Firefox startpage problem (hijacked??)

User Help for Mozilla Firefox
Post Reply
brayniboy
Posts: 4
Joined: March 10th, 2008, 5:09 pm

Firefox startpage problem (hijacked??)

Post by brayniboy »

I installed some smileys on my machine for my IM from this website

http://www.sweetim.com/s.asp?im=yahoo&i ... TCBE(201f6)(0)$V=2,S=78583652$%5c@TCEE

and I had fun with it for a short while then decided to uninstall it.

My problem now is that whenever i start FF, instead of using the default homepage it loads this:

http://www.google.com.tw/firefox?client ... S:official

I've already tried changing the homepage in Options>Main>homepage to the default homepage but it still comes up with that website

It doesn't change the URL of the default homepage in the options tab, but for some reason firefox keeps changing to that one instead.

when i opened the sessionstore.js file in notepad, i saw the google.com.tw website there and I think that this is the file thats Hijacking my startpage. I already tried to change the browser.sessionstore.enabled to false in about:config so that it will not load the file. But it’s still doing the same thing.

I tried deleting prefs.js file, but once I restart firefox, the same problem shows up. So I think there is an adware or virus that is installing changes in firefox everytime I start it.

I've already run Symantec Anti-virus, Ad-Aware and also Hijackthisv2 but I haven't been able to detect anything out of the ordinary.

Can you please guide me on what else I can do to stop this "bug" from taking over my homepage?

Thanks
User avatar
steviex
Moderator
Posts: 28902
Joined: August 12th, 2006, 8:27 am
Location: Middle England

Post by steviex »

Even though the site claims not to be malware, It is also possible that you might have a spyware infection on your machine. Install and run these programs.
SuperAntispyware
AdAware
Spybot Search & Destroy
AVG Anti-Spyware Free


If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://forums.spywareinfo.com/

(Thanks to Daifne for the list)

I would also see if making a brand new profile does the trick

http://kb.mozillazine.org/Creating_a_ne ... on_Windows
http://kb.mozillazine.org/Transferring_ ... _-_Firefox

By the way, did it install as a Firefox Addon, or did it install as a Windows Application, that you uninstalled via the Add/Remove Programs Dialogue in Windows ??
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. -Albert Einstein

Please DO NOT PM me for support... Lets keep it on the board, so we can all learn.
brayniboy
Posts: 4
Joined: March 10th, 2008, 5:09 pm

Post by brayniboy »

steviex wrote:Even though the site claims not to be malware, It is also possible that you might have a spyware infection on your machine. Install and run these programs.
SuperAntispyware
AdAware
Spybot Search & Destroy
AVG Anti-Spyware Free


If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://forums.spywareinfo.com/

(Thanks to Daifne for the list)

I would also see if making a brand new profile does the trick

http://kb.mozillazine.org/Creating_a_ne ... on_Windows
http://kb.mozillazine.org/Transferring_ ... _-_Firefox

By the way, did it install as a Firefox Addon, or did it install as a Windows Application, that you uninstalled via the Add/Remove Programs Dialogue in Windows ??


I've tried creating a new profile, but the new profile still uses the google.com.tw website.

I've also checked if the user.js profile was locked or read only but it was not so I know that the preferences should be saved.

I am going to be using all those Malware removal software and see if that will do the trick.

The smiley software installed as a window application because I had to remove it from add/remove software. It also created a toolbar in IE.

Hope this information helps. I'll give updates if once I go thru all the malware removal.

I really hope I get this resolved soon. I want my Firefox back!!!!
User avatar
titaniumtux
Posts: 56
Joined: March 10th, 2008, 6:39 am
Location: Krung Thep, Siam
Contact:

Post by titaniumtux »

Assuming you're using Windows, have you tried System Restore? That should suffice in most cases. :turn-l:

You mentioned you were using that smilies pack for a "short while", so hopefully you haven't made any important changes (for instance updates or installs unrelated to this) since then, but you may want to back up certain files just in case.

If you choose to stick with Windows, to be on the preventive side, you could use Avast! (http://www.avast.com/). It will hopefully prevent such problems. You can use it at zero cost and updates are also at zero cost, but you have to register to obtain a registration key in order to use it beyond its 30-day trial period (it's a small price to pay for a really good costless virus scanner for Windows, and you only provide them with information such as your full name and mailing address).
My LAMPP: http://delltuxlamp.no-ip.org
Machines: Everex SA2053T and Asus t91 (both 2GB RAM) running the latest stable Ubuntu Linux release & the latest stable FF release w/ extensions from repositories
brayniboy
Posts: 4
Joined: March 10th, 2008, 5:09 pm

Post by brayniboy »

Hello all,

Just giving you updates about my firefox problem.

I've already used Super Anti spyware, ad aware, Spybot S&D but my firefox is still doing the same thing. I thought this might be an issue with the google site since its the only thing that is affected. but even after i changed my preferences on what google to use (english), and i close the browser, once I start it up again, it goes back to the google.com.tw.

I'm starting to read up on the forums for Malware removal and hopefully I'll be able to solve this issue.

I'll do the system restore as a last resort.

This is really weird because the reason I switched to firefox was because it was pretty secure against spyware and malware. I still have faith though. maybe i should try firefox 3...
User avatar
LoudNoise
New Member
Posts: 39900
Joined: October 18th, 2007, 1:45 pm
Location: Next door to the west

Post by LoudNoise »

Post wrangler
"Choose between the Food Select Feature or other Functions. If no food or function is chosen, Toast is the default."
brayniboy
Posts: 4
Joined: March 10th, 2008, 5:09 pm

Post by brayniboy »



Hello,

I will certainly try this one, I may have jumped the gun too early and concluded that this is a case of browser Hi jacking.

hope this will solve the problem

Thanks for all your inputs.
User avatar
titaniumtux
Posts: 56
Joined: March 10th, 2008, 6:39 am
Location: Krung Thep, Siam
Contact:

Post by titaniumtux »

Well, pretty much all Microsoft applications are huge targets to attacks from spyware, malaware, etc. The operating system being the most crucial, because if it fails on you, it's the most difficult to recover (and most inconvenient to replace when you can't access your files easily). FireFox is much safer than IE just by not using ActiveX controls, and is a much smaller target to adaware toolbars... your browser is not the only app that is vulnerable (though it is the biggest portal for spyware, malaware, etc.)... MSN Messenger, MS Office, etc. are also quite vulnerable.

If you are to use Windows and any Microsoft applications with it, I would strongly recommend frequently creating restore points and doing a sys restore any time anything funny comes up. :P
My LAMPP: http://delltuxlamp.no-ip.org
Machines: Everex SA2053T and Asus t91 (both 2GB RAM) running the latest stable Ubuntu Linux release & the latest stable FF release w/ extensions from repositories
Post Reply