How To Remove Scareware From Firefox?
Overview
Scareware is a type of malware that tries to trick the user into thinking that your computer system has a problem and then prompts you to purchase fake security software or other software in order to fix it.
This usually happens when you download an unknown program, such as shareware or freeware, from an unregulated site on the Internet. Scareware scammers can make their ads look like Windows system messages (this method is also known as “White Label” ) and try to either scare the victim into buying fake security software by showing him/her fake security alerts or convince him/her that he/she needs some Registry cleaning tool after running a fake scan.
Impact on Firefox users
Scareware usually tries to trick the victim into purchasing fake anti-spyware applications through pop-up windows. The “Security Suites” they offer are often made by companies popular with scammers (e.g., Norton Antivirus, McAfee) and contain only trial versions of legitimate antivirus products. What is worse, these security suites can even cause damage to your computer because they may be created by cyber criminals to disguise malware in the software package (also known as “scarepack” or “rogueware”).
How Scareware Modifies Firefox Settings?
Scareware usually tries to block access to legitimate security websites like McAfee, Symantec and Microsoft. They can hijack your browser (e.g., Internet Explorer), change your homepage and default search engine settings after you install them or they may use that fake security suite to remove some Firefox add-ons/extensions that are needed for security purposes (anti-malware in particular). Scareware distributors use a variety of names when they try to trick people into thinking their software is a genuine anti-spyware, such as: Spyware Removal, System Security, PC Security Shield Pro, Windows Defender Plus etc.
How To Remove Scareware From Firefox:
Firefox (all platforms)
1. Type “about:config” in the address bar and hit Enter.
2. If you get a message that says “This might void your warranty!”, click the button labeled “I’ll be careful, I promise!”.
3. In the Search box at the top, type “/on4”. This brings up all of the preferences which start with “/on4/” (the number 4 represents other numbers in between it). Scroll down to browser.startup.homepage_override.mstone and double-click on it to change its value from undefined to 5130 . This should prevent websites from hijacking your home page settings. Note: If there is no entry for browser.startup , right-click on an empty spot and select New –> Boolean from the pop-up menu. Type browser.startup.homepage_override.mstone for the name of your preference and set its value to 5130 .
4. In the Search box at the top, type ‘ “/on3″ ‘. This brings up all prefs starting with ‘/on3/’ (the number 3 represents other numbers in between it). Now scroll down to browser.search.”preferred”; double click on it, make sure that it reads reset(edit) instead of user_pref(“browser.”, “change name”, “your chosen name”)); . This should prevent websites from hijacking your search engine settings (although only if you haven’t made any custom changes to your search preferences).
5. In the Search box at the top, type ‘/on2’. This brings up all prefs beginning with ‘/on2/’ (the number 2 represents other numbers in between it). Scroll down to browser.startup.homepage_override_url and double-click on it to change its value from http://isearch.babylon.com/?affID=111618&tt=gc_&babsrc=HP_ss&mntrId=c0caaee000000000000007812e9c43a to https://www.google.com . This should prevent websites from hijacking your home page settings.
6. In the Search box at the top, type ‘/on4’. This brings up all prefs beginning with ‘/on4/’ (the number 4 represents other numbers in between it). Scroll down to browser.startup.homepage_override.mstone and double-click on it to change its value from undefined to 5130 . This should prevent websites from hijacking your home page settings. Note: If there is no entry for browser.startup , right-click on an empty spot and select New –> Boolean from the pop-up menu. Type browser.startup.homepage_override.mstone for the name of your preference and set its value to 5130 .
7. In the Search box at the top, type ‘/on3’. This brings up all prefs beginning with ‘/on3/’ (the number 3 represents other numbers in between it). Scroll down to browser.search.showOneOffButtons and double-click on it to change its value from false to true . This should prevent websites from hijacking your search engine settings (although only if you haven’t made any custom changes to your search preferences).
8. Close Firefox completely and reopen it for your changes to take effect!
Conclusion
Now your Firefox browser should be free of Scareware. If you’re afraid that some website is controlling your browser, go back to the about:config window and search for “/browser/startup” (without quotes), then delete any entry under it whose name starts with “browser_”.
If you think that your computer is infected, try to use tools like Malwarebytes Anti-Malware (free) or antivirus products like AVG Antivirus (free). If you believe that the problem they fix is real, ask for help in legitimate security forums. You should not trust free services on unregulated websites unless you are 100 percent sure of their trustworthiness.
