This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

malware not in add-ons

  • 2 replies
  • 1 has this problem
  • 10 views
  • Last reply by kakakali

kakakali
kakakali
more options

Note': Such problems do exist when all add-ons disabled and in safe mode Firefox (by "refresh firefox" option).

When Firefox is started, an advertising window would occur. The hijacked address: https://winxuan[.]jd[.]com/?cu=true&utm_source=kong&utm_medium=tuiguang&utm_campaign=t_1000623798_&utm_term=19dca519301545a6b711007896b3b333 hijacked address

Also, Ctrl + Shift + N was hijacked to the same window.

The window is strange: When I click the "+" button to open a new tab, the new tab directly opens in the previous window.

Perhaps something in Firefox itself was maliciously modified, I guess.

I am using 88.0.1 (64-bit) version Firefox on Win10.

'''Note': Such problems do exist when all add-ons disabled and in safe mode Firefox (by "refresh firefox" option).''' When Firefox is started, an advertising window would occur. The hijacked address: https://winxuan[.]jd[.]com/?cu=true&utm_source=kong&utm_medium=tuiguang&utm_campaign=t_1000623798_&utm_term=19dca519301545a6b711007896b3b333 hijacked address Also, Ctrl + Shift + N was hijacked to the same window. The window is strange: When I click the "+" button to open a new tab, the new tab directly opens in the previous window. Perhaps something in Firefox itself was maliciously modified, I guess. I am using 88.0.1 (64-bit) version Firefox on Win10.

Modified by Andrew

Chosen solution

Could you check to make sure your home page was not modified? See: How to set the home page

Another possible vector is a modified shortcut. Normally your shortcut has a "Target" like this:

"C:\Program Files\Mozilla Firefox\firefox.exe"

but malware may add a URL to the target so that Firefox launches a page every time you use the shortcut.

Ctrl+Shift+N will re-open the last window you closed during your session, so I don't know whether you are just seeing that, or something specifically attached to Ctrl+Shift+N.

Read this answer in context 👍 1

All Replies (2)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Chosen Solution

Could you check to make sure your home page was not modified? See: How to set the home page

Another possible vector is a modified shortcut. Normally your shortcut has a "Target" like this:

"C:\Program Files\Mozilla Firefox\firefox.exe"

but malware may add a URL to the target so that Firefox launches a page every time you use the shortcut.

Ctrl+Shift+N will re-open the last window you closed during your session, so I don't know whether you are just seeing that, or something specifically attached to Ctrl+Shift+N.

kakakali
kakakali Question owner
more options

jscher2000 said
Could you check to make sure your home page was not modified? See: How to set the home page Another possible vector is a modified shortcut. Normally your shortcut has a "Target" like this: "C:\Program Files\Mozilla Firefox\firefox.exe" but malware may add a URL to the target so that Firefox launches a page every time you use the shortcut. Ctrl+Shift+N will re-open the last window you closed during your session, so I don't know whether you are just seeing that, or something specifically attached to Ctrl+Shift+N.

Thanks for your reply. Firefox now works fine. The shortcut was checked and was not modified. So it should be a malicious add-on :) (which is common and I'll find it). I didn't realize Ctrl+Shift+N would open the last closed window (usually to open a new private window in other browsers). QAQ