Did you check the content of the local-settings.js file you mentioned to check to what cfg file it links ?

The screenshot shows a moz-extension://<UUID> link and such a link is added by an extension. You can search the about:debugging page via the location/address bar (This Firefox) to see if this UUID is listed.

This is what I see there. According to the text, there is no document opened.

Can you follow steps 8-12 to verify your shortcut?

https://www.support.com/how-to/how-to-fix-a-browser-hijack-on-mozilla-firefox-12586

Can you click on the menu, then click on Help, then click on Troubleshooting Information and post a screenshot of the add-on section like mine. see screenshot

Also, do you have the same issue when you log into another windows account?

Just a question for me... When you edit what's in my screenshot, is something changing it back. see screenshot

After cleaning all the history the screenshot looks as attached.

how about the Firefox shortcut?

Hurrah, Jon. You saved my day. However, I cannot understand how it worked. Namely, I went through the troubleshooting several times before I asked for help. The Properties of the exe file were correct all the time. Today was the first time the site code appeared after "C:\Program Files\Mozilla Firefox\firefox.exe". Now, I deleted it and it did not return. All other inspections showed the, correct line, but the browser started with the Turkish site. Anyway, I restarted not only Firefox, but the PC, and now everything is correct. The Startup is not any more unavailable, too. Many thanks, :) Katalin

I wonder whether it is possible to lock preferences in a user.js file or directly in prefs.js ??

Does the Troubleshooting Information page indicate that there is a user.js file overriding settings in your Firefox? Either:

• "3-bar" menu button > "?" Help > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter/Return

Use Find (Ctrl+f) to find the user.js section in the page, if any. Does it say there is such a file?

The Properties of the exe file were correct all the time. Today was the first time the site code appeared after "C:\Program Files\Mozilla Firefox\firefox.exe". Now, I deleted it and it did not return.

You might check the Windows Task Scheduler to see whether there is anything that could have run between the time you checked last and this time. That is one method malware uses for reinserting or re-launching an attack. In the Windows search box (on the Taskbar, usually) enter task scheduler to launch that app. It's easiest to view the list at the top level rather than checking in folders for specific programs, although you could look in those, too.

No, there is no user.js there.

Yeah, I wouldn't be surprised if it came back. Some process put it there.

user.js can't lock a pref. Only GPO or policies.json or an autoconfig file can do this.

I asked above what content is in the local-settings.js file in "defaults\pref" you mentioned and to what .cfg file at the main level it linked (possibly mozilla.cfg or autoconfig.cfg).

Did you look into this ?

See also:

• https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig

Unfortunately, I do not remember. I could not find any *.cfg file now. It is possible that I still have some malware, as now Google chrome (Slimjet) started to behave unusually. All malware checkers and antivirus programs show that the PC is clean. I always took care what I opened in the browser, but still I might open something accidentally.

Is slimjet the site that opens at startup? More info please.

Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.

• download the Firefox installer and save the file to the desktop
  *https://www.mozilla.org/en-US/firefox/all/#product-desktop-release

If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.

• do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including personal data in profiles created by other Firefox versions

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

• (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
• (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"

• it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling

Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.

If you keep having problems then you can create a new profile as a quick test to see if your current profile is causing the problem.

• https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
• https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles

Reinstall Firefox

• https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems

Slimjet opens correctly, but starts to lose the connection. Also, I cannot open some sites. They said something about increased security, and opens only https sites. However, Sciecedirect is a safe site, so I do not know what is happening. Slimjet has some handy options - download documents directly in pdf instead of html, copies parts of the page as jpg, etc., but Firefox is my default browser.

If you have enabled HTTPS-Only then you can click the padlock icon on the location bar to possibly disable HTTPS-Only if you need to connect to a website that only works with HTTP.