hello heckle,

I am leaning towards your browser being hijacked.

But can you take a snap shot or a snip or print scree of this oddity?

~dbben,

Thanks for your response. It looks pretty suspicious to me too. The image has been cropped, but it's a screen shot of about:preferences. The same message appears on other about:... pages.

~dbben,

A little more info. I've just discovered the text in question is a link to about:policies. There is one active entry: Policy Name: Certificates; Policy Value: ImportEnterpriseRoots; true

Hi, assuming you didn't add a Policy yourself, that indicates one has been added by something else, and is often caused by Avast > Core shields > Web shield tab, not having unticked entries 'https scanning' and 'QUIC/http3.' First untick both entries in Avast, then you need to manually remove the entry in the Registry. Unless you are confident editing the Registry, create a Windows Restore Point first - just in case you make a mistake, then open the Registry by typing regedit into your PCs search box. Next, navigate through 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Certificates' then select and right click > Delete 'ImportEnterpriseRoots.' (If necessary, you can also delete \Firefox and \Mozilla.)

Hello Heckle, Thanks for the additional info. I have a thought that might help you. However, let us know how the registry edit cited in the above post, works out.

~dbben & Scribe,

Some stuff has happened since the last post.

1. Deleted the registry entry you suggested (it only appeared if I ran regedit as administrator). 2. Checked about:preferences, "Your browser..." text was still there. 3. Quit and restarted Firefox, "Your browser..." still there. 4. restarted PC

    a. Home page reset to default, numerous icons missing
    b. Edge set as default browser
    c. VPN reset to "get started"
    d. all bookmarks disappeared
    e. Downloads, Documents, Pictures, Music, & Videos folders all empty
    f.  "Your browser..." still there
    g. ImportEnterpriseRoots registry entry there (again?)

I've deleted the registry entry a second time, and I did make a restore point before editing the registry. What now?

VPN?

Though i understand what VPN is, I dont use VPN and dont know how it works or how to manage settings for it.

But it seems that the message in the gray box could correlate to the VPN service.

The VPN service is probably viewed by FF as your "organization".

Can you disable/turn off/disconnect your VPN and use regular internet to test this issue?

(I am on my way out the door do some errands. But when I get back I will review what all that you have shared with us.)

You can inspect the Mozilla and Firefox keys with the Windows Registry Editor in HKEY_LOCAL_MACHINE and in HKEY_CURRENT_USER with the Windows Registry Editor to see whether GPO policy rules are active.

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\
• HKEY_CURRENT_USER\SOFTWARE\Policies\Mozilla\Firefox\

Note that the mere presence of the "Mozilla\Firefox\" key is sufficient to make Firefox display this notification, so if you have the Firefox key then remove it and only leave the Mozilla key or remove this key as well if it is empty.

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ =>
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\

Scribe,

I neglected to mention that I did untick QUIC/http3 in Avast before deleting the registry entry you mentioned. https scanning was not ticked when I got there.

~dbben,

The message in the gray box is the same regardless of VPN state: on or off

cor-el,

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ both ...\Mozilla and ...\Mozilla\Firefox contain only a default entry with no value set HKEY_CURRENT_USER\SOFTWARE\Policies\Mozilla\Firefox\ does not appear, nor does HKEY_CURRENT_USER\SOFTWARE\Policies\Mozilla\

all,

about:policies#active page says, "The Enterprise Policies service is inactive. in bold.

Given the number of files that have disappeared, it's difficult to believe that this issue is from Avast, Firefox or Mozilla VPN. The only change I have made since the last restart (see above) is to delete the offending registry entry, and now the gray box does not appear on about:preferences.

Suggestions?

OK, 'The Enterprise Policies service is inactive' in about:policies is normal if there are no policies set, and you say that the 'Your browser is being managed...' banner has now gone, so it seems that what you did in Avast and the Registry has removed it. (I have myself done the same procedure in Avast and the Registry some time ago, and it removed the banner successfully, without any changes to files etc.) Is there any chance you accidentally deleted any Windows entries from the Registry? If so, rolling back using the Restore Point is going to be your best option I think, although you would have to repeat again the removal of the Avast entries of course.

If you are sure you only deleted the Firefox policy entry, like you, I don't see how that could possibly remove Windows files. Since it happened when you restarted your PC I'm just wondering if by coincidence there was a bad Windows update waiting in the wings for a restart to get installed, so it might be worth seeing if any updates were installed at that time and maybe try uninstalling it/them, or do a search on the web for their KB number(s) to see if there are any other reports of problems.

Like I wrote above, you need to remove the \Mozilla\Firefox\ key leaving only HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ to make the notification go away.

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ =>

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\

PROBLEM SOLVED USING APPROACH IN THIS THREAD: I encountered this problem today after an update to W10... I unticked the two boxes in Avast as suggested above and removed the HKEY_LOCAL_MACHINE\SOFTWARE\Policies for Mozilla (and therefore by default Firefox) and the problem was solved.

I just noticed this today. However, I do not have AVAST. I use "Windows Defender". I also have "CCleaner Professional Plus" and "SUPERAntiSpyware Pro X". Everything is up to date.

There was nothing in HKEY_CURRENT_USER\SOFTWARE\Policies except "Microsoft" and "Power". However, in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Certificates I do have "ImportEnterpriseRoots" as a REG_DWORD with a value of 1. "ImportEnterpriseRoots" is the critter that is the "organization" shown when I clicked on "Your browser is being managed by your organization".

I don't know enough about the registry to make uninformed changes. So, what do I do from here? Do I just delete it? Do I change the value to 0?

The mere presence of the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ key is sufficient to display the notification in Settings, so you would have to remove the entire Firefox key to get rid of the notification.

The "ImportEnterpriseRoots" policy is used to import certificates from the Windows system certifcate store. This usually happens if you have (security) software that wants to inject its root certificate in Firefox to be able to inspect your internet traffic as a MITM, but you write that you do not have suspect security software like Avast.

• https://github.com/mozilla/policy-templates#certificates--importenterpriseroots

I have Avast and this is done to secure your browsing, it's good actually, I used to get bother by it, but now the scammers and ransomware buttholes of the world have made the Internet dangerous. I have installed Avast add-on and activated on Avast all the Internet, email, rootkit and ransomware shields. A couple of months ago, I had all the shields up and Avast detected 2 ransomware attacks, gave me IP and other details, both from USA, so I reported them to the FBI; so be careful