Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

after restoring previous firefox session sometimes all the tabs are replaced with "pli" + "sh" + "man" +".2f" + "h.co" or similar

  • 4 uphendule
  • 1 inale nkinga
  • 10 views
  • Igcine ukuphendulwa ngu the-edmeister

more options

I can't find anything on the web about it so i suspected a virus/worm/something that prevents me to find info about it but avg and malwarebytes antimalware didn't found anything

I've done a firefox refresh (via Troubleshoot screen) and the problem went away for a while then it returned, i have the same problems on my pc and on my laptop but no other computers and tablet/phone in the house experience this issue (though i can't find info about that string on any of them) so now i suspect that there is an extension that does this.

Since it doesn't happen regularly i'd have a very hard time in identifying the culprit (i have lots of extension - that i use) and i'm hopping there is a way, a log file or something to figure out what extension accesses and writes that string into the tab's address bar.

Or, if someone else found this issue with certain extension .. ?!

I'll add some screenshots and troubleshooting info .. hope someone can help.

I can't find anything on the web about it so i suspected a virus/worm/something that prevents me to find info about it but avg and malwarebytes antimalware didn't found anything I've done a firefox refresh (via Troubleshoot screen) and the problem went away for a while then it returned, i have the same problems on my pc and on my laptop but no other computers and tablet/phone in the house experience this issue (though i can't find info about that string on any of them) so now i suspect that there is an extension that does this. Since it doesn't happen regularly i'd have a very hard time in identifying the culprit (i have lots of extension - that i use) and i'm hopping there is a way, a log file or something to figure out what extension accesses and writes that string into the tab's address bar. Or, if someone else found this issue with certain extension .. ?! I'll add some screenshots and troubleshooting info .. hope someone can help.

All Replies (4)

more options

i've tried to add troubleshooting info and a screenshot but they didn't get attached ?!

I'll add a new image with 3 screenshot fragments..

1, in the first fragment you can see 2 tabs in background where the original address was substituted with something else (the string in the problem title)

2. when i click and activate the second tab, talktalk complains that it can't find that web address but after i hit refresh or forward a new website is opened (is that an ad ?)

3. the "new" ad webpage ..

Usually, when i hit the tabs i get the final (ad) webpag and the back button is disabled, but if i click on a link in that webpage and then the ba ck button in firefox i get to the webpage that was replaced (the original web address in the tab)

more options

and here's the text from my troubleshooting page:

Application Basics


Name: Firefox Version: 43.0.4 Build ID: 20160105164030 Update Channel: release User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 Multiprocess Windows: 0/1 (default: false) Safe Mode: false

Crash Reports for the Last 3 Days


All Crash Reports

Extensions


Name: Adblock Plus Version: 2.7 Enabled: true ID: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

Name: BarTab Heavy Version: 3.2.1.1-signed Enabled: true ID: bartabheavy@philikon.de

Name: Coupons at Checkout Version: 1.4.1.1-signed Enabled: true ID: jid0-5R3LLpyrG0a1kPDXAA8ZKmM0bgM@jetpack

Name: Desktop Notifications for Android Version: 2.2.1-signed Enabled: true ID: jid0-105eGBfutA8RahNXKJRXP7CPNs0@jetpack

Name: Disqus Everything Version: 1.0.4 Enabled: true ID: jid1-RCLoMjkprrm6xg@jetpack

Name: Docs Online Viewer Version: 4.2.8.1-signed Enabled: true ID: {bfb54675-2fd9-4e22-949d-c36333aff6b5}

Name: Duplicate This Tab Version: 1.3.1-signed Enabled: true ID: duplicate-this-tab@mozilla.org

Name: easyComment Version: 1.4.1-signed Enabled: true ID: plugins@bf-itservice.de

Name: Element Hiding Helper for Adblock Plus Version: 1.3.6 Enabled: true ID: elemhidehelper@adblockplus.org

Name: Facebook Messenger Version: 43.1 Enabled: true ID: {249b4e45-4fb9-4f6b-9754-7c0c1e605d44}

Name: Firebug Version: 2.0.13 Enabled: true ID: firebug@software.joehewitt.com

Name: FireShot Version: 0.98.84 Enabled: true ID: {0b457cAA-602d-484a-8fe7-c1d894a011ba}

Name: Flashblock Version: 1.5.20 Enabled: true ID: {3d7eb24f-2740-49df-8937-200b1cc08f8a}

Name: Greasemonkey Version: 3.6 Enabled: true ID: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}

Name: gtranslate Version: 0.13.0 Enabled: true ID: {aff87fa2-a58e-4edd-b852-0a20203c1e17}

Name: Less Spam, please Version: 0.8.0.1-signed Enabled: true ID: lessspamplease@developer.org

Name: Multifox Version: 3.2.2.1-let-fixed Enabled: true ID: multifox@hultmann

Name: Password Exporter Version: 1.3.1.1-signed Enabled: true ID: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}

Name: Pushbullet Version: 316 Enabled: true ID: jid1-BYcQOfYfmBMd9A@jetpack

Name: SQLite Manager Version: 0.8.3.1-signed Enabled: true ID: SQLiteManager@mrinalkant.blogspot.com

Name: Tab Mix Plus Version: 0.4.2.0 Enabled: true ID: {dc572301-7619-498c-a57d-39143191b318}

Name: Thumbnail Zoom Plus Version: 3.7 Enabled: true ID: thumbnailZoom@dadler.github.com

Name: Vacuum Places Improved Version: 1.2.1-signed Enabled: true ID: VacuumPlacesImproved@lultimouomo-gmail.com

Name: Video DownloadHelper Version: 5.4.2 Enabled: true ID: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}

Name: Web Developer Version: 1.2.5.1-signed Enabled: true ID: {c45c406e-ab73-11d8-be73-000a95be3b12}

Name: XmlUtils Version: 1.2.1-signed Enabled: true ID: {2fb6bf28-e829-4804-ab69-3bdb7d5fa997}

Name: Flash and Video Download Version: 1.79 Enabled: false ID: {bee6eb20-01e0-ebd1-da83-080329fb9a3a}

Name: Integrated Google Calendar Version: 1.5.1 Enabled: false ID: intgcal@egarracingteam.com.ar

Name: Logitech SetPoint Version: 6.5 Enabled: false ID: {F003DA68-8256-4b37-A6C4-350FA04494DF}

Name: Remove It Permanently Version: 1.0.6.10.1-signed Enabled: false ID: {1dbc4a33-ea62-4330-966c-7bdad3455322}

Name: Session Manager Version: 0.8.1.8 Enabled: false ID: {1280606b-2510-4fe0-97ef-9b5a22eafe30}

Name: View in Office Online Viewer Version: 1.3.0.1-signed Enabled: false ID: viewinofficeapps@huhsiaotao

Graphics


Adapter Description: Intel(R) HD Graphics Adapter Drivers: igdumdim64 igd10iumd64 igd10iumd64 igdumdim32 igd10iumd32 igd10iumd32 Adapter RAM: Unknown Asynchronous Pan/Zoom: none Device ID: 0x0f31 Direct2D Enabled: true DirectWrite Enabled: true (10.0.10586.0) Driver Date: 8-17-2015 Driver Version: 10.18.10.4276 GPU #2 Active: false GPU Accelerated Windows: 1/1 Direct3D 11 (OMTC) Subsys ID: 09361025 Supports Hardware H264 Decoding: Yes Vendor ID: 0x8086 WebGL Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics Direct3D11 vs_5_0 ps_5_0) windowLayerManagerRemote: true AzureCanvasBackend: direct2d 1.1 AzureContentBackend: direct2d 1.1 AzureFallbackCanvasBackend: cairo AzureSkiaAccelerated: 0

Important Modified Preferences


accessibility.typeaheadfind.flashBar: 0 browser.cache.disk.capacity: 358400 browser.cache.disk.filesystem_reported: 1 browser.cache.disk.smart_size.first_run: false browser.cache.disk.smart_size.use_old_max: false browser.cache.frecency_experiment: 4 browser.download.importedFromSqlite: true browser.places.smartBookmarksVersion: 7 browser.sessionstore.upgradeBackup.latestBuildID: 20160105164030 browser.startup.homepage_override.buildID: 20160105164030 browser.startup.homepage_override.mstone: 43.0.4 dom.apps.reset-permissions: true dom.mozApps.used: true extensions.lastAppVersion: 43.0.4 font.internaluseonly.changed: true gfx.crash-guard.d3d11layers.appVersion: 43.0.4 gfx.crash-guard.d3d11layers.deviceID: 0x0f31 gfx.crash-guard.d3d11layers.driverVersion: 10.18.10.4276 gfx.crash-guard.d3d11layers.feature-d2d: true gfx.crash-guard.d3d11layers.feature-d3d11: true gfx.crash-guard.glcontext.gfx.driver-init.direct3d11-angle: true gfx.crash-guard.glcontext.gfx.driver-init.webgl-angle: true gfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-d3d11: false gfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-warp: false gfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-try-d3d11: true gfx.crash-guard.status.d3d11layers: 2 gfx.crash-guard.status.d3d9video: 2 gfx.crash-guard.status.glcontext: 2 gfx.direct3d.last_used_feature_level_idx: 0 media.gmp-eme-adobe.abi: x86-msvc media.gmp-eme-adobe.lastUpdate: 1451057108 media.gmp-eme-adobe.version: 15 media.gmp-gmpopenh264.abi: x86-msvc media.gmp-gmpopenh264.lastUpdate: 1451596756 media.gmp-gmpopenh264.version: 1.5.3 media.gmp-manager.buildID: 20160105164030 media.gmp-manager.lastCheck: 1452344140 media.hardware-video-decoding.failed: false media.youtube-ua.override: false network.cookie.prefsMigrated: true network.predictor.cleaned-up: true places.database.lastMaintenance: 1452300365 places.history.expiration.transient_current_max_pages: 104858 plugin.disable_full_page_plugin_for_types: application/pdf plugin.importedState: true print.printer_PDFCreator.print_bgcolor: false print.printer_PDFCreator.print_bgimages: false print.printer_PDFCreator.print_duplex: -437918235 print.printer_PDFCreator.print_edge_bottom: 0 print.printer_PDFCreator.print_edge_left: 0 print.printer_PDFCreator.print_edge_right: 0 print.printer_PDFCreator.print_edge_top: 0 print.printer_PDFCreator.print_evenpages: true print.printer_PDFCreator.print_footercenter: print.printer_PDFCreator.print_footerleft: &PT print.printer_PDFCreator.print_footerright: &D print.printer_PDFCreator.print_headercenter: print.printer_PDFCreator.print_headerleft: &T print.printer_PDFCreator.print_headerright: &U print.printer_PDFCreator.print_in_color: true print.printer_PDFCreator.print_margin_bottom: 0.5 print.printer_PDFCreator.print_margin_left: 0.5 print.printer_PDFCreator.print_margin_right: 0.5 print.printer_PDFCreator.print_margin_top: 0.5 print.printer_PDFCreator.print_oddpages: true print.printer_PDFCreator.print_orientation: 0 print.printer_PDFCreator.print_page_delay: 50 print.printer_PDFCreator.print_paper_data: 9 print.printer_PDFCreator.print_paper_height: 11.00 print.printer_PDFCreator.print_paper_name: print.printer_PDFCreator.print_paper_size_type: 0 print.printer_PDFCreator.print_paper_size_unit: 1 print.printer_PDFCreator.print_paper_width: 8.50 print.printer_PDFCreator.print_resolution: -437918235 print.printer_PDFCreator.print_reversed: false print.printer_PDFCreator.print_scaling: 1.00 print.printer_PDFCreator.print_shrink_to_fit: true print.printer_PDFCreator.print_to_file: false print.printer_PDFCreator.print_unwriteable_margin_bottom: 0 print.printer_PDFCreator.print_unwriteable_margin_left: 0 print.printer_PDFCreator.print_unwriteable_margin_right: 0 print.printer_PDFCreator.print_unwriteable_margin_top: 0 privacy.sanitize.migrateFx3Prefs: true security.tls.version.min: 0 storage.vacuum.last.index: 1 storage.vacuum.last.places.sqlite: 1451063388 ui.osk.debug.keyboardDisplayReason: IKPOS: Touch screen not found.

Important Locked Preferences


JavaScript


Incremental GC: true

Accessibility


Activated: false Prevent Accessibility: 0

Library Versions


NSPR Expected minimum version: 4.10.10 Version in use: 4.10.10

NSS Expected minimum version: 3.20.2 Basic ECC Version in use: 3.20.2 Basic ECC

NSSSMIME Expected minimum version: 3.20.2 Basic ECC Version in use: 3.20.2 Basic ECC

NSSSSL Expected minimum version: 3.20.2 Basic ECC Version in use: 3.20.2 Basic ECC

NSSUTIL Expected minimum version: 3.20.2 Version in use: 3.20.2

Experimental Features


I hope all this gives insight on what is the source of the problem.

more options

I am pretty sure this is a virus/trojan that's messing things up. I strongly recommend running a check on your system.

Another thing if not a virus, it could be an extension/plug-in that you have. It could be a long time to find the one but you could try uninstalling a few of them one at a time (noting down which ones) and observing if the problem goes away. Over a period you should be able to narrow it down which extension(s) are causing you the trouble.

more options

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.

You can try these free programs to scan for malware, which work with your existing antivirus software:

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Windows 8 has antivirus built-in already.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!