0
2
I had approximately 200 tabs grouped in approximately 30 groups in Firefox 31.0. The grouping showed up when I clicked the icon on the left of the "minimize" button or pressed CTRL+SHIFT+E. It is called "Firefox - Group Your Tabs". I also use Xmarks, but I turned off tab synchronization recently.
Usually all the tabs and their groups were saved when I closed Firefox. Today I opened Firefox and all the tabs and groups were gone! Instead there opens some search engine called Trovi (www.trovi.com) with "Results by bing". Its the same in Chrome, Opera and IE.
My OS is Windows 8.1 Update 1 with all updates installed. My antivirus is Avast! with all updates installed. There must have been some malware installed obviously, but I didnt get any alert. I have run a "Complete system test" in Avast! with latest updates, which is the most in-depth scan I know (without restaring my laptop HP ProBook 4730s). No virus has been found.
I am suspecting a program called "Search Protect" version 2.16.10.61 from "Client Connect LTD". It has been installed along with PowerISO 6.0 x64.
I tried to run System Restore, but it seems all the restore points I have ever created are deleted now! I discovered this by opening System Properties -> System Protection -> System Restore. However "Protection" is "On" for my system drive.
How can I restore my tabs and groups? It is extremely important to me.
user1459339
Posted 2014-08-04T18:51:02.873
Reputation: 161
You can't. The file which contains this information was likely overwritten. – Ramhound – 2014-08-04T19:26:23.347
1
It might be too late as @Ramhound said but you can try to recover your sessionstore.js file using a software like Recuva. Also, you need to completely uninstall Search Protect, run a scan using Malware Bytes (or a similiar program) and an adware removal tool of your choice.
– DragoonHP – 2014-08-05T07:18:48.003I have recovered "sessionstore.js" with Recuva 1.51.1063 (latest). There was also one "sessionstore.js" in that directory before I recovered it with Recuva, but they are not the same files. There are also these files in the directory - "sessionstore.bak", "sessionstore.bak-201407161834" and "sessionCheckpoints.json". What shall I do now? – user1459339 – 2014-08-05T08:48:16.563
Have you uninstalled Search Protect, and ran some scans using the tools I mentioned? If yes, go to %appdata%/Mozilla/Firefox\Profiles and paste the sessionstore.js file in the *.default folder. It will ask to overwrite the file, click yes. But before doing this, make sure that Search Protect is completely uninstalled. (Simply removing the program does not uninstall it fully) – DragoonHP – 2014-08-05T13:22:44.753
I have uninstalled Search Protect with Total uninstall (advanced analysis). Then I have run a scan with Malwarebytes. It has found many malware including Trovi, Search Protect and Conduit. I have quaranteened all. I have overwriten sessionstore.js, but FF opens only homepage. It seems everything is lost. I have learned a lesson. Nr. 1: Get rid of Windows. Nr. 2:Install Linux (Ubuntu,Mint). Nr. 3: Install antivirus (ClamAV, Avast!). Nr. 4: Use Xmarks tab syncing. It might look like overkill but at least I will be safe and I will protect my valuable time on this planet for better things. – user1459339 – 2014-08-05T23:20:09.547
I have found a file called "sessionstore.bak-20140716183446" in C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\utdnb7pi.default and I think it contains all the tabs and groups. I tried to rename it to "sessionstore.js", but firefox opens only the homepage. Any ideas? – user1459339 – 2014-08-05T23:37:23.110
The latest PowerISO setup package tries to install these additional programs: Search Protect, AVG PC TuneUp, Amazon App for Pokki. It's easy to install them by mistake if you're in a hurry and/or just click Agree/Next. Keep in mind the recovered files might have been overwritten after being deleted, be it partially or completely. You should try to open the file to see if it contains any actual information. I would recommended making multiple backups on physical storage of any important data. Also, make sure to pay attention to what get installed and how, regardless of the OS you're using. – and31415 – 2014-08-06T16:21:17.390
I always do! Always. This time I missed it. I am very dissapointed Avast missed it too. According to Virustotal the detection ratio is 14 / 54 for the setup file. Comodo, NOD32, Kaspersky, Malwarebytes, Sophos and some others would detect it but Avast did not. – user1459339 – 2014-08-07T10:00:51.907