A Virus deleted all my bookmarks now I have just a Files folder?
Hiya everyone, Well I got a virus today from a file that should of been safe? Anyways I have lost ALL my bookmarks and uninstalled-installed FF, Checked the APPDATA for them and the only file thats large in there is a file titled PROFILE which has a "Folder" and it has in it another file called CACHE2 and then when I go in there it has a Folder with just over a gig of files which must be my bookmarks but they are not in a JSON format or any readable file they are just "Files".
Can anyone help please as I have lost a lot of valuable bookmarks.
Many thanks.
(Screenshot attached)
Keazen oplossing
According to the time stamp appended to the profile name (1546208401862) this profile got created Sun 30 Dec 2018 22:20:01:862 GMT as the result of a refresh (only a refresh creates a profile with a time stamp).
Did you look at the desktop to see if there is an "Old Firefox Data" folder on the desktop?
Is this the only profile in C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles ?
Dit antwurd yn kontekst lêze 👍 0Alle antwurden (10)
Just to add, It has also reset ALL by browser history so I have nothing it is like I have just installed the browser?
Your Screenshot shows the cache2 folder that is used for the disk cache. Your personal data is in another location in "AppData\Roaming" and may still be there.
Firefox uses two locations for the Firefox profile folder, so make sure to look in the correct location. Location used for the main profile that keeps your personal data in "AppData\Roaming" (Root Directory on about:profiles).
- C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\
Location used for the disk cache and other temporary files in "AppData\Local" (Local Directory on about:profiles).
- C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<profile>\
You can check if you have an "Old Firefox Data" folder on the desktop in case the Refresh feature in Firefox has been used and a new profile has been created.
It is possible that there has been a problem with the profiles.ini file that registers profiles and that a new default profile got created.
You can check if you have an orphaned profile that isn't registered in profiles.ini and that doesn't show in the Firefox Profile Manager. You can check that by opening the current profile folder via the about:profiles page and go up one level (..) to see if there are unlisted profiles present. If you have found an orphaned profile then you may want to recover some personal data or restore his profile.
You can recover an orphaned profile via these steps:
- use the Profile Manager to create a new profile
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles - click "Choose Folder" in the Profile Manager
- browse to the location of this profile to register this profile in the Profile Manager and use this profile
See "Profile was moved or renamed":
Note that you should never use "Choose Folder" to specify a folder that already contains files that do not belong to Firefox. Only use "Choose Folder" to recover an profile that isn't listed in the Profile Manager.
- bookmarks and history: places.sqlite
- bookmark backups: compressed .jsonlz4 JSON backups in the bookmarkbackups folder
- cookies.sqlite for the Cookies
- formhistory.sqlite for saved autocomplete Form Data
- logins.json (passwords) and key4.db (58+) or key3.db (57 and older) (decryption key) for Passwords saved in the Password Manager
if you only have key3.db then make sure to remove an existing key4.db - cert9.db (58+) or cert8.db (57 and older) for (intermediate) certificates stored in the Certificate Manager
if you only have cert8.db then make sure to remove an existing cert9.db - persdict.dat for words you added to the spelling checker dictionary
- permissions.sqlite for Permissions and possibly content-prefs.sqlite for other website specific data (Site Preferences)
- sessionstore.jsonlz4 for open tabs and pinned tabs (see also the sessionstore-backups folder)
Hi Cor-El,
Thank you so much for your time and explanation.
I have tried to find the AppData file and its got some bookmarks present but they is only a small amount of them, The bookmarks I had was something like 1500.
I uninstalled FF earlier just before I started this thread as someone suggested it on a post I was reading and that didnt work?
It would seem the only file I have is the cache2 folder, Can I do anything with this or is it a no go?
Best Wishes and thanks again.
Aren't there any folders and files present in the AppData\Roaming location?
- C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\
"Old Firefox Data" folder on the desktop
You can look at this utility to browse System Restore points.
- System Restore Explorer
http://nicbedford.co.uk/software/systemrestoreexplorer/
Hi bioshock, in case you haven't already, make sure to set Windows to show you hidden files and folders:
https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files
As a shortcut to
C:\Users\your-user-name\AppData\Roaming\Mozilla\Firefox\Profiles
you can paste the following to the Windows search box (on the Task bar, usually) and press Enter to load it:
%APPDATA%\Mozilla\Firefox\Profiles
Look in each folder there for a subfolder named bookmarkbackups.
That folder contains compressed files (.jsonlz4 extension) with the creation date code into the file name. Can you find a recent one?
These files cannot be opened by regular applications. I have a page to decompress them and export out an HTML versions of the bookmarks if you want to see what's in a file before trying to restore one:
Hi Cor-El,
Thank you once again sorry for the late reply.
I have located the files you stated but in the Bookmarks there is present just new bookmarks and not the ones I had before the virus did this?
Many thanks. (Screenshot attached)
Hi jscher2000,
Thank you so much for your time and help.
I have done that and could only find about ten Bookmarks and each of them was dated yesterday but I think the time on them was after the virus caused this I cant seem to find anything else? Today I am going to use some software and scan my C: Drive for items deleted in my Recycle bin and see if the virus has deleted them as I think thats my last port of call dont you think?
I tried your method of dragging and dropping the current bookmarks into the site you kindly sent me and it told me invalid file even though it was in the location you stated and the file format was ' .jsonlz4.xabae ' and I tired other bookmarks and nothing happened when I dragged and dropped them? so I tried the "locate file" method and when I dragged one of the bookmarks to the desktop it just kept opening up the 'locate file' instead of actioning the file id directed the site too?
I cant thank you enough for your help.
Best Wishes.
bioshock said
I tried your method of dragging and dropping the current bookmarks into the site you kindly sent me and it told me invalid file even though it was in the location you stated and the file format was ' .jsonlz4.xabae ' and I tired other bookmarks and nothing happened when I dragged and dropped them?
It's not normal to have an extra file extension after .jsonlz4 -- I don't know where that came from. Did you have a ransomware infection that encrypted your files and demanded to be paid to recover them?
Do you still have the OId Firefox Data folder on your desktop?
Keazen oplossing
According to the time stamp appended to the profile name (1546208401862) this profile got created Sun 30 Dec 2018 22:20:01:862 GMT as the result of a refresh (only a refresh creates a profile with a time stamp).
Did you look at the desktop to see if there is an "Old Firefox Data" folder on the desktop?
Is this the only profile in C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles ?
Hello jscher2000 and Cor-el.
So sorry for the late reply its been manic here with the NYE celebrations so ive only just sat down to reply.
I backed up what files I had of the browser and noticed almost my entire system (OS) wasn't right? the
virus had Clearly critically damaged my W10. So after
backing it up I rolled back to W7 64 on my 8700K
machine and its running really sweet, I didn't manage
to get my bookmarks back but that's not through lack
of help you two both kindly offered me so Id like to thank you both for the last time and wish you the very
best for 2019.
One suggestion might I add that FF is configured in a way where every week it backs up peoples Bookmarks for
instances like mine where I have basically been robbed
of vital bookmarks..
Kindest Regards and thanks.