Foxstart PUA removal

50Twuncle

My Dad has inadvertently downloaded a PUA - "Foxstart" which has set his Firefox homepage to its own choice !!
I spent a good hour, this morning - trying to rid his NEW laptop of this addition, with no success
I downloaded and ran Malwarebytes - which failed to remove it......
I googled it and was advised to remove it from Firefox Addons - but it doesn't appear in Addons
I changed the home page under Internet Options - to Google - but this doesn't affect the home page !
Any suggestions ?

pappa_golf

read this http://remove-browser-hijackers.com/foxstart-com/

50Twuncle

pappa_golf wrote: »

read this http://remove-browser-hijackers.com/foxstart-com/

Thanks - but are those download links safe ?
The download removal tool one in particular
I don't want to end up out of the frying pan = into the fire !!
never heard of "reason core security"...

hans_2

Reviewed on BLEEPINGCOMPUTER who have it for download so should be ok.

http://www.bleepingcomputer.com/download/reason-core-security/

pappa_golf

tried the installer on a sick animal here , it found opencandy and a few more bits , most are in users/xx/apdata/local/temp , which is a hidden directory


try emptying that before you start


the proggy (tools) cleaned a lot of start up junk as well ,


the prog will uninstall afterwards ok


try also running superantispyware as well http://www.superantispyware.com/

RumRat

Either make a new profile, or, go to 'Help' then 'Troubleshooting Information'. then go to top right of page 'Refresh Firefox'...
Make a note of all your extensions as you will need to reinstall them as the refresh goes back to factory install.
This should get rid of Foxstart if all else fails.

50Twuncle

OK Tried "REASON CORE SECURITY" on my own laptop and it found YONTOO malware and disposed of it - quickly - so thanks for the pointer - I have recommended that my Dad uses it to get rid of his problem

50Twuncle

Reasoncoresecurity failed to get rid of the FOXSTART program - it didn't detect it !
Any more ideas ?

pappa_golf

its not one I have come across , so can only google for an answer , this page looks like it might help https://www.fixyourbrowser.com/removal-instructions/remove-foxstart-com-homepage/

RumRat

50Twuncle wrote: »

Reasoncoresecurity failed to get rid of the FOXSTART program - it didn't detect it !
Any more ideas ?

Post#6 ................

GunJack

as with all these types of infections, before running mbam/adwcleaner/etc., ALWAYS run a windows disk cleanup and ccleaner - these things very often reside in temp files so will reload after cleaning, unless you have removed their main instance first...