I have had this annoying problem too. It is pretty crazy how there are no solutions for it on the Net! I Googled through and through, so I know exactly how people feel about not being able to solve this annoyance. I had to specifically search Russian forums and find the answer from the people who had the same issue.

So, for our English speaking friends, I provide the answer on how to resolve this headache.

Here is a step-by-step solution on how to forever get rid of the above issue:

1. To get rid of webalta.ru search engine from your browser (Firefox, etc.) click on the Start button of your OS, then choose "Run". 2. In the open field type in "regedit" to open your Registry Editor. 3. When your Registry Editor opens up, select "Edit" in the menu and click on "Find" button or simply Ctrl+F. 4. In the open search window you will need to search for "webalta". 5. Type it in and click "Find". 6. Delete all the registry keys that contain webalta or right-click on each key and choose "Modify" to change the line to google.com for example. 7. Repeat the above step until all the registry keys that contain word/link webalta are gone. It's going to notify you so when "there are no more results".

Next:

8. Find a file named user.js (it is going to be easier if you search for it through your Start "Find" menu) and delete them afterwards. 9. Look for file prefs.js (using the same method as in step 8), when the file is found, open it with the help of Notepad, press (Ctrl+F) and enter the word "webalta", when the line with webalta.ru is found, just delete the entire link It should look like this - user_pref("browser.startup.homepage", "_http//webalta.ru");, and after deleting it should look like this - user_pref("browser.startup.homepage", ""); or you could change the link, if you want to use Google as your search engine for example - user_pref("browser.startup.homepage", "http://google.com");

Problem solved!

p.s. Although it is pretty sad how some morons at webalta and such malicious sites make us good Russian people look bad.

Спасибо за внимание! Your friend, Viktor G.

Hi Victor,

Thanks for the attempt to help all of us effected. I have the same problem and did everything you advised. However, the pest is still there. Can't get rid of it. I agree with you that those morons make us Russians look bad. Any other recommendations? Oleg

Hi Oleg,

Victor's solution is just great for me it really works. You may missed some entries of prefs.js or did not save the file. Try again it should work.

BR Gabor

thank you very much. Is there any way to add another Tab?I mean the first tab will be blank and the next Tab would be our destination url?!

Instead of deleting the link from the user_pref line, delete the whole line. I think this would actually let you set your homepage using Firefox's Preferences dialog again, instead of having to do that using Notepad.

Hope this helps!

Hello from Russia, once again.

I have some addition to Victor's advices: "Find a file named user.js" - to find this file you can do: 1.Start-> Run 2. Enter there string "%APPDATA%\Mozilla\Firefox\" (without quotes) 3. click Enter Opened folder contains subfolder "Profiles", and further sub-sub-folders like "dli13t4w.default", for example (or any letters-digits combination). So, files :prefs.js" and "user.js" are located in the "dli13t4w.default" folder.

If "user.js" contains 3 strings only

{
 user_pref("startup.homepage_override_url", "http://webalta.ru");
  user_pref("browser.startup.page", 1);
   user_pref("browser.startup.homepage", "http://webalta.ru");
}

then it's better and more easy to just delete this file.

Also you can try my little program, written specially to detect and clean "webalta" http://malware.maslan.ru/heal/wakill.exe (Right now, it's not support prefs.js cleaning, so if it couldn't help, then check prefs.js file manually)