Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

my Firefox has been hijacked by Bing

  • 25 replies
  • 20 have this problem
  • 1187 views
  • Last reply by Mark1620

more options

Firefox is default browser, suddenly Bing is replacing it and can't get firefox shortcut to work. It automatically goes to Bing

Chosen solution

Answer to your question: The BingPopup.exe and log listed above was discovered by my search of the date and time of changes to my Windows Directory. I am running Avast Professional. I did a scan, it found nothing.

I checked my 5 extensions, turned them all off, but that had no affect. So, I removed the last 3, which I could not remember installing on Firefox since the original install; and rebooted, but that had no affect.

It appears to me the BingPopup.exe file log indicates a number of changes to ni.dll files found in various sub-directories.

Seems I need to run an exe file to counter the BingPopup.exe. or reset the OS to previous date, neither of which I have any experience with.

Read this answer in context 👍 0

All Replies (5)

more options

CT3332016 in the Bing link would indicate to Conduit malware.

Do a malware check with several malware scanning programs on the Windows computer.

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.


https://support.kaspersky.com/viruses/utility

Helpful?

more options

BingPopup.exe (C:\Users\Jerry\AppData\Local\Microsoft\CLR_v4.0\UsageLogs)

The Bing search engine pop-up, screen and recommendations has superseded the Firefox selected default, and still stated, search engine. The following appears to be the installation of it. However, I have no idea as to how to uninstall it: 1,"fusion","GAC",0 1,"WinRT","NotApp",1 3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\594d60461acceac13ce80832549c89e5\System.ni.dll",0 3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\a8b9264f5404041b3ca7990d0c870eea\System.Core.ni.dll",0 3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\9bc269d94588e5851ab5430121020ac6\System.Drawing.ni.dll",0 3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\dca7ad09cd35273a889606994391f9c0\System.Windows.Forms.ni.dll",0 3,"CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\565f8a93d92bc82ec2b51a58cecfbcfc\CustomMarshalers.ni.dll",0 3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\a735c36b364fecbd4bf5cb11860567e7\System.Management.ni.dll",0 3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\4463fd7855bf3afd17a358d42b242f0d\System.Xml.ni.dll",0 3,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web\3dc0e6a96fd70701be3f0e55a5a8cd76\System.Web.ni.dll",0 3,"System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a#\7cd4af74f07a9c4ee3df45672d465d0f\System.Web.Extensions.ni.dll",0 3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\4fe9b888a2c823ebca746b7a37317174\System.Configuration.ni.dll",0 3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\174f2f1f57bd55acc7fad3a68a3e0a78\System.ServiceProcess.ni.dll",0 3,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\60301fadb791de3ae639e442427ae0f3\System.ServiceModel.ni.dll",0 3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\6feed415c7ea4080aec4dbedfd7d779b\System.Runtime.Serialization.ni.dll",0 3,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\bcefb49eb025c7dbe0b6299510ac28e7\SMDiagnostics.ni.dll",0 3,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\6e8bd209b94378d2684592d79f16e584\System.ServiceModel.Internals.ni.dll",0 3,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\9d4bbce0517f910265bad3e312041eb5\System.IdentityModel.ni.dll",0

Helpful?

more options

Hi savmort, is that information from a malware scanner?

A common vector for search hijacks in Firefox is an extension. You can view, disable, and usually remove unwanted or unknown extensions on the Add-ons page. Either:

  • Ctrl+Shift+a (Mac: Command+Shift+a)
  • "3-bar" menu button (or Tools menu) > Add-ons
  • type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions. On the right side, find the "Manage Your Extensions" heading.

If there is at least one extension before the next heading -- "Recommended Extensions" -- please continue:

Then cast a critical eye over the list below that heading. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage.

Anything suspicious or that you just do not remember installing or why? If in doubt, disable anything you can live without for a few hours, and remove anything you don't need or don't fully trust. For your privacy and security, don't let mystery programs linger here.

Any improvement?

Helpful?

more options

Chosen Solution

Answer to your question: The BingPopup.exe and log listed above was discovered by my search of the date and time of changes to my Windows Directory. I am running Avast Professional. I did a scan, it found nothing.

I checked my 5 extensions, turned them all off, but that had no affect. So, I removed the last 3, which I could not remember installing on Firefox since the original install; and rebooted, but that had no affect.

It appears to me the BingPopup.exe file log indicates a number of changes to ni.dll files found in various sub-directories.

Seems I need to run an exe file to counter the BingPopup.exe. or reset the OS to previous date, neither of which I have any experience with.

Helpful?

more options

Hi savmort, if you are not confident that Avast is cleaning your system, you could supplement it with the tools listed in our article here: Troubleshoot Firefox issues caused by malware.

Just to confirm the situation:

  • Your default search engine is Google, or DuckDuckGo, or something else that doesn't use Bing for its results: Change your default search settings in Firefox
  • When you start typing a query in the address bar, Firefox shows on the top line of the drop-down that it is going to use your selected default search engine, but when you submit the query, results appear on https://www.bing.com/ instead
  • This occurs even with all extensions disabled

Helpful?

  1. 1
  2. 2
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.