X
Tap here to go to the mobile version of the site.

Support Forum

Shopping banner pops up over search box.

Posted

When I go to the google homepage and begin typing my search, it jumps from the middle of the screen to the top (presumably to make way for the results).

However, as I continue to type, I very often get a shopping banner that pops up right over the search box, immediately stopping me from typing [see attached image]. I then have to hit the 'X' on the right hand side of the banner before I can continue typing my search.

It's incredibly annoying, as sometimes it will keep triggering every time I click back in the search box.

It seems to be triggered if what you're typing relates to something you could buy, so for instance, if you were to type in the name of a book or film, it would pop up with a link to ebay or amazon, and give you the best price for that item.

It's not in my add-ons. I'm on XP, using Firefox 38.0.5

Is this adware or something Mozilla have added, thinking it would be a useful tool?

When I go to the google homepage and begin typing my search, it jumps from the middle of the screen to the top (presumably to make way for the results). However, as I continue to type, I very often get a shopping banner that pops up right over the search box, immediately stopping me from typing [see attached image]. I then have to hit the 'X' on the right hand side of the banner before I can continue typing my search. It's incredibly annoying, as sometimes it will keep triggering every time I click back in the search box. It seems to be triggered if what you're typing relates to something you could buy, so for instance, if you were to type in the name of a book or film, it would pop up with a link to ebay or amazon, and give you the best price for that item. It's not in my add-ons. I'm on XP, using Firefox 38.0.5 Is this adware or something Mozilla have added, thinking it would be a useful tool?
Attached screenshots

Chosen solution

Yes, it points the finger directly at Avira!

General info: http://www.avira.com/en/avira-offers

FAQ says:

Q: How do I enable or disable Avira Offers?

A: Avira Offers is included as a feature of the Avira Browser Safety extension. When you install it you will be notified that the feature is running. You can disable Avira Offers through the Avira Browser Safety settings page. Just click on the Settings icon inside the dashboard.

An old page that may or may not be relevant on how to remove the ads: https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1716

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.25.2 for Mozilla browsers
  • DRM Store Netscape Plugin
  • DRM Netscape Network Object
  • Shockwave Flash 17.0 r0
  • Adobe Shockwave for Director Netscape plug-in, version 12.0.7.148
  • VLC media player Web Plugin 2.1.3
  • Npdsplay dll
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • iTunes Detector Plug-in

Application

  • User Agent: Mozilla/5.0 (Windows NT 5.1; rv:38.0) Gecko/20100101 Firefox/38.0

More Information

guigs 1072 solutions 11697 answers

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.

You can try these free programs to scan for malware, which work with your existing antivirus software:

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Windows 8 has antivirus built-in already.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of. You can try these free programs to scan for malware, which work with your existing antivirus software: * [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner] * [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware] * [http://support.kaspersky.com/viruses/disinfection/5350 Anti-Rootkit Utility - TDSSKiller] * [http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner AdwCleaner] (for more info, see this [http://www.bleepingcomputer.com/download/adwcleaner/ alternate AdwCleaner download page]) * [http://www.surfright.nl/en/hitmanpro/ Hitman Pro] * [http://www.eset.com/us/online-scanner/ ESET Online Scanner] [http://windows.microsoft.com/MSE Microsoft Security Essentials] is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Windows 8 has antivirus [http://www.microsoft.com/security/pc-security/windows8.aspx#antivirus built-in] already. Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article. Did this fix your problems? Please report back to us!
jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

Helpful Reply

Are you sure you don't have any mystery extensions? Just to make sure, would you mind starting Firefox in its Safe Mode, where the self-hiding feature of some extensions doesn't work for them? (Firefox's Safe Mode is a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Troubleshoot Firefox issues using Safe Mode.)

If Firefox is not running: Hold down the Shift key when starting Firefox.

If Firefox is running: You can restart Firefox in Safe Mode using either:

  • "3-bar" menu button > "?" button > Restart with Add-ons Disabled
  • Help menu > Restart with Add-ons Disabled

and OK the restart.

Both scenarios: A small dialog should appear. Click "Start in Safe Mode" (not Refresh).

Then check the Add-ons page. Either:

  • Ctrl+Shift+a
  • "3-bar" menu button (or Tools menu) > Add-ons

In the left column, click Extensions. Anything listed here that you do not remember installing?

Are you sure you don't have any mystery extensions? Just to make sure, would you mind starting Firefox in its Safe Mode, where the self-hiding feature of some extensions doesn't work for them? (Firefox's Safe Mode is a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: [[Troubleshoot Firefox issues using Safe Mode]].) ''If Firefox is not running:'' Hold down the Shift key when starting Firefox. ''If Firefox is running:'' You can restart Firefox in Safe Mode using either: * "3-bar" menu button > "?" button > Restart with Add-ons Disabled * Help menu > Restart with Add-ons Disabled and OK the restart. ''Both scenarios:'' A small dialog should appear. Click "Start in Safe Mode" (''not'' Refresh). Then check the Add-ons page. Either: * Ctrl+Shift+a * "3-bar" menu button (or Tools menu) > Add-ons In the left column, click Extensions. Anything listed here that you do not remember installing?

Helpful Reply

Thanks, Guigs2. I have a couple of malware and virus removers, but they found nothing.

jscher2000, thanks very much for your detailed instructions on checking for unwanted extensions. Unfortunately, there's nothing in there that I didn't intentionally install.

Thanks, Guigs2. I have a couple of malware and virus removers, but they found nothing. jscher2000, thanks very much for your detailed instructions on checking for unwanted extensions. Unfortunately, there's nothing in there that I didn't intentionally install.
jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

Did the problem still occur in Firefox's Safe Mode? In that case, it could be an example of a new type of malware that embeds into a settings file in Firefox's program folder. To remedy that, try this:

Clean Reinstall

We use this name, but it's not about removing your settings, it's about making sure the program files are clean (no inconsistent or alien code files). As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed.

(1) Download a fresh installer for Firefox 38.0.5 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.)

(2) Exit out of Firefox (if applicable).

(3) Rename the program folder:

(32-bit Windows folder names)

C:\Program Files\Mozilla Firefox

to

C:\Program Files\OldFirefox

(64-bit Windows folder names)

C:\Program Files (x86)\Mozilla Firefox

to

C:\Program Files (x86)\OldFirefox

(4) Run the installer you downloaded in #1. It should automatically connect to your existing settings.

Does a cleanly reinstalled Firefox search Google normally??

Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders:

  • \OldFirefox\Plugins
  • \OldFirefox\browser\plugins
Did the problem still occur in Firefox's Safe Mode? In that case, it could be an example of a new type of malware that embeds into a settings file in Firefox's program folder. To remedy that, try this: '''Clean Reinstall''' We use this name, but it's not about removing your settings, it's about making sure the program files are clean (no inconsistent or alien code files). As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed. (1) Download a fresh installer for Firefox 38.0.5 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.) (2) Exit out of Firefox (if applicable). (3) Rename the program folder: ''(32-bit Windows folder names)'' C:\Program Files\Mozilla Firefox to C:\Program Files\OldFirefox ''(64-bit Windows folder names)'' C:\Program Files (x86)\Mozilla Firefox to C:\Program Files (x86)\OldFirefox (4) Run the installer you downloaded in #1. It should automatically connect to your existing settings. Does a cleanly reinstalled Firefox search Google normally?? Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders: * \OldFirefox\Plugins * \OldFirefox\browser\plugins

Question owner

Sorry, jscher2000. I tried to follow those instructions, but don't really understand what you mean when you say rename the program folder.

I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again.

Sorry, jscher2000. I tried to follow those instructions, but don't really understand what you mean when you say rename the program folder. I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again.

Modified by OurJud

cor-el
  • Top 10 Contributor
  • Moderator
17541 solutions 158616 answers

Which malware scanners did you run?


You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled.

Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem.

  • Switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance
  • Do NOT click the Reset button on the Safe Mode start window

You can check the connection settings.

If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly.

See "Firefox connection settings":


You need to reinstall Firefox after having renamed the current Firefox program folder. The purpose is to do a clean reinstall of Firefox and that involved removing or renaming the existing Firefox program folder.

Which malware scanners did you run? ---- You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled. Start Firefox in <u>[[Safe Mode|Safe Mode]]</u> to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem. *Switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance *Do NOT click the Reset button on the Safe Mode start window *https://support.mozilla.org/kb/Safe+Mode *https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes ---- You can check the connection settings. *Tools > Options > Advanced > Network : Connection > Settings *https://support.mozilla.org/kb/Options+window+-+Advanced+panel If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly. See "Firefox connection settings": *https://support.mozilla.org/kb/Firefox+cannot+load+websites+but+other+programs+can ---- You need to reinstall Firefox after having renamed the current Firefox program folder. The purpose is to do a clean reinstall of Firefox and that involved removing or renaming the existing Firefox program folder.
jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

OurJud said

I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again.

Sorry, you'll need to copy/paste the steps to a word processing document or another program in that case!

''OurJud [[#answer-739086|said]]'' <blockquote> I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again. </blockquote> Sorry, you'll need to copy/paste the steps to a word processing document or another program in that case!

Question owner

cor-el said

Which malware scanners did you run?

You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled.

CCCleaner and Malwarebytes.

Sorry, I thought I'd made it clear that I'd done the Safe Mode check, in my reply to jscher2000's first post.

Now that I know I did the folder rename correctly, I'll try it again and see it through to the end.

''cor-el [[#answer-739092|said]]'' <blockquote> Which malware scanners did you run? ---- You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled. </blockquote> CCCleaner and Malwarebytes. Sorry, I thought I'd made it clear that I'd done the Safe Mode check, in my reply to jscher2000's first post. Now that I know I did the folder rename correctly, I'll try it again and see it through to the end.

Modified by OurJud

Question owner

Okay, did the re-install and it's still popping up.

Just to clarify, I can trigger it by typing into google, words which suggest I would like to shop.

See another example attached.

I think the next step is to try some different malware detectors.

Okay, did the re-install and it's still popping up. Just to clarify, I can trigger it by typing into google, words which suggest I would like to shop. See another example attached. I think the next step is to try some different malware detectors.

Modified by OurJud

jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

OurJud said

I think the next step is to try some different malware detectors.

Yes, good idea.

You'll notice that the icon in the address bar which usually is gray padlock turned to a mixed content warning, probably due to something injected by the malware. If you want to see whether you can learn more about it, maybe you could pull out a bit more information:

  • Open the "Inspector" tool by pressing Ctrl+Shift+i. This should display the HTML source code of the page in the lower part of the tab.
  • Click the little icon in the upper left (looks like an arrow pointing to a box) and then click the upper left corner of the black bar. This should display a selection bar over the relevant portion of the HTML source down in the Inspector.
  • Using the mouse, hover over the selected part of the HTML source and then the next element up, and so on, watching the blue highlight over the page, until you find what seems to be the outermost part of the source that is associated with the black box. Then click that to select it.
  • To share the source code of that section of the page with forum volunteers, you can paste it on the Pastebin site (no registration needed). Right-click the HTML element you selected and choose Copy Outer HTML. Then go to http://pastebin.com/ and paste the code into the New Paste box.
  • The code might be hard to read, but skim through it to make sure it doesn't have your email address or other personal information. To save, you can leave the various controls below the box at their default values, and assign a name like Black Box on Google (or more if you like) before clicking Submit. Then you should get a link you can paste back here for someone to look at.
''OurJud [[#answer-739108|said]]'' <blockquote> I think the next step is to try some different malware detectors. </blockquote> Yes, good idea. You'll notice that the icon in the address bar which usually is gray padlock turned to a mixed content warning, probably due to something injected by the malware. If you want to see whether you can learn more about it, maybe you could pull out a bit more information: * Open the "Inspector" tool by pressing Ctrl+Shift+i. This should display the HTML source code of the page in the lower part of the tab. * Click the little icon in the upper left (looks like an arrow pointing to a box) and then click the upper left corner of the black bar. This should display a selection bar over the relevant portion of the HTML source down in the Inspector. * Using the mouse, hover over the selected part of the HTML source and then the next element up, and so on, watching the blue highlight over the page, until you find what seems to be the outermost part of the source that is associated with the black box. Then click that to select it. * To share the source code of that section of the page with forum volunteers, you can paste it on the Pastebin site (no registration needed). Right-click the HTML element you selected and choose Copy Outer HTML. Then go to http://pastebin.com/ and paste the code into the New Paste box. * The code might be hard to read, but skim through it to make sure it doesn't have your email address or other personal information. To save, you can leave the various controls below the box at their default values, and assign a name like Black Box on Google (or more if you like) before clicking Submit. Then you should get a link you can paste back here for someone to look at.

Question owner

Thanks for your continued help, jscher2000.

I installed and ran hitman pro, and was quite optimistic when it found several 'threats'. I let the program to its job and delte them all, but to no avail - the shopping pop-up is still lurking.

I actually beat you to your next advice, although I used Firebug to inspect the banner.

It highlighted the following code:

<nav class="indicator-groups">

??

Thanks for your continued help, jscher2000. I installed and ran hitman pro, and was quite optimistic when it found several 'threats'. I let the program to its job and delte them all, but to no avail - the shopping pop-up is still lurking. I actually beat you to your next advice, although I used Firebug to inspect the banner. It highlighted the following code: <nav class="indicator-groups"> ??

Modified by OurJud

jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

Hmm, that's not enough to go on. When you use Copy Outer HTML you should get the full HTML of the entire block, which will have the URL of that image among other things. This might be called something different in Firebug, I haven't used it for a couple years now. Please try to get the entire block by navigating upwards in the HTML tree, as selecting by click often doesn't do that.

Hmm, that's not enough to go on. When you use Copy Outer HTML you should get the full HTML of the entire block, which will have the URL of that image among other things. This might be called something different in Firebug, I haven't used it for a couple years now. Please try to get the entire block by navigating upwards in the HTML tree, as selecting by click often doesn't do that.

Question owner

Hi, jscher2000.

I don't really know what I'm doing in terms of the code I have to share with you, and am reluctant to do so if you think personal information could be contained within.

I did find this in the code, which suggest the source is my avira virus software.

<a class="offers-best" data-element="Notification" data-type="Best" data-event="Offers - View" title="Backwards (Red Dwarf)" target="_blank" href="https://offers.avira.com/aviraoffers/api/v2/tracker?apiclien…ZmU2NzhkOGJhNTU3ZTFlZDBhZjcyNTE1ZDgyNzFhZWMtIy05MTgyNjY2MA==">

I've tried to kill the link, but can't.

Hi, jscher2000. I don't really know what I'm doing in terms of the code I have to share with you, and am reluctant to do so if you think personal information could be contained within. I did find this in the code, which suggest the source is my avira virus software. <a class="offers-best" data-element="Notification" data-type="Best" data-event="Offers - View" title="Backwards (Red Dwarf)" target="_blank" href="https://offers.avira.com/aviraoffers/api/v2/tracker?apiclien…ZmU2NzhkOGJhNTU3ZTFlZDBhZjcyNTE1ZDgyNzFhZWMtIy05MTgyNjY2MA=="> I've tried to kill the link, but can't.

Modified by OurJud

jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

Chosen Solution

Yes, it points the finger directly at Avira!

General info: http://www.avira.com/en/avira-offers

FAQ says:

Q: How do I enable or disable Avira Offers?

A: Avira Offers is included as a feature of the Avira Browser Safety extension. When you install it you will be notified that the feature is running. You can disable Avira Offers through the Avira Browser Safety settings page. Just click on the Settings icon inside the dashboard.

An old page that may or may not be relevant on how to remove the ads: https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1716

Yes, it points the finger directly at Avira! General info: http://www.avira.com/en/avira-offers FAQ says: <blockquote>Q: How do I enable or disable Avira Offers?<br><br> A: Avira Offers is included as a feature of the Avira Browser Safety extension. When you install it you will be notified that the feature is running. You can disable Avira Offers through the Avira Browser Safety settings page. Just click on the Settings icon <img src="https://www.avira.com/images/content/v3/avira-offers/icon-settings.png"> inside the dashboard. </blockquote> An old page that may or may not be relevant on how to remove the ads: https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1716

Question owner

Phew! So it's nothing sinister then?

Phew! So it's nothing sinister then?
jscher2000
  • Top 10 Contributor
8776 solutions 71744 answers

OurJud said

Phew! So it's nothing sinister then?

Perhaps only extremely annoying and not sinister.

''OurJud [[#answer-739204|said]]'' <blockquote> Phew! So it's nothing sinister then? </blockquote> Perhaps only extremely annoying and not sinister.

Question owner

Thank you so much for sticking with me on this, jscher2000.

I've now disabled it and the banner has gone!!

I owe you, and very much appreciate your help :)

Thank you so much for sticking with me on this, jscher2000. I've now disabled it and the banner has gone!! I owe you, and very much appreciate your help :)