Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have for some reason had my computer hijacked by the malware. It takes over my browser and sets my new tab, startup page and default search engine to, something that I'm not very fond of. I've tried doing the following things:

  1. Followed the guide on to the point, 3 times.
  2. Removing the add-on/extension
  3. Reinstalling Firefox
  4. Doing a full malware scan with SuperAntiSpyware
  5. Adding a mozilla.cfg file to the Mozilla directory with the following text

lockPref("browser. startup. homepage", "about:home"); lockPref("browser.newtab.url", "about:home"); lockPref("", "data:text/plain,"); lockPref("", "");

It is good for a few days and then it resets back to the malware search engine. What is interesting is that I have added the lockPref("browser.newtab.url", "about:home") and just now the new tab is the malware search engine. When I look at the about:config tab I can find the browser.newtab.url has been changed from about:newtab to the malware url instead.

I'm out of luck here, does anyone have any suggestion on what I could do? Any help is appreciated, thank you!


Just remembered I tried using HijackThis to remove the dll files which contained the malware as well, no luck there either.

share|improve this question
have you tried to remove the whole Firefox user's profile – jet Aug 23 '13 at 21:56
Tried it now, but I will have to get back to you in a day or two to make sure that it stays fine, because all the things I tried in the list above worked for a few days before going back to the malware again. – MagneTism Aug 23 '13 at 22:08
up vote 1 down vote accepted

I would try using MalwareBytes to neutralize the threat. . Make sure that you run it after updating it fully and booting into Safe mode.

Also try Revo Uninstaller to strip away everything associated with the firefox install, including registry items that may have been affected.

share|improve this answer
I will try that when I get home, currently at work computer. – MagneTism Aug 24 '13 at 12:42
Any update on the situation? – worseone Aug 30 '13 at 17:08
Oh, sorry, I forgot about this one! Yes, it worked fine, thank you very much :) What is the difference between these ones and the ones I tried? – MagneTism Sep 4 '13 at 12:46
I am not familiar with SuperAntiSpyware as a tool, it sounds like it might have a limited scope in terms of what types of malware it is capable of handling. Malwarebytes is a highly reputable Malware removal tool, and by booting into safemode before using it you are able to disarm a lot of methods that malware uses to remain on the system even when you try to remove it. Afaik HJT is a detection tool only, so you would have to be very thorough in removing the actual malware yourself once you found it. – worseone Sep 4 '13 at 17:05
It's definitely worth trying that as well in the future. That being said having a plurality of tools at your disposal is always helpful. – worseone Sep 4 '13 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.