First and simplest thing to try to solve this problem is to uninstall firefox ,download again and reinstall .

Hi   !

Good for you to be on the alert, for search.rspark.com is a browser hijacker, which of course you need to get rid of.

Go to the 3-bar menu => Addons => and look for any unfamiliar or suspicious looking extensions, like e.g.:

SafeSearch Incognito SearchAssist Incognito

When you find any :   remove them.

Also look in :   Advanced => Network tab => Under : 'Offline Web Content and User Data'

Do the same in Windows' Control Panel => Programs.

However :   most malware will be 'hiding' somewhere , so let's run malware scans :

Further information can be found in this article :
https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware?cache=no

Run most or all of the listed malware scanners.
They all work differently   -   what one program doesn't pick up, the other might.

Also see : https://malwaretips.com/blogs/remove-search-rspark-com/

When I open a new tab, http://search.hdirectionsandmap.com is what I now see. How does one change the URL that appears when a new tab is open?

Hi craigj1, I replied about your maps issue in your tab over here: https://support.mozilla.org/questions/1171714

dacky said

First and simplest thing to try to solve this problem is to uninstall firefox ,download again and reinstall .

Uninstalled Quantum, restarted, downloaded a fresh version of Quantum, and still have the https://search.rspark.com/?ytm in what should be a blank tab.

Hi 1jazzguy, uninstalling/reinstalling usually doesn't touch your settings folder, so if your new tab page was hijacked, that's what you need to investigate next. Do you still use Windows?

Here's my suggested procedure for tracking down and cleaning up bad add-ons and other hijackers. I know it seems long, but it's really not that bad. (If you do not use Windows you can skip to #2.)

(1) Open the Windows Control Panel, Uninstall a Program.

After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.

Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.

On XP, the Add/Remove Programs panel doesn't have that same column sorting feature. You could check for other sorting options.

(2) Open Firefox's Add-ons page using either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• in the Windows "Run" dialog, type or paste
  firefox.exe "about:addons"

In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions. All extensions are optional; the troublemaker might not be obvious from its name.

Before Firefox 57, a link sometimes would appear above at least one disabled extension to restart Firefox to make the change effective. You can complete your work on the tab and click one of the links as the last step. In Firefox 57, disabling should be immediate, but you may need to reload pages to notice any change.

Any improvement?

(3) You can search for remaining issues with the scanning/cleaning tools listed in this support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

Hopefully that will flush anything on your system and in your Firefox that could be a problem.

Thanks for your response. I use Windows10 Ver. 1709.

In control panel, updates and programs installed from January 5, and later were deleted.

All extensions added from January 5 on, were disabled.

I ran Zemana Anti-Malware which found two Trojans and Malawarebytes which found nothing. The issue was not solved. ???

Opening a new tab in Firefox 57.0.4 (64bit) Quantum, still opens https://search.rspark.com/?ytm

I do not have the problem using Google Chrome.

Hi 1jazzguy, do you have any extensions? You can cross-check the list on the Troubleshooting Information page. Either:

• "3-bar" menu button > "?" button > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter

Scroll down to the Extensions heading, and review the table that follows. Anything you don't remember installing?

Could you also check for a program folder infection that malware cleaners tend to miss? That would be in one of these locations (varies for 32-bit / 64-bit):

• C:\Program Files\Mozilla Firefox\defaults\pref
• C:\Program Files (x86)\Mozilla Firefox\defaults\pref

A file named channel-prefs.js is normal. Any other file is suspicious. Remove any such files to a neutral location for further analysis at your leisure, or bury them in the Recycle Bin. Please do not double-click .js files as that will execute them as Windows system scripts. You can right-click > Edit or right-click > Open With to view them in Notepad.

See my post from August 15, 2017 :

https://malwaretips.com/blogs/remove-search-rspark-com/

No, everything was fine with all your suggestions. The only other thing that happened on January 5, was when I opened Firefox for the first time, it installed the Quantum version update. Could the malware have possibly been within that? I do not see it as an update in the Remove program settings.

Happy112 said

See my post from August 15, 2017 : https://malwaretips.com/blogs/remove-search-rspark-com/

I tried all of that already. No luck.

Hi 1jazzguy, where exactly does the unwanted page appear now? For example:

• Only at startup
• Any time you click the Home button or launch a new window (Ctrl+n)
• New tab page (Ctrl+t)
• Somewhere else (be specific)

Only when I am in Firefox, and open a new tab.

What is the current new tab page if you paste the code posted below in the command line in the Browser Console?

• "3-bar" menu button or Tools -> Web Developer -> Browser Console
• set devtools.chrome.enabled to true on the about:config page to enable the command line
• https://developer.mozilla.org/en/Tools/Browser_Console

You can open the about:config page via the location/address bar. You can accept the warning and click "I accept the risk!" to continue.

• http://kb.mozillazine.org/about:config

This code in the Browser Console shows the current setting of the new tab page:

• aboutNewTabService.newTabURL

Does that show the rspark website as the current new tab page?

@ 1jazzguy :

Would you please remove the Chosen Solution mark from your post  ?

Apart from the fact that your problem is not solved :

The original poster of this thread is shubh7177, whom we haven't heard from since August 14, 2017.

How do I do remove the Chosen Solution mark ?

1jazzguy said

How do I do remove the Chosen Solution mark ?

You can remove it by clicking on the 'Undo' button to the right of that post.

@cor-el I'm sorry, but I am not a computer geek. I appreciate your trying to help.

I don't know what I'm looking at in the Browser Console. Tools -> Web Developer -> Browser Console

I have about:config open and do not find "aboutNewTabService.newTabURL"

And I'm ignorant in /Applications/Firefox Aurora.app/Contents/MacOS/firefox-bin -jsconsole

There is no UNDO button on this page. I may be technically ignorant, but I'm not blind.

Only devtools.chrome.enabled is on the about:config page. If you set this pref to true with a double-click if it is currently false then you should see a command line with a prompt (>) at the bottom of the Browser Console the next time you open this Console.

• "3-bar" menu button or Tools -> Web Developer

On the command line in the Browser Console you can now paste the code and press the Enter key to evaluate the code and see the result.

• aboutNewTabService.newTabURL