Blocked Firefox Startup page
Hi, It seem that the Firefox.exe was hacked on my PC. Namely, there is no way to get rid of some Turkish webpages like https://www[.]ahaberci[.]com/sifresiz-trabzonspor-konyaspor-canli-izle-bedava-bein-sports-1-canli-yayin-izle-justi-49375h.htm which appear on starting the Firefox. I checked for the malwares the PC with several antivirus software. I uninstalled Firefox and reinstalled it without saving data from the previous versions, with no success. I tried all methods offered by the Firefox Help, but does not work. Please, help me to fix the problem. I am attaching screenshots to illustrate the problem.
Thank you, Katalin
link broken to avoid misclicks and malware -Andrew
Andrew மூலமாக திருத்தப்பட்டது
தீர்வு தேர்ந்தெடுக்கப்பட்டது
Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.
- download the Firefox installer and save the file to the desktop
*https://www.mozilla.org/en-US/firefox/all/#product-desktop-release
If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.
- do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including personal data in profiles created by other Firefox versions
Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.
- (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
- (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"
- it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling
Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.
If you keep having problems then you can create a new profile as a quick test to see if your current profile is causing the problem.
- https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
- https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles
Reinstall Firefox
Read this answer in context 👍 0All Replies (20)
I'm curious... what tools did you run?
Thanks for the reply. I ran antivirus software Windows Defendant, Comodo (full scan), and Microsoft(R) Anti-Malware tool. The PC seems clean. Do you have any idea what to do?
Katalin
Can you try one more for me? Malwarebytes https://www.malwarebytes.com/mwb-download/thankyou/
Here are the results. They are supposedly in a quarantine.
What happens when you run Firefox in safe mode?
To start Firefox in Safe Mode:
Click the menu button. , click Help and select Restart with Add-ons Disabled. Firefox will start up with the Firefox Safe Mode dialog. When the Firefox Safe Mode window appears, click the Start in Safe Mode button.
I restricted the access to this annoying page, but running in the Safe Mode it is still there. No access to the Startup.
Could you check two ways to set a locked preference:
(1) The About Policies page
Type or paste about:policies in the address bar and press Enter to load it. Normally, you see "The Enterprise Policies service is inactive."
What do you see?
(2) The defaults\pref folder
This is either:
- C:\Program Files\Mozilla Firefox\defaults\pref
- C:\Program Files (x86)\Mozilla Firefox\defaults\pref
Normally the only file in this folder is channel-prefs.js -- any other file in this folder is suspicious. Please do not double-click any script files. That causes Windows to execute them as system scripts. Instead, to view their contents, right-click > Edit the files.
Anything unusual there?
about:policies I see "The Enterprise Policies service is inactive.", but the pref folder I see the image I am sending you.
I renamed the second file, but nothing happens. The Turkish site sits still in the Firefox. This is in the first file: /* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
// // This pref is in its own file for complex reasons. See the comment in // browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add // other prefs to this file.
pref("app.update.channel", "release");
How about this?
https://support.mozilla.org/en-US/kb/how-to-set-the-home-page
Sorry, I got distracted by another thread. The next time you started Firefox after removing local-settings.js, is the lock gone from the browser.startup.homepage preference so you can reset it?
Note that you shouldn't rename local-settings.js because the name doesn't matter, so you need to remove this file.
Can you also list the content of the file that is referenced in local-settings.js via general.config.filename.
- pref("general.config.filename", "autoconfig.cfg");
This file is located at the main level in the Firefox installation folder where firefox.exe is located.
See also:
cor-el மூலமாக திருத்தப்பட்டது
This is the channel-prefs.js: This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
// // This pref is in its own file for complex reasons. See the comment in // browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add // other prefs to this file.
pref("app.update.channel", "release");
Katalin said
This is the channel-prefs.js:
That looks normal. So now that is the only file in the folder? And at the next restart, has the lock been removed so you can set your own home page?
Unfortunately nothing happened. The Turkish site is still there and no access to the Startup functions. :(
Are there any other files in the C:\Program Files\Mozilla Firefox\defaults\pref folder now, or only channel-prefs.js ?
This is what is left after the deletion of the second file: /* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
// // This pref is in its own file for complex reasons. See the comment in // browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add // other prefs to this file.
pref("app.update.channel", "release");
Looks good. So it's not Policy and it's not Autoconfig, where else could that preference lock be coming from?!
Where is Autoconfig?
Autoconfig is set up by the alien .js file in the C:\Program Files\Mozilla Firefox\defaults\pref folder.