izle-bedava-bein-sports-1-canli-yayin-izle-justi-49375h.htm which appear on starting the Firefox. I checked for the malwares the PC with several antivirus software. I uninstalled Firefox and reinstalled it without saving data from the previous versions, with no success. I tried all methods offered by the Firefox Help, but does not work. Please, help me to fix the problem. I am attaching screenshots to illustrate the problem.

Thank you, Katalin

link broken to avoid misclicks and malware -Andrew

Attached screenshots

Modified by Andrew

Chosen solution

Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.

If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.

  • do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including personal data in profiles created by other Firefox versions

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

  • (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
  • (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"
  • it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling

Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.

If you keep having problems then you can create a new profile as a quick test to see if your current profile is causing the problem.


Reinstall Firefox

Read this answer in context 👍 0

All Replies (17)

more options

Did you check the content of the local-settings.js file you mentioned to check to what cfg file it links ?

The screenshot shows a moz-extension://<UUID> link and such a link is added by an extension. You can search the about:debugging page via the location/address bar (This Firefox) to see if this UUID is listed.

Helpful?

more options

This is what I see there. According to the text, there is no document opened.

Helpful?

more options

Can you follow steps 8-12 to verify your shortcut?

https://www.support.com/how-to/how-to-fix-a-browser-hijack-on-mozilla-firefox-12586

Can you click on the menu, then click on Help, then click on Troubleshooting Information and post a screenshot of the add-on section like mine. see screenshot

Also, do you have the same issue when you log into another windows account?

Helpful?

more options

Just a question for me... When you edit what's in my screenshot, is something changing it back. see screenshot

Helpful?

more options

After cleaning all the history the screenshot looks as attached.

Helpful?

more options

how about the Firefox shortcut?

Modified by jonzn4SUSE

Helpful?

more options

Hurrah, Jon. You saved my day. However, I cannot understand how it worked. Namely, I went through the troubleshooting several times before I asked for help. The Properties of the exe file were correct all the time. Today was the first time the site code appeared after "C:\Program Files\Mozilla Firefox\firefox.exe". Now, I deleted it and it did not return. All other inspections showed the, correct line, but the browser started with the Turkish site. Anyway, I restarted not only Firefox, but the PC, and now everything is correct. The Startup is not any more unavailable, too. Many thanks, :) Katalin

Helpful?

more options

I wonder whether it is possible to lock preferences in a user.js file or directly in prefs.js ??

Does the Troubleshooting Information page indicate that there is a user.js file overriding settings in your Firefox? Either:

  • "3-bar" menu button > "?" Help > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter/Return

Use Find (Ctrl+f) to find the user.js section in the page, if any. Does it say there is such a file?

Helpful?

more options

Katalin said

The Properties of the exe file were correct all the time. Today was the first time the site code appeared after "C:\Program Files\Mozilla Firefox\firefox.exe". Now, I deleted it and it did not return.

You might check the Windows Task Scheduler to see whether there is anything that could have run between the time you checked last and this time. That is one method malware uses for reinserting or re-launching an attack. In the Windows search box (on the Taskbar, usually) enter task scheduler to launch that app. It's easiest to view the list at the top level rather than checking in folders for specific programs, although you could look in those, too.

Helpful?

more options

No, there is no user.js there.

Helpful?

more options

Yeah, I wouldn't be surprised if it came back. Some process put it there.

Helpful?

more options

user.js can't lock a pref. Only GPO or policies.json or an autoconfig file can do this.

I asked above what content is in the local-settings.js file in "defaults\pref" you mentioned and to what .cfg file at the main level it linked (possibly mozilla.cfg or autoconfig.cfg).

Did you look into this ?

See also:

Helpful?

more options

Unfortunately, I do not remember. I could not find any *.cfg file now. It is possible that I still have some malware, as now Google chrome (Slimjet) started to behave unusually. All malware checkers and antivirus programs show that the PC is clean. I always took care what I opened in the browser, but still I might open something accidentally.

Helpful?

more options

Is slimjet the site that opens at startup? More info please.

Helpful?

more options

Chosen Solution

Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.

If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.

  • do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including personal data in profiles created by other Firefox versions

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

  • (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
  • (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"
  • it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling

Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.

If you keep having problems then you can create a new profile as a quick test to see if your current profile is causing the problem.


Reinstall Firefox

Helpful?

more options

Slimjet opens correctly, but starts to lose the connection. Also, I cannot open some sites. They said something about increased security, and opens only https sites. However, Sciecedirect is a safe site, so I do not know what is happening. Slimjet has some handy options - download documents directly in pdf instead of html, copies parts of the page as jpg, etc., but Firefox is my default browser.

Helpful?

more options

If you have enabled HTTPS-Only then you can click the padlock icon on the location bar to possibly disable HTTPS-Only if you need to connect to a website that only works with HTTP.

Helpful?

  1. 1
  2. 2
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.