How do I stop unwanted redirection to a new site?
I am running Win XP sp3, FF 20. When I click on a link to open in a new tab I am redirected to a site I do not want. Before the site opens I get a "WOT" notice that the site is untrustworthy. I have run "clean disk", CCLeaner, AVG AV, Super Spyware Pro and Malwarebites. Everything is clean according to those programs but the problem still exists. I also have checked to see if I have any add-ons that I did not recognize or windows Add/remove programs that I did not add. They all seemed to be OK. Does anyone have any suggestion how I can solve this problem?
Thanks,
Ben
Wšě wotmołwy (15)
hello ben, web-of-trust is an addon for firefox - if you don't like the functionality, you can remove it from firefox/tools > addons > extensions.
WOT is not the problem. Being diverted to unwanted web sites is.
can you go to firefox > help > troubleshooting information, copy the information about your extensions there & paste them into a forum reply here...
Do a scan for malware.
- Malwarebytes' Anti-Malware - http://www.malwarebytes.org/mbam.php
- SuperAntispyware - http://www.superantispyware.com/
- Spybot Search & Destroy - http://www.safer-networking.org/en/index.html
- AdAware - http://www.lavasoftusa.com/software/adaware/
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
WOT is not the problem, but you should uninstall DriverAgent if you don't need it and go through full lists of plugins. Additionally, enter about:config and check for newtab variable value.
Extensions
Name
Version
Enabled
ID
Adblock Plus Pop-up [email protected] Toolbar Buttons1.2.3trueCSTBB@NArisT2_Noia4devColorfulTabs17.8true{0545b830-f0aa-4d7e-8820-50a4629a56fe}Custom [email protected] Statusbar0.9.10true{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}[email protected]{aff87fa2-a58e-4edd-b852-0a20203c1e17}Java Console6.0.43true{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBA}RoboForm Toolbar for Firefox7.8.6.5true{22119944-ED35-4ab1-910B-E619EA06A115}Toolbar Buttons1.0true{03B08592-E5B4-45ff-A0BE-C1D975458688}WOT20130402true{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}AVG Security [email protected]@infoatoms.comMicrosoft .NET Framework Assistant0.0.0false{20a82645-c095-46ed-80e3-08825760534b}Skype Click to Call
Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).
- Do NOT click the Reset button on the Safe Mode start window or otherwise make changes.
the DownloadTerms extension (ID: [email protected]) that you've installed looks phishy - please remove it...
CT3277370.lastNewTabSettings;{"isEnabled":true,"newTabUrl":"http://search.conduit.com/?ctid=CT3277370&octid=CT3277370&SearchSource=15&CUI=UN27184609011393914&SSPV=EB_SSPV&Lay=1&UM=2"}
you can also install the search reset addon - it will revert the most common customizations those adware programs do in firefox back to the default: https://addons.mozilla.org/firefox/addon/searchreset/
Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).
- Do NOT click the Reset button on the Safe Mode start window or otherwise make changes.
- https://support.mozilla.org/kb/Safe+Mode
- https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes
You can try to rename or delete the prefs.js file and possible numbered prefs-##.js files and a possible user.js file to reset all prefs to the default values.
Conduit is malware. You want to get rid of that.
it should be listed as extension in firefox > addons > extensions - you can remove it from there... Disable or remove Add-ons
philipp.....The only extension I could find relating to download was Download Status Bar 0.9.10. I disabled it and tried to go the the URL for it but it "timed out" and never connected.
finitarry.....I have removed all conduit entries.
Thank you both. I'll just have to wait and see if the problem has been corrected.
Ben