That is not a normal Firefox message. It may have come from an add-on or your protection programs.

FredMcD said

That is not a normal Firefox message. It may have come from an add-on or your protection programs.

Is there any way I can prevent this from happening? Why does it even show-up to begin with? It usually only happens the first time I open Firefox; if I were to go away and come back a few hours later, it doesn't happen. As mentioned in my first post, I've run both antivirus and malware scans and nothing has come-up as being suspicious.

That depends on what is calling that message.

Do you have something called; Search Restore? Look at the address of that message. That is from your hard drive.

I'm sorry, I don't understand. I want to know why this keeps popping-up when I first come on to Firefox in the mornings. Is it safe to simply close the tab and delete it from my history? I haven't clicked on the "Restore search settings" button because I'm worried that this is something potentially malicious. I have run both an antivirus and a malware scan and they haven't found anything, however. This has only started happening since my Firefox updated to version 63.0.3. Is it safe to ignore this? As I mentioned before, I haven't interacted with anything on the tab other than closing it and removing it from my history.

Did you check the location that shows in the screenshot to see what files are there?

Maybe search the Windows Registry for this file path (SearchRestore).

Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.

• download the Firefox installer and save the file to the desktop
  *https://www.mozilla.org/en-US/firefox/all/

If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.

• do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

• (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
• (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"

• it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling
• http://kb.mozillazine.org/Uninstalling_Firefox

Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.

If you keep having problems then you can create a new profile to test if your current profile is causing the problem.

• https://support.mozilla.org/en-US/kb/Profiles
• https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles

Reinstall Firefox

• https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems

cor-el said

Did you check the location that shows in the screenshot to see what files are there? Maybe search the Windows Registry for this file path (SearchRestore).

---

Do a clean reinstall of the current Firefox release and delete the Firefox program folder before installing a fresh copy of the current Firefox release.

• download the Firefox installer and save the file to the desktop
  *https://www.mozilla.org/en-US/firefox/all/

If possible uninstall your current Firefox version to cleanup the Windows Registry and settings in security software.

• do NOT remove "personal data" when you uninstall the current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

• (64-bit Firefox) "C:\Program Files\Mozilla Firefox\"
• (32-bit Firefox) "C:\Program Files (x86)\Mozilla Firefox\"

• it is important to delete the Firefox program folder to remove all the files and make sure there are no problems with files that were leftover after uninstalling
• http://kb.mozillazine.org/Uninstalling_Firefox

Your personal data like bookmarks is stored in the Firefox profile folder, so you won't lose personal data when you reinstall or update Firefox, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.

If you keep having problems then you can create a new profile to test if your current profile is causing the problem.

---

• https://support.mozilla.org/en-US/kb/Profiles
• https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles

Reinstall Firefox

• https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems

I'm sorry for sounding ignorant, but how to I find/use Windows registry? Is it the Windows key+R?

EDIT: I did a few searches but nothing seems to have come up at all. Is it safe for me to ignore the tab as in the screenshot whenever it next appears? Would it be worth my time in refreshing my Firefox browser? I would like to know if this is potentially malicious at all or not, too.

I did some more searching and found under SearchRestore two things; an XPI File called bing-ext.xpi and a Firefox HTML Document called restore.

I'm not sure exactly where to go from here, but since nothing bad seems to have happened, and since Bing is no longer in my one-click search engines list under my Firefox options, is it really okay or safe for me to ignore the tab if/whenever it appears again? Or, as I asked before, would it be worth my time to refresh Firefox via the about:support option?

Any help on this issue would be greatly appreciated.

finlandsberet said

I did some more searching and found under SearchRestore two things; an XPI File called bing-ext.xpi and a Firefox HTML Document called restore.

I ignore moldy cheese in my fridge. That doesn't mean everything is okay. :-)

A .xpi file is an extension, which something may have "side-loaded" into your Firefox. I would treat it as potentially the tip of a malware iceberg and do a scrubdown.

Here's my suggested procedure for tracking down and cleaning up bad add-ons and other hijackers. I know it seems long, but it's really not that bad.

(1) Open the Windows Control Panel, Uninstall a Program.

After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.

Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.

(2) You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions.

Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).

Any improvement?

(3) You can search for remaining issues with the scanning/cleaning tools listed in this support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

Hopefully that will flush anything on your system and in your Firefox that could be a problem.

jscher2000 said

finlandsberet said

I did some more searching and found under SearchRestore two things; an XPI File called bing-ext.xpi and a Firefox HTML Document called restore.

I ignore moldy cheese in my fridge. That doesn't mean everything is okay. :-)

A .xpi file is an extension, which something may have "side-loaded" into your Firefox. I would treat it as potentially the tip of a malware iceberg and do a scrubdown.

Here's my suggested procedure for tracking down and cleaning up bad add-ons and other hijackers. I know it seems long, but it's really not that bad.

(1) Open the Windows Control Panel, Uninstall a Program.

After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.

Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.

(2) You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions.

Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).

Any improvement?

(3) You can search for remaining issues with the scanning/cleaning tools listed in this support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

Hopefully that will flush anything on your system and in your Firefox that could be a problem.

Thank you very much for all of your help.

I tried each of your suggestions, but nothing seems out of the ordinary. Would I be safe in simply deleting the .xpi file and the HTML Document?

EDIT: I double-checked and I have a legacy extension on Firefox; Mozilla Partner Defaults 1.0.1, but I didn't think that would have any effect since Mozilla already disabled it.

finlandsberet said

I tried each of your suggestions, but nothing seems out of the ordinary. Would I be safe in simply deleting the .xpi file and the HTML Document?

That sounds good. If you have unknown software on your system, I think it makes sense to remove it. Particularly if its only apparent purpose is to switch your search engine to one you don't prefer.

jscher2000 said

finlandsberet said

I tried each of your suggestions, but nothing seems out of the ordinary. Would I be safe in simply deleting the .xpi file and the HTML Document?

That sounds good. If you have unknown software on your system, I think it makes sense to remove it. Particularly if its only apparent purpose is to switch your search engine to one you don't prefer.

I deleted the file; I'll keep an eye on it and see if anything happens. Thank you for your help!

jscher2000 said

finlandsberet said

I tried each of your suggestions, but nothing seems out of the ordinary. Would I be safe in simply deleting the .xpi file and the HTML Document?

That sounds good. If you have unknown software on your system, I think it makes sense to remove it. Particularly if its only apparent purpose is to switch your search engine to one you don't prefer.

Hello again.

After deleting the file, I won't see that tab as shown in the screenshot again, correct?

Hi finlandsberet, there are two possibilities after deleting this file:

(A) Firefox works normally

(B) Firefox says file not found

In case (B), we need to help you track down why Firefox might still be looking for that file, such as home page setting or hijacked Firefox shortcut (page address added to "Target" on the "Shortcut" tab). See cor-el's earlier reply for the steps.

jscher2000 said

Hi finlandsberet, there are two possibilities after deleting this file: (A) Firefox works normally (B) Firefox says file not found In case (B), we need to help you track down why Firefox might still be looking for that file, such as home page setting or hijacked Firefox shortcut (page address added to "Target" on the "Shortcut" tab). See cor-el's earlier reply for the steps.

Firefox seems to be working normally for me now, but as this happens for me in the mornings, I'll have to keep an eye out tomorrow and see what, if anything happens.

Thanks again for your help and speedy reply.

jscher2000 said

Hi finlandsberet, there are two possibilities after deleting this file: (A) Firefox works normally (B) Firefox says file not found In case (B), we need to help you track down why Firefox might still be looking for that file, such as home page setting or hijacked Firefox shortcut (page address added to "Target" on the "Shortcut" tab). See cor-el's earlier reply for the steps.

Hello again.

I've just gone on to Firefox (it's the morning here for me now), and while the file location came-up in the url bar as it did in the screenshot, it came-up in the first tab that I have open, before being replaced in favour of the actual website's url (that I have open in the first tab.) I've run another search for SearchRestore, and to my surprise both the .xpi file and the HTML document are back again, too. I've included a screenshot of the search, and I've gone ahead already deleted them both, but how do I make sure they stay deleted? Do I need to refresh Firefox via the about:support option, or should I uninstall and reinstall?

EDIT: Failing that, if the XPI File and the HTML Document return in a day or so, how can I prevent it from creating that tab in the screenshot in my first post?

Does this coincide with restarting Windows, not simply exiting and restarting Firefox itself? Things that occur at Windows startup could be part of the startup sequence, or a Scheduled Task.

jscher2000 said

Does this coincide with restarting Windows, not simply exiting and restarting Firefox itself? Things that occur at Windows startup could be part of the startup sequence, or a Scheduled Task.

It usually happens the first time I start Firefox in the morning. If I were to shut everything down now and start it all up, for example, I wouldn't get the tab showing-up or any sign of the file location in the url bar.

EDIT: I should mention that this only started happening after Firefox updated to version 63.0.3. Will this be fixed in the next update?

Hello finlandsberet,

What shows in your first screenshot looks like a bad imitation of what you get when you type in the address bar :

about:searchreset

What do you get when you type that in the address bar and press Enter ?

Would you check this please :

Type in the address bar about:config and press Enter (promise to be careful, if asked)

Type in the search bar and look for the preference :

browser.search.reset.enabled

And make sure its value is set to false

In case you had to change the value : close and restart Firefox.

McCoy said

Hello finlandsberet, What shows in your first screenshot looks like a bad imitation of what you get when you type in the address bar : about:searchreset What do you get when you type that in the address bar and press Enter ?

---

Would you check this please :

Type in the address bar about:config and press Enter (promise to be careful, if asked)

Type in the search bar and look for the preference :

browser.search.reset.enabled

And make sure its value is set to false

In case you had to change the value : close and restart Firefox.

I checked the first one - about:searchreset - and I've included a screenshot as to what comes up.

After checking under about:config, the value is set to false. Should it stay as false or do I need to change it?

finlandsberet said

I checked the first one - about:searchreset - and I've included a screenshot as to what comes up.

That screenshot doesn't show your default search engine - would you check your setting again  ?

(Options => Search)

After checking under about:config, the value is set to false. Should it stay as false or do I need to change it?

No, don't change the value - it should stay on "false"

(it was a mere stab in the dark .... )