last firefox update on other computer contained hijack called trusted surf
the home page not displayed after update instead, a url trustedsurf and some ads, all looking like firefox and no way to remove. did scan removed some malware, but it's back more buzzing malware on board with firefox. tried e, and it has that too, also chrome now saying trusted surf.com. is this something widespread or is it a personal attack?
Chosen solution
If you are experiencing a multi-browser attack, it usually arrives bundled into a software installer. Here's my suggested procedure for tracking down and cleaning up bad add-ons and other hijackers. I know it seems long, but it's really not that bad.
(For Windows Vista, 7, 8, 8.1, 10; XP is somewhat different)
(1) Open the Windows Control Panel, Uninstall a Program. After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it. Take out as much trash as possible here.
(2) Open Firefox's Add-ons page using either:
- Ctrl+Shift+a
- "3-bar" menu button (or Tools menu) > Add-ons
- in the Windows "Run" dialog, type or paste
firefox.exe "about:addons"
In the left column, click Plugins. Set nonessential and unrecognized plugins to "Never Activate".
In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions. All extensions are optional; none come with Firefox.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
Any improvement?
Other browsers have similar add-on/extension management pages.
(3) You can search for remaining issues with the scanning/cleaning tools listed in our support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.
Finally, if you have a problem with the startup page -- using your program shortcut loads an unwanted page but it is different from your home page -- check the shortcut you use to start Firefox. Either:
- Desktop shortcut: right-click the icon, choose Properties
- Pinned taskbar icon: right-click the icon, right-click Mozilla Firefox, choose Properties
Windows normally will select the Shortcut tab. If not, go ahead and click the Shortcut tab.
The Target line should not have anything after this part:
- 32-bit Firefox on 64-bit Windows: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
- Otherwise: "C:\Program Files\Mozilla Firefox\firefox.exe"
If any URLs are listed after that, clear them out and save your change. To test, you can either:
- Desktop shortcut: double-click the icon to launch a new window
- Pinned taskbar icon: right-click the icon, click Mozilla Firefox to launch a new window
If you get your home page, it worked.
Repeat for other browsers.
Read this answer in context 👍 13All Replies (1)
Chosen Solution
If you are experiencing a multi-browser attack, it usually arrives bundled into a software installer. Here's my suggested procedure for tracking down and cleaning up bad add-ons and other hijackers. I know it seems long, but it's really not that bad.
(For Windows Vista, 7, 8, 8.1, 10; XP is somewhat different)
(1) Open the Windows Control Panel, Uninstall a Program. After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it. Take out as much trash as possible here.
(2) Open Firefox's Add-ons page using either:
- Ctrl+Shift+a
- "3-bar" menu button (or Tools menu) > Add-ons
- in the Windows "Run" dialog, type or paste
firefox.exe "about:addons"
In the left column, click Plugins. Set nonessential and unrecognized plugins to "Never Activate".
In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions. All extensions are optional; none come with Firefox.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
Any improvement?
Other browsers have similar add-on/extension management pages.
(3) You can search for remaining issues with the scanning/cleaning tools listed in our support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.
Finally, if you have a problem with the startup page -- using your program shortcut loads an unwanted page but it is different from your home page -- check the shortcut you use to start Firefox. Either:
- Desktop shortcut: right-click the icon, choose Properties
- Pinned taskbar icon: right-click the icon, right-click Mozilla Firefox, choose Properties
Windows normally will select the Shortcut tab. If not, go ahead and click the Shortcut tab.
The Target line should not have anything after this part:
- 32-bit Firefox on 64-bit Windows: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
- Otherwise: "C:\Program Files\Mozilla Firefox\firefox.exe"
If any URLs are listed after that, clear them out and save your change. To test, you can either:
- Desktop shortcut: double-click the icon to launch a new window
- Pinned taskbar icon: right-click the icon, click Mozilla Firefox to launch a new window
If you get your home page, it worked.
Repeat for other browsers.