Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

A Virus deleted all my bookmarks now I have just a Files folder?

  • 10 replies
  • 1 has this problem
  • 3 views
  • Last reply by bioshock

more options

Hiya everyone, Well I got a virus today from a file that should of been safe? Anyways I have lost ALL my bookmarks and uninstalled-installed FF, Checked the APPDATA for them and the only file thats large in there is a file titled PROFILE which has a "Folder" and it has in it another file called CACHE2 and then when I go in there it has a Folder with just over a gig of files which must be my bookmarks but they are not in a JSON format or any readable file they are just "Files".

Can anyone help please as I have lost a lot of valuable bookmarks.

Many thanks.

(Screenshot attached)

Hiya everyone, Well I got a virus today from a file that should of been safe? Anyways I have lost ALL my bookmarks and uninstalled-installed FF, Checked the APPDATA for them and the only file thats large in there is a file titled PROFILE which has a "Folder" and it has in it another file called CACHE2 and then when I go in there it has a Folder with just over a gig of files which must be my bookmarks but they are not in a JSON format or any readable file they are just "Files". Can anyone help please as I have lost a lot of valuable bookmarks. Many thanks. (Screenshot attached)
Attached screenshots

Chosen solution

According to the time stamp appended to the profile name (1546208401862) this profile got created Sun 30 Dec 2018 22:20:01:862 GMT as the result of a refresh (only a refresh creates a profile with a time stamp).

Did you look at the desktop to see if there is an "Old Firefox Data" folder on the desktop?

Is this the only profile in C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles ?

Read this answer in context 👍 0

All Replies (10)

more options

Just to add, It has also reset ALL by browser history so I have nothing it is like I have just installed the browser?

more options

Your Screenshot shows the cache2 folder that is used for the disk cache. Your personal data is in another location in "AppData\Roaming" and may still be there.

Firefox uses two locations for the Firefox profile folder, so make sure to look in the correct location. Location used for the main profile that keeps your personal data in "AppData\Roaming" (Root Directory on about:profiles).

  • C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\

Location used for the disk cache and other temporary files in "AppData\Local" (Local Directory on about:profiles).

  • C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<profile>\

You can check if you have an "Old Firefox Data" folder on the desktop in case the Refresh feature in Firefox has been used and a new profile has been created.

It is possible that there has been a problem with the profiles.ini file that registers profiles and that a new default profile got created.

You can check if you have an orphaned profile that isn't registered in profiles.ini and that doesn't show in the Firefox Profile Manager. You can check that by opening the current profile folder via the about:profiles page and go up one level (..) to see if there are unlisted profiles present. If you have found an orphaned profile then you may want to recover some personal data or restore his profile.

You can recover an orphaned profile via these steps:

See "Profile was moved or renamed":

Note that you should never use "Choose Folder" to specify a folder that already contains files that do not belong to Firefox. Only use "Choose Folder" to recover an profile that isn't listed in the Profile Manager.


  • bookmarks and history: places.sqlite
  • bookmark backups: compressed .jsonlz4 JSON backups in the bookmarkbackups folder
  • cookies.sqlite for the Cookies
  • formhistory.sqlite for saved autocomplete Form Data
  • logins.json (passwords) and key4.db (58+) or key3.db (57 and older) (decryption key) for Passwords saved in the Password Manager
    if you only have key3.db then make sure to remove an existing key4.db
  • cert9.db (58+) or cert8.db (57 and older) for (intermediate) certificates stored in the Certificate Manager
    if you only have cert8.db then make sure to remove an existing cert9.db
  • persdict.dat for words you added to the spelling checker dictionary
  • permissions.sqlite for Permissions and possibly content-prefs.sqlite for other website specific data (Site Preferences)
  • sessionstore.jsonlz4 for open tabs and pinned tabs (see also the sessionstore-backups folder)
more options

Hi Cor-El,

Thank you so much for your time and explanation.

I have tried to find the AppData file and its got some bookmarks present but they is only a small amount of them, The bookmarks I had was something like 1500.

I uninstalled FF earlier just before I started this thread as someone suggested it on a post I was reading and that didnt work?

It would seem the only file I have is the cache2 folder, Can I do anything with this or is it a no go?

Best Wishes and thanks again.

more options

Aren't there any folders and files present in the AppData\Roaming location?

  • C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\

"Old Firefox Data" folder on the desktop


You can look at this utility to browse System Restore points.

more options

Hi bioshock, in case you haven't already, make sure to set Windows to show you hidden files and folders:

https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

As a shortcut to

C:\Users\your-user-name\AppData\Roaming\Mozilla\Firefox\Profiles

you can paste the following to the Windows search box (on the Task bar, usually) and press Enter to load it:

%APPDATA%\Mozilla\Firefox\Profiles

Look in each folder there for a subfolder named bookmarkbackups.

That folder contains compressed files (.jsonlz4 extension) with the creation date code into the file name. Can you find a recent one?

These files cannot be opened by regular applications. I have a page to decompress them and export out an HTML versions of the bookmarks if you want to see what's in a file before trying to restore one:

https://www.jeffersonscher.com/ffu/bookbackreader.html

more options

Hi Cor-El,

Thank you once again sorry for the late reply.

I have located the files you stated but in the Bookmarks there is present just new bookmarks and not the ones I had before the virus did this?

Many thanks. (Screenshot attached)

more options

Hi jscher2000,

Thank you so much for your time and help.

I have done that and could only find about ten Bookmarks and each of them was dated yesterday but I think the time on them was after the virus caused this I cant seem to find anything else? Today I am going to use some software and scan my C: Drive for items deleted in my Recycle bin and see if the virus has deleted them as I think thats my last port of call dont you think?

I tried your method of dragging and dropping the current bookmarks into the site you kindly sent me and it told me invalid file even though it was in the location you stated and the file format was ' .jsonlz4.xabae ' and I tired other bookmarks and nothing happened when I dragged and dropped them? so I tried the "locate file" method and when I dragged one of the bookmarks to the desktop it just kept opening up the 'locate file' instead of actioning the file id directed the site too?

I cant thank you enough for your help.

Best Wishes.

more options

bioshock said

I tried your method of dragging and dropping the current bookmarks into the site you kindly sent me and it told me invalid file even though it was in the location you stated and the file format was ' .jsonlz4.xabae ' and I tired other bookmarks and nothing happened when I dragged and dropped them?

It's not normal to have an extra file extension after .jsonlz4 -- I don't know where that came from. Did you have a ransomware infection that encrypted your files and demanded to be paid to recover them?

Do you still have the OId Firefox Data folder on your desktop?

more options

Chosen Solution

According to the time stamp appended to the profile name (1546208401862) this profile got created Sun 30 Dec 2018 22:20:01:862 GMT as the result of a refresh (only a refresh creates a profile with a time stamp).

Did you look at the desktop to see if there is an "Old Firefox Data" folder on the desktop?

Is this the only profile in C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles ?

more options

Hello jscher2000 and Cor-el.

So sorry for the late reply its been manic here with the NYE celebrations so ive only just sat down to reply.

I backed up what files I had of the browser and noticed almost my entire system (OS) wasn't right? the


virus had Clearly critically damaged my W10. So after backing it up I rolled back to W7 64 on my 8700K machine and its running really sweet, I didn't manage to get my bookmarks back but that's not through lack

of help you two both kindly offered me so Id like to thank you both for the last time and wish you the very


best for 2019.

One suggestion might I add that FF is configured in a way where every week it backs up peoples Bookmarks for


instances like mine where I have basically been robbed


of vital bookmarks..

Kindest Regards and thanks.