Here's how you can remove the rogue Firefox profile

Apr 28, 2016 00:15 GMT  ·  By

Security firm Malwarebytes has discovered a new browser hijacker called GsearchFinder that takes over many of your browser settings and redirects your search queries via services like YesSearches and HohoSearch.

Malwarebytes says it discovered this browser hijacker application bundled with other software such as Amonetize, SoftPulse, Somoto, and OutBrowse.

Researchers say that there are versions that target Google Chrome and Firefox, but the Firefox version uses a non-standard trick to hijack the browser's settings.

While many browser hijackers work by altering Firefox's settings associated with the current profile, GsearchFinder creates a new profile where it makes all its changes.

The technique is weird, because it allows any users infected with GsearchFinder to easily remove it. The simplest way to do this is by going through the following steps, courtesy of Malwarebytes' experts:

Step 1: Close any instance of Firefox, and open the Windows "Run" utility (either through the Start menu or by pressing the Windows key + R).

Step 2: Write "Firefox -P" in the Run box and press Enter. This will open a popup associated with Firefox that allows users to choose their Firefox profile.

Step 3: Malwarebytes says GsearchFinder works via a profile named "Firefox Default," so go on and delete it.

Step 4: Select your desired default Firefox profile, tick the "Use the selected profile without asking at startup" checkmark, and press "Start Firefox."

Malwarebytes says it also seen GsearchFinder push unwanted ads to infected victims every two hours, so besides being a sneaky browser hijacker, GsearchFinder is also a dirty adware as well.

Firefox profile selection popup
Firefox profile selection popup

Photo Gallery (2 Images)

GsearchFinder browser hijacker
Firefox profile selection popup
Open gallery