Hello,

Try Firefox Safe Mode to see if the problem goes away. Safe Mode is a troubleshooting mode, which disables most add-ons.

(If you're not using it, switch to the Default theme.)

• You can open Firefox 4.0+ in Safe Mode by holding the Shift key when you open the Firefox desktop or Start menu shortcut.
• Or open the Help menu and click on the Restart with Add-ons Disabled... menu item while Firefox is running.

Once you get the pop-up, just select "'Start in Safe Mode"

If the issue is not present in Firefox Safe Mode, your problem is probably caused by an extension, and you need to figure out which one. Please follow the Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems article for that.

To exit the Firefox Safe Mode, just close Firefox and wait a few seconds before opening Firefox for normal use again.

You may also have malware, check with all programs.

• Microsoft Safety Scanner
• MalwareBytes' Anti-Malware
• TDSSKiller - AntiRootkit Utility
• Hitman Pro
• ESET Online Scanner

yes this sounds like a problem possibly caused by adware/malware on your pc. please go to firefox > addons > extensions & remove any suspicious entries (toolbars, things that you have not installed intentionally, don't know what purpose they serve, etc). also go to the windows control panel / programs and remove all toolbars or potentially unwanted software from there and run a full scan of your system with the security software that you have in place and different other tools like adwcleaner.

Remove a toolbar that has taken over your Firefox search or home page Troubleshoot Firefox issues caused by malware

We had another thread about an ad that was launched at the same time every day using the Windows Task Scheduler.

There was a folder named dsite that needed to be removed. To find it, you would need to be showing hidden files and folders. (See: Show hidden files - Microsoft Windows Help)

You might also check the Scheduled Tasks here as that may reveal the path to the badware:

Windows XP: Start button > [All] Programs > Accessories> System Tools > Scheduled Tasks

Windows Vista/7: Start button > Control Panel > System and Security > Administrative Tools > Task Scheduler

I'm not sure where it will be lurking...

Just posting to say that I had the same problem and found the DSite folder jscher2000 mentioned specifically in the following location (on Windows 7, where [username] is your username obviously): C:\Users\[username]\AppData\Roaming\DSite

DSite (the offending task that called the exe in that DSite folder) was in the Task Scheduler Library (in Task Scheduler) in the root (\) directory.

Comment from a forum moderator. ~J99

Also see further information on tofushopnews here

If removing from the scheduler is not sufficient to resolve the issue.

That's exactly where I found it. Thanks for the followup. Haven't had any problems since I deleted it 2 days ago. Keeping my fingers crossed...

do NOT use the link jackMX gave, from mitechmate, it appears to be a bogus method put out by the malware designers. You must use the approach by fr4N1GBmUD, delete Dsite from your computer and eliminate it from the task scheduler. I also stumbled across another "guide" to get rid of this virus and it told you to delete the Microsoft anti-malware programs, lol. Be careful with this one there are deliberate instructions out there designed to make the virus permanent.

delete dsite from task manager (root) and from the app roaming folder.

On my Windows 8 system, I found the malware folder located as noted, in the C: drive (C:\Users\<username>\AppData\Roaming\DSite). However, it was not visible in the File Manager; I had to perform a Search on the C: drive for 'DSite' for it to finally appear so it could be removed.

Similarly, DSite.job was not visible among the Task Scheduler's list of active jobs; again, performing the Search made it appear among the search results.

Oh, and BTW I *did* already have the proper option set to show hidden files and folders ... it still was not appearing until I performed a Search.

a warning folds i tried to show hidden files and deleted the dsite schedule i now have an empty computer with just the apps remaining

You also need to look for elevateddiagnostics in hidden file search and delete this folder as well - may have similar names like elevatediagnostics so serch for elevated*

i found Tee support's removal guide on how to remove it and i followed it carefully. but the virus still comes back. i am sure it is a bogus method. so don't use Tee support' service, they only want to rip you off. '

Os voy a dar una solución, que quizá no sea muy elegante, pero de seguro que es efectiva si trabajáis bajo el S.O. Windows.

En esta ubicación

C:\Windows\System32\drivers\etc

encontraréis un fichero que se llama "hosts." (sin extensión) y que tiene la clave de todo.

Abrir ese fichero con el "notepad.exe" y modificarlo de forma que debajo de donde pone:

1. For example:

figure, por ejemplo, vuestra misma dirección IP y a continuación el nombre del dominio al que no deseéis que vuestro ordenador se conecte, en este caso:

web.tofushopnews.com

aunque el dominio problemático ha ido cambiando, y antes ha pasado, al menos, por estos otros dos:

tv.channel157news.com m.bingoodthingshappen.com

que forman parte de la misma mierda.

Es posible que esa operación no os resulte tan sencilla, debido al tema de permisos de Windows pero, si no te deja, y por si acaso, puedes mover el fichero original a otro emplazamiento, guardarlo y después copiar el fichero modificado donde estaba el original, ¡y quitarle la extensión .txt que te habrá puesto! O sea, guardar el nuevo fichero "hosts." en C:\Windows\System32\drivers\etc

¿Y qué se consigue con eso? Pues la cosa es sencilla, que cada vez que tu ordenador quiera conectarse a ese dominio, o sea, a "web.tofushopnews.com " lo intente a través de tu dirección IP, con lo que nunca lo va a conseguir, es decir, no va a intentar buscar su IP en los servidores de DSN.

Bueno, sé que es una "chapuza" pero es efectiva. Yo tuve mucho tiempo ese problema, incluso me intentaron ayudar la gente de McAfee, pero no había caso, ¡volvía a salir una vez al día!, hasta que hice lo que os cuento y, desde entonces, ¡¡¡ningún problema!!!

Escribirme contando cómo os va con esto, aunque os garantizo que si hacéis lo que os digo, se os van a terminar los quebraderos de cabeza por este motivo. Un fuerte abrazo.

Please pm me if this becomes outdated &/or reliable trustworthy links or methods are given elsewhere on our site by a top contributor, moderator, or admin and I (or another Mod.) will update this, or link instead to a better post.

This may not be fully detailed but is aimed at giving advice to help you prevent the situation getting worse.

_{EDIT added Alice's comment ~ J99}

The best place ...

The best place to go for advice and step-by-step help removing malware is a reputable forum specializing in malware removal.

See the KB article Troubleshoot Firefox issues caused by malware for some recommendations, under the How do I get rid of malware? section.

Care with Removal Advice Obtained from Web Searches

• You fell into one trap installing unwanted software now you are about to leap into another.
• tofushopnews is NOT itself actually a dangerous site
  The site is not the problem. Note that the site tofushopnews itself is possibly not widely liked but not in itself dangerous
  • See for instance current reviews
    Note although there may be community votes against the site it also important to note the lack of automated results indicating positive malware threats from the site McAfee, Norton, WOT
• The PROBLEM with a simple web search.
  In these situations it may result in advice or links that are anywhere between not good and downright dangerous.
  Here is why; and why this particular type of query may harm you. Consider the case where instead of looking for a specific true malware you look for a relatively harmless site or relatively harmless adware. Now Instead of finding free advice and free support from a malware removal site you are open to scams and overly expensive offers of paid for help because such sites will take advantage of your fears, but get no competition from free malware support sites because the search term is not for true malware.
  There is a danger you try to follow incomple & or complicated advice get stuck or cause problems by your actions you then are in danger of falling for all sort of scams.

Advice on Removal (web.tofushopnew.com & similar)

You probably need know about to &/or do all or most of these things

• Note that it is changing registry items that is the probably step with the most potential y to cause damage if not done correctly. I will leave that out until I find a good link XXX

1. Know how to find hidden files, or you will just miss seeing things
   http://kb.mozillazine.org/Show_hidden_files_and_folders
2. Remove startup items. As the name suggests these run automatically on startup.
3. Remove scheduled items. This is a less common problem, but some things may be scheduled by the system to run at particular times and this is then taken advantage of by some adware (web.tofushopnews.com may well do this).
   jcher2000 explains in the current thread here
4. Remove Addons
   • Disable or remove Add-ons
   • Cannot remove an add-on (extension or theme)
   • Troubleshoot issues with plugins ..._manually-uninstalling-a-plugin

• Note someone with adware on a machine may well have multiple types of adware and possibly multiple malware infections. Also filenames and sites change or something else has a similar effect. Cases are not all the same.

But I do need step by step help and advice

Then start your own then this is the procedure you need to follow:

1. Start your own thread using the special quick & direct shortcut only for this issue
   • follow the prompts to include full troubleshooting advice
2. Post back in this thread but only to say that you have started your own thread, and give a one line explanation of the problem. Also please say roughly when it was posted, eg. 5 minutes ago or last week.

YOU WILL NOT GET ADVICE by asking in this thread without first starting your own thread. It is against forum rules to hijack threads by posting your support question in someone else's thread even if it is the same subject.

Someone will try to help you, although that may also involve you taking specialist free advice from other sites depending on exactly what the problem is. Or it may involve following the steps someone else has taken and been guided through.

If you do need paid for advice look for a reputable company and try to get references, recommendations from friends & colleagues, or search the web carefully for reviews of the company.

Note This thread >4kHits Aug 2013

To add to what John99 said,

The best place to go for advice and step-by-step help removing malware is a reputable forum specializing in malware removal.

See the KB article Troubleshoot Firefox issues caused by malware for some recommendations, under the How do I get rid of malware? section.

hi, the method from mitechmate worked for my computer which was infected by tofushopnews.com. i find a friend who familiar with regisry to help me complete the manual removal guide as the mitechmate posted. mitechmate guide is helpful, indeed... i recommend you find someone good at computer to help you finish that complicated process. good luck and take care

You could even go to one of the fora of the recommended sites and tell them what guide you are trying to follow.

Yes some people may need additional help not just a guide. The point is some of the reputable sites we recommend will provide additional help on their fora for free.

Other sites may offer complicated instructions and be aware that you will be tempted to opt for their paid for support. In such a business model profits will actually increase by providing instructions that are incomplete or overly complicated.

I hacked registry entries when I used Windows, but it used to need precautions of making backups and was potently dangerous it is not something I personally would try to guide someone through.

Th mozillazine site mentions the problem, and links to a long thread on their fora about the registry and malicious software

• http://kb.mozillazine.org/Uninstalling_add-ons#Windows_Registry_extension
  • http://forums.mozillazine.org/viewtopic.php?f=38&t=948945

I have deleted "dsite" and so far all ok. Many thanks