After I'm hopeless on how to get rid off of the ///C:/Program Files (x86)/Mozilla

Where exactly do you see that ? If it is showing in the taskbar it looks like Firefox is picking that up as a page to open. Most likely it is part of the shortcut that is entered on one of your icons or the takbar. Right clicking icons or Taskbar icons and using Properties will probably let you get information on the actual shortcut used.

Another way of setting what Firefox uses to start is from its internal Home page settings. They are saved in the profile, so using different profiles may result in differing behaviour.

• See also How to set the home page
  • Startup, home page, tabs, and download settings
  • Home page with pipe character opens extra tabs when Firefox starts

Note that when Firefox is running you are able to check easily which profile it is using by clicking on the [Show Folder] button in the Troubleshooting Information page.

• Use: Menu Button -> Help -> Troubleshooting Information
• See Use the Troubleshooting Information page to help fix Firefox issues

Also note that if for some reason Firefox is unable to find the profile you expect it to use it may create a new profile and use that. If you need to discover what profiles exist on the Computer try searching for the file "places.sqlite" one of those files will exist in every Firefox profile.

If you need to check the profile that Firefox is set to use that information is stored in a file called profiles.ini again it is possible you may have more than one such file on the computer if you have been moving Firefox about.

• See http://kb.mozillazine.org/Profiles.ini_file

You did a good job of explaining the problem in English. I would not have known English is not your first language.

Hi John99, Thank you for your reply.

you wrote : Right clicking icons or Taskbar icons and using Properties will probably let you get information on the actual shortcut used.

me : after I restart the computer then do as your instruction (pic-01), the resulting properties has the target : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed" (pic-02)

I unpin that ff pin, create shortcut of the ff.exe then pin this shortcut to the taskbar. Do as your instruction (pic-03), and the resulting properties has the target : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" (pic-04)

The pin of the ff.exe on the taskbar has the following : 1. Open new tab 2. Open new window 3. New private window 4. Mozilla Firefox 5. Unpin this program from the taskbar

If I click number 1 or 2 or 3, Firefox open with a blank page If I click number 4, Firefox open with the URL : http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed

After Googled about "safesurfs.net", it turns out that the problem is my computer infected by a malware. I ran ADWcleaner downloaded from bleepingcomputer.com and the log file is :

• • • • • [ Services ] *****

No malicious services found.

• • • • • [ Folders ] *****

No malicious folders found.

• • • • • [ Files ] *****

No malicious files found.

• • • • • [ DLL ] *****

No malicious DLLs found.

• • • • • [ WMI ] *****

No malicious keys found.

• • • • • [ Shortcuts ] *****

No infected shortcut found.

• • • • • [ Scheduled Tasks ] *****

No malicious task found.

• • • • • [ Registry ] *****

Key Found: [x64] HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270} Key Found: [x64] HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A} Key Found: HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270} Key Found: HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A} Key Found: HKLM\SOFTWARE\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}

• • • • • [ Web browsers ] *****

No malicious Firefox based browser items found. No malicious Chromium based browser items found.

So I click "clean" button on the ADWcleaner. Restart the computer. The problem still there : If I pin the ff.exe to the taskbar then click this pin, Firefox open the page with that "safesurfs" URL no matter I change the Firefox startup option in the General Tab. When I right click this pin (as you instructed), if click Mozilla Firefox (number 4), the same result ... Firefox open the page with that "safesurfs" URL.

I ran Malwarebytes software. It found nothing in my computer. I ran Eset NOD32 Antivirus, it found nothing in my computer. Ran the ADWcleaner for the second time, it found nothing in my computer.

Reading from the internet, there is a solution which is to buy SpyHunter anti malware. But I'm still hoping that there is another solution which is free :).

Now my question is changed from my original post : 1. Is this "safesurfs" malware which affecting Firefox dangerous ? 2. Am I safe if for the time being I just pin the shortcut of ff.exe ? (to prevent Firefox start with "safesurfs" URL page ? 3. I wonder why there is a difference pinning the shortcut of ff.exe --VS-- pinning directly the ff.exe file ?

Thank you once again for your comprehensive explanation, John99. BTW, is my post appropriate in this forum ? Because after I found out that the problem is a malware, I feel that my post is not appropriate in this Mozilla Support forum anymore... well, but at least I hope you know how to avoid Firefox get infected by this malware when the firefox.exe file is pinned to the taskbar :).

regards.

I will post more later just couple of quick comments Avoid spyhunter it costs money and I have seen bad reports about it. Dont go directly editing the Registry, either suitable tools will do that for you, or the remaining entries will be harmless once files are removed.

You can directly edit the firefox shortcuts. Remove everything except the closing quote marks, that is after firefox.exe because the rest has been added by malware and will cause that particular URL to be opened when Firefox starts.

Try using all the tools mentioned in

• Troubleshoot Firefox issues caused by malware

If malware problems are too complex we may need to suggest you get specialst help, but there are free advice sites that provide such help as mentioned in the article I linked to. Finding solutions to malware that affects Firefox helps others who are trying to solve the same issue so it is useful to post about such problems on our forum.

Most of the problems get solved by using the simple tools we link to or by other advice we are able to link to. You do need to take care looking for solutions because some supposed solutions try to scare you in to paying for a fix, or could even be scams sites themselves.

I may have expected ADWcleaner to have detected your infected shortcuts,

Here is page explaining how to remove safesurfs.net from a reputable site

• How to remove Safesurfs.net redirect (Virus Removal Guide) |Filed Under: Browser Hijackers https://malwaretips.com/blogs/remove-safesurfs-net/

That page does say the malware is more of a nuisance than being dangerous.

HI John99,

Thank you once again for your help. I forgot to mention that I've also run the TDSS Killer from Kapersky, beside ADWcleaner, Malwarebytes, Malwarebytes Rootkit and Eset NOD32. All of them show nothing as if my computer is free from virus/malware.

Just now I've found an article from Malwarebytes website : https://www.malwarebytes.com/restorebrowser/index.html

It did mention about pinning, but the article talk only for the shortcut which it didn't happen to me. This strange problem exist only if I pin the firefox.exe to the taskbar then click the pin.

1. Double click the firefox.exe is OK, 2. Double click the shortcut to firefox.exe is OK, 3. Pin that shortcut to the taskbar then click the pin is OK. Those 3 above start Firefox with a blank page as it's meant to be since in General Option I put "show a blank page" as the startup when FF open. If I change the startup to "show my home page" with google.com URL, those 3 above also show me the google.com URL.

I scratch my head :).

Anyway, I've downloaded the SuperAntispyware Portable Scanner and ran it. It did find some malwares/viruses. Here is the log file :

SUPERAntiSpyware Scan Log http://www.superantispyware.com

Generated 08/14/2016 at 11:56 PM

Application Version : 6.0.1222 Database Version : 12938

Scan type  : Quick Scan Total Scan Time : 00:00:40

Operating System Information Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601) UAC Off - Administrator

Memory items scanned  : 278 Memory threats detected  : 0 Registry items scanned  : 57857 Registry threats detected : 0 File items scanned  : 8059 File threats detected  : 29

Adware.Tracking Cookie C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\3NT121FG.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\3NT121FG.txt [ /adgrx.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\L1ZUDVVV.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\L1ZUDVVV.txt [ /scorecardresearch.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TEXSFCLM.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TEXSFCLM.txt [ /revsci.net ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\LZ1W2RLU.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\LZ1W2RLU.txt [ /cdn.turn.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\Z1PAGQQZ.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\Z1PAGQQZ.txt [ /mookie1.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\0QGMGRU0.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\0QGMGRU0.txt [ /casalemedia.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\Z3IZELQQ.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\Z3IZELQQ.txt [ /owneriq.net ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WA2CUDLR.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WA2CUDLR.txt [ /springserve.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\493HUVT1.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\493HUVT1.txt [ /criteo.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\NQA55FN4.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\NQA55FN4.txt [ /rfihub.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\EFM1BQLD.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\EFM1BQLD.txt [ /turn.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\AMU5GOFD.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\AMU5GOFD.txt [ /adsymptotic.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\06X5WS32.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\06X5WS32.txt [ /adnxs.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\1WQS9R3S.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\1WQS9R3S.txt [ /sitescout.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\KI8PROJT.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\KI8PROJT.txt [ /adaptv.advertising.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\LUMIBFJ4.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\LUMIBFJ4.txt [ /w55c.net ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WF3TMIOP.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WF3TMIOP.txt [ /chango.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TNNW9MGM.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TNNW9MGM.txt [ /everesttech.net ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WABH34C3.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\WABH34C3.txt [ /mathtag.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\CHZZK7S4.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\CHZZK7S4.txt [ /eyereturn.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\PNFUOUBM.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\PNFUOUBM.txt [ /adsrvr.org ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\QOJ4F4HC.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\QOJ4F4HC.txt [ /bluekai.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\L0Z1LVQE.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\L0Z1LVQE.txt [ /btrll.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TM4HOWVZ.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\TM4HOWVZ.txt [ /acuityplatform.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\V063C8PX.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\V063C8PX.txt [ /wtp101.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\C86CHFNH.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\C86CHFNH.txt [ /advertising.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\X9WT7LIO.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\X9WT7LIO.txt [ /eyeviewads.com ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\4TLGT5ZI.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\4TLGT5ZI.txt [ /simpli.fi ] C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\P4T4DYU5.txtC:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies\P4T4DYU5.txt [ /tubemogul.com ]

==

End of Log 

==

After I click the "clean" button, restart then pin the firefox.exe to the taskbar, the same problem still there. Ran SAS for the second time, it found nothing in my computer.

I haven't downloaded the Microsoft Safety Scanner and HitmanPro as the suggested software to use from your link you gave me. But I will and run them then I give you an update about the result.

So far I've used : 1. Malwarebytes with yesterday's updated database 2. Malwarebytes AntiRootkit with today's updated database 3. TDSS Killer (downloaded yesterday) 4. ADW Cleaner (downloaded yesterday) 5. SuperAntispyware Scanner (downloaded just now)

I've taken the step : 1. Reset Firefox Browser setting 2. Made a new profile from Firefox Profile Manager

Not yet : 1. Microsoft Safety Scanner 2. HitmanPro 3. Kaspersky Virus Removal Tool

I think I'm going crazy now because of this stubborn malware :). I've been thinking to just do the Win 7 system-image restore which I've backed up on June 2015 via Win 7 System Restore when my computer still fresh. But still I don't know for sure whether doing image restore will kill this malware.

Thank you once again, John99. I really appreciate your time and help.

regards.

Update : HitmanPro : no thread found :)

Hi again reko, Do not try the Windows 7 Restore, that will possibly create more problems than it will fix. The tracking cookies may not be ideal, but are not causing this issue and it is ok to ignore them for now.

I thought the problem with the strange behaviour when pinning Firefox to the taskbar may have been solved already.

I am using Windows 10 at the moment but in Windows 7 do you get an option to right click the taskbar or taskbar buttons and see the properties of the shortcut used. If so then do you get an option to edit the properties of that shortcut. The article you pointed out mentions how to make clean shortcuts https://www.malwarebytes.com/restorebrowser/index.html#fix-browser-shortcuts

What about removing the shortcut and adding it again. What method are you using to add the button to the taskbar ?

It did mention about pinning, but the article talk only for the shortcut which it didn't happen to me. This strange problem exist only if I pin the firefox.exe to the taskbar then click the pin. 1. Double click the firefox.exe is OK, 2. Double click the shortcut to firefox.exe is OK, 3. Pin that shortcut to the taskbar then click the pin is OK. Those 3 above start Firefox with a blank page as it's meant to be since in General Option I put "show a blank page" as the startup when FF open. If I change the startup to "show my home page" with google.com URL, those 3 above also show me the google.com URL.

So you have explained when this does not happen.

Have you checked the properties of the firefox .exe itself that you are using ? not just the firefox shortcut. What are you using and where are you finding it ? Possibly you are using another shortcut that is infected. The path to my Firefox is C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Hi John99,

I'm sorry for my late reply. Thanks for your advice not to do the Win7 System Restore. Oke... I won't do it.

The problem still there but since I don't want to have the headache anymore, I just do the pinning from the Firefox shortcut.

you wrote : do you get an option to right click the taskbar or taskbar buttons and see the properties of the shortcut used

reko : Yes, Win7 have the option as you asked. The properties in the Target box show like this : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed" (pic-02 from my post before)

I edit it to : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" removing completely the : "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed"

Restart the computer, the Firefox pin property of the Target boxstay in edited state. So the Target box didn't automatically come back with : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed"

BUT, if I unpinned it, then I pin back by right clicking directly the firefox.exe file, the pin target box property came back with : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed"

If you have the time, please take a look the four pictures I attached in my post before. From those picture I concluded : 1. The way Win7 pin a program to the taskbar is different between pinning directly the exe file VS pinning the shortcut to the exe file.

2. We can see the differences by right click the pinned program in the taskbar (pic-1 VS pic-3). Pic-1 is the result if I pin the exe file ---VS--- Pic-3 is the result if I pin the shortcut to the exe file.

3. After right click the pin in the taskbar : The one pinned directly from the exe file has 5 option : a. Open new tab b. Open new window c. New private window d. Mozilla Firefox e. Unpin this program from the taskbar (as seen in the Pic-1)

The one pinned from the shortcut to the exe file has 2 option : x. firefox.exe - Shortcut y. Unpin this program from the taskbar (as seen in the Pic-3)

If I move the cursor to point-d (Mozilla Firefox), right click, then click the Properties, the target box show "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" "http://www.safesurfs.net/?ssid=1470676413&a=1003679&src=sh&uuid=c0c6cf2c-9882-4108-84e8-277909e995ed" (as seen in Pic-2)

There is no "properties" option in point-a, b and c, only "open". So of I click a or b or c, Firefox starts with a blank page (which is meant to be because in the Firefox Browser Option I choose to "start with a blank page").

For the point-x the target box show : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" (as seen in Pic-4).

you wrote : Have you checked the properties of the firefox .exe itself that you are using ? not just the firefox shortcut.

reko : Yes I did. I think there is no suspected things in the firefox.exe properties. (I attached the screenshot in this post).

you wrote : What are you using and where are you finding it ?

reko : I'm sorry I don't understand your "what are you using"  :). Anyway, I did it by right-clicking the firefox.exe file where I can find this file in : C:\Program Files (x86)\Mozilla Firefox\

you wrote : Possibly you are using another shortcut that is infected. The path to my Firefox is C:\Program Files (x86)\Mozilla Firefox\firefox.exe

reko : No. I did it exactly as you mentioned above. Right click the firefox.exe file from within the path : C:\Program Files (x86)\Mozilla Firefox\

I got stressed searching deeply in the internet about this problem, but no result ... even there is no talking about how Win7 pin to the taskbar (right click the file then click "pin to taskbar") is different between pinning the exe file ---VS--- pinning the shortcut to the exe file.

And as you give me the link to Malwarebytes, it talk about the problem on the shortcut.. which on the contrary, my problem is not on the shortcut (to the firefox.exe file) but pinning directly the firefox.exe file to the taskbar.

Oh well... maybe someday I will just reformat my drive C: partition then clean-install Win7 OS to get rid off this malware :).

Thank you once again for your time, concern and respond about my problem, John99.

regards.

I did look at your pictures thanks.

I will post back again later this week. Post and bump the thread if I forget. I don't use Windows much these days, but I will try on Windows 7 so I am sure I can give you the correct instructions.

Reformatting the HDD & doing a clean install of Windows 7 is probably overkill, and a lot of work thereafter to get things back to normal. Installing Firefox and many other programs, settings & files from scratch. OR if you use backups to simplify the tasks, you could risk reintroducing malware.

Many thanks to you John99. You are much deserve to be the top 1 Contributor for me :)