Running windows 7 but get message on opening firefox that my MAC OS is infected, will not go away even when uninstalling/reinstall of firefox
Was searching for a site, suddenly received a page stating that my MAC OS has become infected. I'm running Win 7 ultimate. Will not let me clear error message and will immediately load same message when closing and restarting Firefox, I uninstalled Firefox, ran regedit and cleared out Mozilla info, cleared my AppData section, ran Ccleaner business edition, Malwares and Microsoft Security essentials. Reloaded Firefox and experienced exact same issue. Chrome and Opera are free of this issue, only Firefox is affected..
All Replies (4)
Hi ikeisaacks,
I'm sorry to hear you're having issues with a website loading without your permission.
You could also try Malwarebytes extension : Malwarebytes Browser Extension {link}
I believe it would be a good idea to restart Firefox in Safe Mode to see if these problems persist.
To do this :
- Click the '3-bar' menu
- Click Help
- Click Restart with Add-ons Disabled...
- Click Restart
- Choose Start in Safe Mode
If problems persist you could try to clear your cookies and site data if you haven't already :
- Open a new tab in your web browser
- Type about:preferences#privacy in your address bar
- Under Cookies and Site Data click Clear Data
- Read the warning,
"may sign you out of websites and remove offline web content. Clearing cache data will not affect your logins."
If you are okay with the above message check mark one or both options and click Clear.
Related Knowledge Based Article for Malware related issues : Troubleshoot Firefox issues caused by malware {link}
Let me know if the problem persists!
As a footnote to the above, if you crash out of Firefox, then Firefox will attempt to restore your last set of tabs when you restart. So in this case, crash recovery may be working against you.
To avoid an unwanted session recovery, you could either modify a settings file or hide your session history files from Firefox so that it can't restore the unwanted page at the next startup. Here's how:
Step #1: Open the profile folder
Windows
Type or paste the following into the Windows Run dialog or the system search box, and press Enter to launch Windows Explorer into this folder:
%APPDATA%\Mozilla\Firefox\Profiles
You should see at least one semi-randomly-named profile folder there. (If you see more than one, you'll want to figure out which one has the unwanted session history in it by checking each one.)
Double-click into the profile folder.
Mac or Linux
Your Firefox profile folder would be accessible in a different way than on Windows. Please see these articles for information on how to locate it:
- Profiles - Where Firefox stores your bookmarks, passwords and other user data
- http://kb.mozillazine.org/Profile_folder_-_Firefox
Step #2: Your Choice of...
Modifying a Settings File
At startup, Firefox will check whether to restore tabs automatically or show you a list so you can make your own selections. In the most recent versions of Firefox, you may need to click a button to see the list.
In your profile folder, locate the file named prefs.js and open it in a text editor -- if you are running Windows, make sure to right-click > Edit or right-click > Open With to avoid executing the script.
By default, Windows hides the .js extension, so to make sure it's the right file, you may want to set Windows to show all extensions. See: https://www.bleepingcomputer.com/tutorials/how-to-show-file-extensions-in-windows/
Paste this on a new line at the end and save the change:
user_pref("browser.sessionstore.max_resumed_crashes", 0);
When you save, make sure to avoid adding any formatting (save using a plain text format) or changing the file name (you don't want to end up with .txt on the end).
If you're not sure it worked, you could also do the next option.
Hiding Session History Files
This is less convenient if you want to restore some of your tabs, but if you don't care, you may prefer this.
- Right-click the sessionstore-backups folder and rename it to sessionstore-backupsOLD (later you can mine the files in this folder for any important tabs you want to restore)
- Check for any files with these names and:
- sessionstore.jsonlz4 - created by Firefox 56-68 when it shuts down normally - rename to OLDsessionstore.jsonlz4
- sessionstore.js - created by Firefox 55 and earlier when it shuts down normally - rename to OLDsessionstore.js
- sessionstore.bak - obsolete file from years ago - delete
When you start Firefox up again, it should just show the home page.
Success?
If you need to read the contents of any of those hidden files, you can use this tool on my websites to extract out a list of the tabs:
Forgot to mention, I'm using Win7 Ultimate, not MAC OS. I have deleted all folders I know that have anything to do with Mozilla/Firefox, cleaned registry entries, AppData folders deleted completely but still getting same indication when installing new Firefox. Immediately get the screen that says MAC OS infected, call xxx-xxx-xxxx to clear up issues. Of course I won't do that and listen to some idiot trying to scam money. As stated only Firefox is affected and when this screen pops up I cannot access anything on the Firefox browser. When I go to task manager and stop the MAC OS virus page it also stops Firefox. Chrome, Opera and other browsers are unaffected.
If you deleted all of your Firefox folders, then session restore would not be an issue. A new installation should start up with the default home page and new installation page, a not a scam page. Either you are not fully removing Firefox data -- I am not recommending you remove all your data -- or you have a contaminated installer or you have persistent malware on your system.
By the way, try this:
(A) Start Firefox -- if Firefox goes to full screen, press the Esc key
(B) Right-click the Firefox tile on the Taskbar to call up the Jump list and click New Window
(C) Hover the Firefox tile on the Taskbar and X close out of the scam page window
Does that work?