C:\Program Files\Mozilla Firefox\defaults\pref\
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\

C:\Program Files\Mozilla Firefox\
C:\Program Files (x86)\Mozilla Firefox\

You can check for recently installed suspicious or unknown extensions., start with extensions that have search or incognito in their name. Start Firefox in <u>Safe Mode</u> to check if one of the extensions ("3-bar" menu button or Tools -> Add-ons -> Extensions) or if hardware acceleration is causing the problem. *switch to the DEFAULT theme: "3-bar" menu button or Tools -> Add-ons -> Appearance *do NOT click the "Refresh Firefox" button on the Safe Mode start window *https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode *https://support.mozilla.org/en-US/kb/troubleshoot-extensions-themes-to-fix-problems ---- This could be an issue caused by AdAware or Web Companion from Lavasoft. You can look for a file named dsengine.js in these locations. You should only find channel-prefs.js in this location, any other file found here is suspicious. C:\Program Files\Mozilla Firefox\defaults\pref\ C:\Program Files (x86)\Mozilla Firefox\defaults\pref\ You can look for a file named dsengine.cfg in the main Firefox program folder. C:\Program Files\Mozilla Firefox\ C:\Program Files (x86)\Mozilla Firefox\ Delete the dsengine.js and dsengine.cfg files when present. ---- Do a malware check with several malware scanning programs on the Windows computer. *https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware Please scan with all programs because each program detects different malware. All these programs have free versions. Make sure you update each program to get the latest version of their databases before doing a scan. *Malwarebytes' Anti-Malware:<br>http://www.malwarebytes.org/mbam.php *AdwCleaner:<br>http://www.bleepingcomputer.com/download/adwcleaner/<br>http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml *SuperAntispyware:<br>http://www.superantispyware.com/ *Microsoft Safety Scanner:<br>https://www.microsoft.com/security/scanner/en-us/default.aspx *Windows Defender:<br>https://windows.microsoft.com/en-us/windows/using-defender *Spybot Search & Destroy:<br>http://www.safer-networking.org/en/index.html *Kasperky Free Security Scan:<br>https://www.kaspersky.com/security-scan You can also do a check for a rootkit infection with TDSSKiller. *Anti-rootkit utility TDSSKiller:<br>https://support.kaspersky.com/viruses/disinfection/5350 <br>https://support.kaspersky.com/viruses/utility See also: *"Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

If you notice that the default search engine changes to "Bing Search Engine" instead of "Bing", focus on the program folder infection section of cor-el's reply (associated with Web Companion).