Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Junkware Removal Tool deleted many Firefox preferences


  • Please log in to reply
5 replies to this topic

#1 welayton

welayton

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 February 2014 - 12:22 PM

First of all, thank you to the BleepingComputer staff and community for making this site such a useful resource.

I want to report a problem I had with Junkware Removal Tool downloaded from the site. I wasn't aware of any particular problems on my system, but I saw this tool recommended and wanted to do a scan to see if it picked up anything my other regular scans missed.

During the scan, there were a few errors shown, but I think the relevant error was "Line too long" while scanning the Firefox prefs.js.

Looking through the log, I double checked each item and discovered nearly all of my Firefox and addon preferences had been deleted. The resulting prefs.js after JRT had only 108 entries left, while my most recent backup has over 4000+ lines of entries. Many of the items are addon preferences, including extensive manual blacklists and whitelists and other settings built up over a period of years. The Firefox addons NoScript and RequestPolicy in particular seem to have extremely long user_pref values.

Thankfully, I have a fairly recent backup from a few weeks ago which seems to have worked as a drop in replacement, but I thought I should warn others and notify the developer about the issue.

Perhaps the JRT tool should make a backup of all files to be altered in case of such "Line too long" errors. Also, I'm not sure if there is already such an option, but a "scan only" setting with confirmation before making any changes would also be helpful.

Here's a truncated version of the relevant sections from the log.
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.2 (02.20.2014:1)

OS: Microsoft Windows XP x86



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



~~~ FireFox



Successfully deleted the following from C:\Documents and Settings\user\Application Data\mozilla\firefox\profiles\profile.default\prefs.js



user_pref("extensions.requestpolicy.allowedOriginsToDestinations", "... amazon.ca|images-amazon.com amazon.ca|ssl-images-amazon.com ...


BC AdBot (Login to Remove)

 


m

#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:40 PM

Posted 25 February 2014 - 12:54 PM

:welcome: to Bleeping Computer.

JRT (Junkware Removal Tool) is a free non-interactive batch program created by thisisu (a member of the BC Malware Response Team) that will remove many potentially unwanted programs (PUPs), adware, toolbars, browser hijackers, extensions, add-ons, browser helper objects (BHOs) and other junkware. The tool is designed to remove all traces of these types of programs which includes services, registry values, registry keys, files, and folders. The tool will also restore some default settings for Internet Explorer, Mozilla FireFox and Google Chrome (somewhat supported). It can delete any potentially unwanted extensions from Extension folders and registry.

Since JRT is a batch file, it extracts to a temporary folder and does NOT create backups of what was removed but it does backup the registry.

The error you encountered has been reported to the developer by myrti, our Malware Study Hall Admin.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 welayton

welayton
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 February 2014 - 03:45 PM

:welcome: to Bleeping Computer.
...

The error you encountered has been reported to the developer by myrti, our Malware Study Hall Admin.

Thank you and thanks for the welcome. Another suggestion could be to include a notice or readme with a complete list of files to be modified and a warning to back them up before running JRT. I certainly would have backed up the files manually had I known which might be affected.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:40 PM

Posted 25 February 2014 - 04:52 PM

JRT's current disclaimer states: "This software is provided "as is" without warranty of any kind. You may use this software at your own risk."

Adding to that will be up to thisisu...but I know he welcomes suggestions and feedback.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 welayton

welayton
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 February 2014 - 09:15 PM

JRT's current disclaimer states: "This software is provided "as is" without warranty of any kind. You may use this software at your own risk."

Well, that's quite an uninformative, generic CYA boilerplate phrase seen on nearly every software tool out there. I carefully read through the JRT page both here and at the author's site before running it and saw no mention of the potential for non-malicious files to be irrevocably removed. If there had been a more specific notice on either page or included with the download or on the run screen, I would have been able to take extra steps.

http://www.bleepingcomputer.com/download/junkware-removal-tool/
http://thisisudax.org/

I hope my feedback might save someone else from similar problems in the future.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:40 PM

Posted 25 February 2014 - 09:46 PM

Actually the BC download link you provided shows two screenshots...the one on the left includes that disclaimer which appears when first running JRT. His home page (blog) also shows the same screenshot with the disclaimer.

I agree its a CYA disclaimer. thisisu, like many others in the security community volunteer their time and service as well as creating these kind of useful tools for the rest of us to use. They are not wealthy folks or employees of large corporations with a war chest for legal defense. With all the litigation these days, they have to protect themselves.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users