Another infected PC. This time, Windows XP also got corrupted.

So, as well as removing the infection, I also need to do a repair install of Windows.

But after all that, clicking on any google results (using Firefox) brings up a Firefox “reported attack site”… looking at the url, it seems I get redirected to c.ppcxml.net … regardless of which link I click on.

I quickly find the solution:

Use windows explorer to navigate to something like:

C:Program FilesMozilla Firefoxextensions{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}chromecontentffjcext

Note that there might be more than 1 folder that starts with “{CAFEEFAC-“… you might need to look at all of them.

I ended up renaming any file that ends in .XUL (I changed the extension from .XUL to .LUX).

You might need to try a few combinations, as its a fairly important file for Firefox.