"something" Wiped Out My Firefox Bookmarks & "my Documents"

TimW (Malware Expert) has suggested that I post my issue to this forum. The results of the scans that I submitted to him were "clean".
As best that I can remember, on 02/06/20, I was applying a patch in Norton which asked for a restart. Upon restarting, Firefox then requested some sort of update. When that was completed, I discovered that all of my bookmarks in Firefox had been deleted. I also discovered that the "My Documents" folder was empty! I am assuming some sort of virus? I run the following programs every Friday (Norton, Superantispyware, Spybot, Spywareblaster, CCleaner, & Malwarebytes). After running these on 02/07/20 and not noticing anything out of the ordinary, I reloaded files into "My Documents". Soon after doing so, I was asked to perform another restart. Upon restart, the files in "My Documents" had been deleted again. Does someone have any idea as to what could be happening with this PC? It is a Dell Inspiron desktop running Windows 10 Home 64 bit. The PC will be two years old in March.

 

Do you have any extensions in Firefox that could be malicious? Extensions make it into the store that sometimes look exactly like a real extension but aren't.

I had a similar event happen about 2-3 years ago, and I grabbed an image of the system. I am still hoping to determine someday what happened, and I know it will happen again if I use the image, because it happened over and over each time I restored the image. Finally restored from an older image and the problem stopped.

For me it was program files (in "Program Files") being deleted of security programs. Whatever it was it deleted everything but the main program folder from Comodo Firewall, NVT EXE Radar Pro, and the a-v which I think was 360 Total Security at that time. Everything was gone in those program folders. Someday I will be able to forensically detect what happened using that image I have...

 

How can I determine if any extensions in Firefox are malicious?

 

Did you look for your stuff in C:\users\ (if this is a modern OS) Are there several folders there with your username? Usually if everything is 'gone' Windows created a new profile and all your old stuff is in the other profile.

 

Click on the 3 bars on the right side up top. Click on Add ons. Then click on extensions. Make a note of the name of the extension and then click on "Find more extension" at the top of the page. Search out your extensions by name each and see if there is another extension with a similar name or the same name that may be the "real" one. If you find your extension, look at the popularity to make sure that there is a good sized number using the app. This is how I do this when I suspect something might be fishy with one extension...

 

Unfortunately, I deleted Firefox from this system as I suspected that it may have been causing an issue.

 

Wow! I found everything in C:\users\. Can I just copy these files and place them back into My Documents?

 

Thank you for this info. Unfortunately, I deleted Firefox from this system as I suspected that it may have been causing an issue.

 

Yep, you can copy them over to your new profile. I've used Firefox forever and never had an issue like this - corrupting my Windows profile. What is your OS?

 

I know. I have used Firefox for years. I have just read something on the internet about Mozilla banning hundreds of browser extensions in Firefox that steal user data and execute remote code. I am using Windows 10 Home 64 bit.

 

Yes, that is the article that I read. Oddly enough, I do not recall using ANY Firefix add-on/extensions when this issue occurred. I am not a fan of them either.