Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Thousands of JonuiCouupon type files are being written into AppData/Local/Mozilla/Firefox/Profiles/.../cache2/entries.

  • 13 replies
  • 3 have this problem
  • 8 views
  • Last reply by cor-el

more options

Something had infected my computer. With help I've removed most of the bad effects, but what remains is files of type JonuiCouupon being written into the Firefox Profiles area. When I delete the Profile, it creates a new one and starts writing them again. 38,000 files in the last week, totaling 330 MB.

Something had infected my computer. With help I've removed most of the bad effects, but what remains is files of type JonuiCouupon being written into the Firefox Profiles area. When I delete the Profile, it creates a new one and starts writing them again. 38,000 files in the last week, totaling 330 MB.

All Replies (13)

more options

You may have ad / mal-ware. Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.

more options

I've been working with a guy from Malwarebytes Support who resolved the many other issues I've had with the same problem so it stopped heavily effecting my browsing experience. But the file writes remain. I've probably run 10 different scanners, a few of them multiple times. But this problem with the "coupon" files continually being written to my hard drive has not gone away.

This started in August, 2015. I've run MBAM, Farbar (FRST), FRST (again), Junkware Removal Tool, ESET, Dr. Web CureIt!, and Farbar again.

more options

Have you tried clearing your cache?

  1. Click the menu button New Fx Menu, choose History, and then "Clear Recent History...".
  2. Under "Time range to clear", select "Everything".
  3. Now, click the arrow next to Details to toggle the Details list active.
  4. From the details list, check-mark Cache and uncheck everything else.
  5. Then click the "Clear Now" button.
more options

Just in case, I found https://www.bing.com/search?q=JonuiCouupon&pc=MOZI how to remove.

more options

That is the location that Firefox uses for the disk cache and it is normal that it fills to a few hundred megabytes. You can inspect the disk cache via the about:cache page.

What makes you think that that are all JonuiCouupon type files?

more options

1) I ran another scan, SUPERAntiSpyware, as suggested on the Mozilla help as suggested above. After a reboot and a few hours, I have about 4,000 new files copied to my hard drive.

2) I cleared the history, as suggested. No help.

3) Searching for JunuiCouupon is worthless. There's too many optimized sites which suggest meaningless fixes. Maybe one is the one I need, but it's a needle in a haystack, and I'm not willing to run any old program that's suggested in that manner and/or pay for a fix as they are non-specific to my problem.

4) Since my last scan, removal of bad files (mostly cookies) and reboot, a new profile was created in my AppData/Local/Firefox/Profiles folder, and in that Profile's cache2/entries folder, 3,427 files of Type "JunuiCouupon" have been copied into it. Using Windows Explorer to tell me that info.

more options

The files in the entries folder are files in the disk cache that have a name that consists of a special SHA1 hash of 80 characters. I'm sure that other applications like Windows Explorer don't know about these files and can identify them with any name. You can also see this by files like prefs.js that Windows is calling JScript files and Windows will try to run as JScript files when double-clicked although they are special JavaScript files that are interpreted and not even run as a JavaScript files by Firefox. You should always be cautious with how Windows identifies specific file types and avoid double-clicking them, but always use the right-click context menu in case of doubt what application Windows would use.

more options

My feeling is that all the JonuiCouupon files are ads. Previous scans and removals of ad software prevents their display, but the ads are being written to my hard drive at a very fast rate. The names are a hash of 40 characters in this case.

more options

The location in \AppData\Local\Mozilla\Firefox\ is only used by Firefox for the disk cache.

  • C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<profile>\cache2\entries

The files have a special header at the start of the file, so you can't easily open them other than in a hex view utility. Firefox constantly write files to the disk cache. You can try to disable the Firefox disk cache to see if there are still files written.

You can set browser.cache.disk.enable to false on the about:config page.

You can open the about:config page via the location/address bar. You can accept the warning and click "I'll be careful" to continue.

Modified by cor-el

more options

Disabling the disk cache seems to have stopped the files. At least to this location. Are there any consequences to disabling the disk cache?

more options

If you do not use the disk cache then Firefox can only use the memory cache and Firefox needs to request files that aren't cached from the server, so you likely have more internet traffic and a slower browsing experience. As you can see that this are normal files in the Firefox disk cache and nothing to worry about. That is how the disk cache works and other software doesn't know about what files are stored in that location. So do not let this confuse you.

more options

Thank you for the replies and suggestions. I want to make sure I understand.

I'm sure that JonuiCouupon is a malware that had several different names that served annoying ads and hijacked my Firefox browsing experience to the point of it being nearly unusable. I successfully removed it, with help.

Are you saying that JonuiCouupon has just redefined the file type, and the files written to the Profile cache by Firefox are benign and/or helpful? Are you sure that the volume of files being written there is normal? I'm talking 30,000 to 40,000 files per week.

I'd turn the cache back on if this were so.

more options

If Windows knows about JonuiCouupon then it is likely that you still have or had this software on your computer. This doesn't necessarily mean that all files identified as JonuiCouupon are actually files that belong to JonuiCouupon. You would have to remove all traces of this software and do a registry cleanup to restore the proper reporting of affected file extensions.

Did you search the registry for JonuiCouupon to see what comes up?

You can try to ask advice at a malware or Windows oriented forum if you need further help to cleanup your computer.