Separate Security Issue, please update your Flash 28.0 r0 by removing it with this tool : https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html If you use it Reinstall with Flash Player Version: 30.0.0.154 Current Version https://get.adobe.com/flashplayer/otherversions/ Step 1: Select Operating System Step 2: Select A Version (Firefox, . . . .) Note: Other software is offered in the download. <Windows Only>

Backup :

• https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles
• https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer

You can try : https://www.revouninstaller.com/revo_uninstaller_free_download.html to remove it, though may remove your Profile which is why backedup.

Start here with Malwarebytes : Please use more than 1 scanner as each uses diff tech :

• https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Save your Report and google each before deleting anything as do not want to delete something you need, If need help :

• https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Uninstall any Bittorrent apps, uninstall cracked programs and delete cracks then Post in only 1 forum, then wait. Please let us know if this solved your issue or if need further assistance.

I have reinstalled the mozilla firefox early but it didn't worked for me. This Ad aware is hidden somewhere in my PC and it is difficult to remove as I have uninstalled the Lavasoft Web Companion from my PC earlier and then I noticed this problem.

AdAware or Web Companion from Lavasoft.

You can look for a file named dsengine.js in these locations. You should only find channel-prefs.js in the "defaults\pref" location. Any file found here apart from channel-prefs.js is suspicious. You can check the content of the file in a text editor (use open with and do not double-click the file).

C:\Program Files\Mozilla Firefox\defaults\pref\ C:\Program Files (x86)\Mozilla Firefox\defaults\pref\

You can look for a file named dsengine.cfg in the main Firefox program folder.

C:\Program Files\Mozilla Firefox\ C:\Program Files (x86)\Mozilla Firefox\

Delete the dsengine.js and dsengine.cfg files when present.

I am using a 64 bit machine.

C:\Program Files\Mozilla Firefox\defaults\pref\ Found this file :-

0xphi3ajdlo.jss

After Opening it shows this:-

// The first line of this and the config file will always be ignored. Set default search for adaware users after consent pref("general.config.filename", "0xphi3ajdlo.cfg"); pref("general.config.obscure_value", 0);

Now what to do and how to proceed....

Rename it with .old As well find this file : 0xphi3ajdlo.cfg as code points to it. You may have to boot to Safe Mode if it is in other parts of Windows.

And I am unable to find a file with the name dsengine.js and dsengine.cfg in C:\Program Files\Mozilla Firefox

Pkshadow said

Rename it with .old As well find this file : 0xphi3ajdlo.cfg as code points to it. You may have to boot to Safe Mode if it is in other parts of Windows.

Where I can find this file in my PC. Any probability or guesses or any clue. Where such kind of file can hide???

No, I do not. If you have Windows 10 setup to index all files and folders and drives then stick the name into the Start Menu Search and have it look for it.

The other is to go to the Malwarebytes Forum and have the Pros help you out.

You may have already uninstalled that file.

Thank You very much for the HELP that you have provided :)

I have deleted that file 0xphi3ajdlo.js and then went to options>search>Removed that stupid search engine and restarted Mozilla Firefox and now it is working fine and My Mozilla Firefox is now Hijacker free.

Now Lastly I have found the file :-

0xphi3ajdlo.cfg

It shows:-

// This line is ignored. adaware cfg file. // Import the XPCOM component var Cu = Components.utils; Cu.import("resource://gre/modules/Services.jsm");

function addSearch() { // Check if we have already added our search engine, as we don't want to keep adding it if (Services.search.getEngines().indexOf(Services.search.getEngineByName("Ad-Aware SecureSearch Search Engine")) === -1) { // let iconURI = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAABGklEQVQoz2NgGB6AnZ1dUlJSXl4eSDIyMhLW4Ovr%2B%2Fr168uXL69Zs4YoG%2BLi4i5dusTExMTGxsbNzd3f37937976%2BnpmZmagbHR09J49e5YvX66kpATVEBYW9ubNm2nTphkbG7e2tp44cQLIuHfvXm5urpaWFlDKysqqu7v73LlzECMYIiIiHj58mJCQoKKicvXq1bS0NKBgW1vbjh074uPjgeqAXE1NzSdPnvDz84M0AEUvXLgAsW379u1z5swBen3jxo2zZ892cHB4%2BvQp0KlAfwI1cHJyghQFBwfv2rULokFXV%2FfixYu7d%2B8GGqGgoMDKyrpu3br9%2B%2FcDuXl5eVA%2FAEWBfoWHAdAYoNuAYQ0XAeoUERFhGDYAAPoUaT2dfWJuAAAAAElFTkSuQmCC";

// Manually define the search, otherwise setting the search won't work as it hasn't downloaded yet. //Services.search.addEngineWithDetails("Ad-Aware SecureSearch Search Engine", "http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.ico", "", "", "GET", "http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WCYID10420__180822&q={searchTerms}");

Services.search.addEngineWithDetails("Ad-Aware SecureSearch Search Engine", { iconURL: "http://securedsearch.lavasoft.com/templates/home/adaware_securesearch/favicon.ico", template: "http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WCYID10420__180822&q={searchTerms}", suggestURL: "http://api.bing.com/osjson.aspx?q={searchTerms}", });

// Name of search we're looking for in the search plugin array let engine = Services.search.getEngineByName("Ad-Aware SecureSearch Search Engine");

// If the search isn't set, set it if (Services.search.currentEngine.name != "Ad-Aware SecureSearch Search Engine") { Services.search.currentEngine = engine; } } } // Asynchronously initialize the function, as synchronous initialization will be deprecated eventually. Services.search.init(() => { addSearch(); });

And then Deleted it