Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Need help with removal of Brand Thunder remnants from about:config.

more options

I unknowingly installed what I had thought been a persona from another site, but was actually the Brand Thunder extension Personas Interactive, which changed the new tab page and added other unwanted malware/adware and a virus. I have removed the persona and the add-on, but I think I should have disabled them first and done so in safe mode, not sure. The new tab page is now back to how I had it, but there seems to be some remnants in the about:config. Some are obvious, others I'm not so sure what they are and if they are even part of the leftovers. I'd like to know which ones are the remnants and if they are safe to remove from about:config.

These are the entries I found:

extensions.brandthunder.btpersonas.currentPersona user set string 437428

extensions.brandthunder.btpersonas.firstrun user set boolean false

extensions.brandthunder.btpersonas.installedTheme user set string 0b40d759-9986-49cb-ad76-389a3f8fb425@brandthunder.com

extensions.brandthunder.btpersonas.installedVersion user set string 1.6.2.8

extensions.brandthunder.keywordSearch user set boolean true

extensions.btMetricsLite.bid user set string ec4bda537a757075a580afa1ed8d3647

extensions.btpersonas@brandthunder.com.install-event-fired user set boolean true

browser.search.selectedEngine user set string WebSearch+ (this is in bold)


When I typed BrandThunder.com in the filter, there was three results, two of which are listed above. The third one:

extensions.register@pgport.com.data user set string {ef522540-89f5-46b9-b6fe-1829e2b572c6},0,9999,999.999.999,9999,|{c50ca3c4-5656-43c2-a061-13e717f73fc8},5300,5300,4.0.1,5300,fvd|fvd@kallout.com,5200,5200,4.0.1,5200,fvd|fbg@pgport.com,0,5100,1.6.2.8,4600,|kosa@kallout.com,5000,5000,2.0.1,5000,sm|ytvdh@pgport.com,0,4800,1.1.3,4800,|ytvdw@pgport.com,0,4700,1.1.3,4700,|btpersonas@brandthunder.com,0,4600,1.6.2.8.,4600,


What are these?

app.update.disable_button.showUpdateHistory user set boolean false (bold)

app.update.lastUpdateTime.addon-background-update-timer user set integer 1352818742 (bold)

app.update.lastUpdateTime.background-update-timer user set integer 1352818982 (bold)

app.update.lastUpdateTime.blocklist-background-update-timer user set integer 1352818862

(bold)

app.update.lastUpdateTime.search-engine-update-timer user set integer 1352818622

(bold)

extensions.bootstrappedAddons user set string {}

browser.search.order.1 default string Google browser.search.order.2 default string Yahoo browser.search.order.3 default string Bing

browser.aboutHomeSnippets.updateURL default string https://snippets.mozilla.com/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/

extensions.databaseSchema user set integer 5

urlclassifier.gethashtables default string goog-phish-shavar,goog-malware-shavar

urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey user set integer 1353632794

browser.search.useDBForOrder user set boolean true (bold)


My Firefox version is 7.0.1 and my OS is Win 7. Any help will be apreciated, thanks.

I unknowingly installed what I had thought been a persona from another site, but was actually the Brand Thunder extension Personas Interactive, which changed the new tab page and added other unwanted malware/adware and a virus. I have removed the persona and the add-on, but I think I should have disabled them first and done so in safe mode, not sure. The new tab page is now back to how I had it, but there seems to be some remnants in the about:config. Some are obvious, others I'm not so sure what they are and if they are even part of the leftovers. I'd like to know which ones are the remnants and if they are safe to remove from about:config. These are the entries I found: extensions.brandthunder.btpersonas.currentPersona user set string 437428 extensions.brandthunder.btpersonas.firstrun user set boolean false extensions.brandthunder.btpersonas.installedTheme user set string 0b40d759-9986-49cb-ad76-389a3f8fb425@brandthunder.com extensions.brandthunder.btpersonas.installedVersion user set string 1.6.2.8 extensions.brandthunder.keywordSearch user set boolean true extensions.btMetricsLite.bid user set string ec4bda537a757075a580afa1ed8d3647 extensions.btpersonas@brandthunder.com.install-event-fired user set boolean true browser.search.selectedEngine user set string WebSearch+ (this is in bold) When I typed BrandThunder.com in the filter, there was three results, two of which are listed above. The third one: extensions.register@pgport.com.data user set string {ef522540-89f5-46b9-b6fe-1829e2b572c6},0,9999,999.999.999,9999,|{c50ca3c4-5656-43c2-a061-13e717f73fc8},5300,5300,4.0.1,5300,fvd|fvd@kallout.com,5200,5200,4.0.1,5200,fvd|fbg@pgport.com,0,5100,1.6.2.8,4600,|kosa@kallout.com,5000,5000,2.0.1,5000,sm|ytvdh@pgport.com,0,4800,1.1.3,4800,|ytvdw@pgport.com,0,4700,1.1.3,4700,|btpersonas@brandthunder.com,0,4600,1.6.2.8.,4600, What are these? app.update.disable_button.showUpdateHistory user set boolean false (bold) app.update.lastUpdateTime.addon-background-update-timer user set integer 1352818742 (bold) app.update.lastUpdateTime.background-update-timer user set integer 1352818982 (bold) app.update.lastUpdateTime.blocklist-background-update-timer user set integer 1352818862 (bold) app.update.lastUpdateTime.search-engine-update-timer user set integer 1352818622 (bold) extensions.bootstrappedAddons user set string {} browser.search.order.1 default string Google browser.search.order.2 default string Yahoo browser.search.order.3 default string Bing browser.aboutHomeSnippets.updateURL default string https://snippets.mozilla.com/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/ extensions.databaseSchema user set integer 5 urlclassifier.gethashtables default string goog-phish-shavar,goog-malware-shavar urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey user set integer 1353632794 browser.search.useDBForOrder user set boolean true (bold) My Firefox version is 7.0.1 and my OS is Win 7. Any help will be apreciated, thanks.

Modified by RayneForrest

All Replies (5)

more options
  • You are 10 versions behind with Firefox updates. Firefox 17.0.1 was released today. You need to update Firefox thru Help > About Firefox .
  • In about:config right-click each of those "Brand Thunder" prefs and select Reset, then restart Firefox.

That will get rid of the prefs which were added by the Brand Thunder garbage, and reset to the default value the prefs which were modified by Brand Thunder.

more options

First off the edmeister, I don't appreciate calling my product garbage. I don't think you'd appreciate it if I went around calling everything you do garbage. We work very hard to do the right thing and we have tens of thousands of users who love our product.

Secondly, RayneForrest, what specific problem were you experiencing that you are trying to fix? Most add-ons when they are uninstalled leave preferences behind just in case you reinstall.

Going through about:config and simply resetting preferences is generally not a good idea. And just because you see a preference in about:config, doesn't mean it shouldn't be there.

Brand Thunder themes are a combination of the theme engine and the theme. If you are still seeing the new tab page, it sounds like the theme has been uninstalled, but Personas Interactive has not. You can uninstall it on the Extensions page.

Uninstalling Personas Interactive will undo the takeover of the new tab page. It will also remove it's search engine if that engine is not set as the default. If you have uninstalled and those items remain, that's a bug and I would love to work with you to resolve it.

more options

I'm sorry you didn't like me calling your product "garbage". Based upon doing Firefox user support for close to 10 years now, it may have been more politically correct for me to classify the Brand Thunder related add-ons as malware, instead.

Quoting from the Owners posting "... which changed the new tab page and added other unwanted malware/adware and a virus."

That I would classify as ... take partial control over its operation ... by making preference changes that weren't expected by the user.

http://dictionary.reference.com/browse/malware

more options

If taking over the new tab page makes an add-on malware, then there is tons of malware on AMO. We take over the new tab page as part of our theme (and provide theming elements on that page).We provide preferences to turn everything off and we properly unset anything we changed when we are uninstalled.

We are an approved AMO add-on and are not malware.

Your advice to this user was simply bad advice. Telling a user to go into about:config and start resetting preferences is like telling them to go in the registry and start deleting entries.

Clearly if you knew anything about Firefox support, the first step would have been to check if the add-on had been completely uninstalled.

more options

How about if we just agree to disagree?

Yes, any add-on which surprises a user by changing a pref which the user doesn't expect to be changed is malware in my book. IMO, whether AMO permits that or not doesn't make it the right thing to do. Evidently my standards for acceptable actions are a bit higher now than what AMO currently allows. And whether "most add-ons" leave preferences behind or not isn't a valid reason for changing preferences in the first place. And as far as your claim that your or Brand Thunder's uninstaller routine resets preferences or not, is something that I don't care to ascertain. What's clear to me though is that it must be that something out of the ordinary needs to be done, or this user wouldn't be here asking for help with this problem with your add-on.

As far as resetting non-default preferences that the user specifically mentions and specifically asks for help removing, the only thing "wrong" with that is that they will have a default preference restored in place of the changed preference, and the worst that could happen is that they actually fix what they are complaining about.

As far as Brand Thunder in general, long before this particular forum even existed, many of us Firefox users over at the MozillaZine fora got them banned from the Mozilla extensions website altogether due to the garbage they were spewing out at that time. IMO, crap like what we are arguing about right now is what got them banned en masse, not to return for good number of years.

Modified by the-edmeister