This thread was archived. Please ask a new question if you need help.
Firefox keeps redirecting me, after I try to open a webpage I've found in "search"
Locked due to age. If you still have a problem, please start a new thread
After doing a search, I will click on suggested websites. It will start to load, then will redirect me to another site that generally has nothing to do with the original search.
Not sure how often
== a couple of days ago
Modified by Shawn
One of your add-ons might be the culprit too. Try running Firefox in Troubleshoot Firefox issues using Safe Mode with all add-ons disabled. If that solves the problem, see Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems and possibly Troubleshoot issues with plugins like Flash or Java to fix common Firefox problems
Also your issue may be caused by Malware. You can run and update the following free anti virus software:
1. Malwarebytes (Free version) - http://www.malwarebytes.org
2. Spybot Search & Destroy - http://www.safer-networking.org
3.Spyware Terminator - http://www.spywareterminator.com
In addition, there are a number of forums you can use to help get rid of your infection. These include:Read this answer in context 👍 10
All Replies (20)
Ok...I had this problem a while back...tried everything
Eventually the only thing that worked was that I changed the name of the Firefox.exe and created a new shortcut and put it on the desktop. Works fine no problems. You might want to redo this if you experience this after you update Firefox to a newer version. This will work until they find a better solution.
Try the following to resolve the issue (it worked for me):
Read the following link to resolve the issue (it worked for me):
or here in brief (fuller details in link)
This article describes what to do when searches from Firefox don't go to the expected site(s). For example, Google searches may redirect to a page with a lot of advertising or using a different search engine.
There are two possible causes for this depending on the exact symptom:
* If only searches from the Location bar are affected, this is likely caused by your ISP (Internet Service Provider) and/or DNS (Domain Name System) server redirecting invalid requests, or a changed keyword.URL preference setting.
* If all searches are redirected (including searches from the search engine's page itself and searches from the Search bar) this is likely the result of malicious software installed on your computer.
If only Location bar searches are affected
If a term is entered in the Location bar, Firefox sends a request to your ISP to see if the term is actually a website address. If the server returns a no-such-domain error, Firefox will then initiate a search using the site listed in the keyword.URL preference (Google is the default). A number of ISPs and DNS servers are set not to return a no-such-domain error, and will redirect to their own search site instead.
Make sure that the keyword.URL preference is set to the search site you want and that it's turned on.
1. In the Location bar, type about:config and press EnterReturn.
The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page.
2. In the filter box at the top, type keyword. 3. In the resulting grid, make sure the preference keyword.URL is set to the site you want to use. (For examples, see our article on Location bar search).
To reset it to the default, right-clickhold down the Ctrl key while you click on the preference and select Reset.
4. Make sure that the preference keyword.enabled is set to true. If it is not, double-click on it to set it to true.
Some service providers offer "DNS Assistance" which is what is doing the redirecting. Check with your provider to see if you can opt out of this service.
In regard to all the above mentioned solutions, I have found the quickest way to solve this problem is to go your firefox and click on tools----> Options----> toogle on( put a tick on) "Warn me when sites try to install add-ons" and click Exceptions button. You will notice if there is any address listed in this column and remove any associate websites that cause the redirecting. After this, things should go back to normal. Hooray~~~~~~~~~~~~
Modified by jameskk
Unfortunately many redirecting browsers don't show up as spy ware.
I have found only three solutions that worked for me.
After you Google what your looking for, highlight the link and place it directly into the search window of the Firefox browser
don't click the link directly.
Reinstall Firefox: (temporarily fix) since the browser dll's are deep in your system files.
Reinstall windows: will work until you use Firefox again.
Modified by MAllenArt
I have an update! Firefox is releasing new add ons that will help the problem.
Also the new AVG free addition has a program that seems to work well. I went to file hippo and downloaded AVG's latest protection and i have yet to see a redirection. It found a worm like generator in one of my ststem32 DLL files and windows warned me to delete it my PC may not work properly, Hell who cares I just want to Google something and actually get there. Any way I hope this helps, Japan hang in there see you guys on facebook or an MIT forum
Modified by MAllenArt
I have had the same problem. This morning I ran Firefox in safe mode and only kept my bookmarks the same. I applied the new settings to the regular FireFox application.
Firefox works great now. You just have to reset your homepage.
Modified by rick2811
Unfortunately the redirecting started again this morning. Sorry if I mislead you.
I have a sad update! The re-direct browser was created by a ex employee of Google and is considered by most spyware as some sort of add-on. This is what it floating around the circle.
The bottom-line it caught Fire Fox with it's pants down. But so did Japan so cut them some slack.
I spent too much time searching for a solution to this problem that didn't involve too much mucking around. Download ComboFix for free (freeware) here: http://www.combofix.org/ and save it to your desktop. Disable all antivirus activity and anti-malware; (E.g disable ESET etc, and disable Malwarebytes etc) as these will potentially interfere with desired results. Close all other programs and browsers and run ComboFix.exe from your desktop. Allow it to complete all desired tasks and be patient because it's activity screen can be stagnant at times. Once finished, keep the Log it provides to post in Malware/Spyware removal techhelp forums (If need be), but as in my case - This fixed the Redirect Issue in Mozilla Firefox. Peace.
Modified by UnitSquareS
This is a simplistic approach to a problem I tried and that failed to resolve anything except for waste my time and make Mozilla shrug its shoulders about a problem that lies at the heart of its own product's viability.
here my tips (sorry for bad English)
first, open the Firefox then, go to :
1-option 2-click on option 3-click advance (on the right site) 4-click network (next to general) 5-click setting 6-the connection setting will pop up
here you can try to choose the Configure Proxies to Access the Internet. you can try an error to choose those option until the redirecting errors is gone.
some computers stop the error by click on No proxy but mine is worked on "Automatic proxy configuration URL"
Modified by sayyid
I had this for the last several days too. Checked my Add-Ins and there it was. I added the "Add to Amazon Wish list Button" last week. I disabled it and no more redirects! Be sure to check your add-ins. I almost didn't because it seemed too easy.
In my case, I could get rid of the uninvited "XULrunner 1.9.1" add-on that was causing my redirects, but it would reinstall itself every time I restarted windows (or even logged off and back on) and launched FireFox. I spent way too much time figuring this out, so I'm posting it here in case it helps someone else.
The "get rid of" was a pretty easy find with some web searching. The "get gone completely" took much longer. Getting rid of it was as just a matter of searching the registry in the recommended place, although with 64-bit Win 7 the usual place was slightly different. There should be a registry entry at: HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions that points to a long directory name in your \Users\[User Name]\AppData\Local folder. Delete both the registry entry and that folder, close/open FireFox, and the add-is gone. The problem comes when you restart or log off and it re-appears again.
Here's what to do to get rid of it for good. Open windows Task Manager (Ctrl-Shift-Esc) and go to the Process tab. From the top menu, select "View", then "Select Columns", and check "Command Line." Now sort by the "Image Name" column and look for rundll32.exe entries and check the "Command Line" column for each. You'll likely find one that points to some randomly named .dll file in your \Users\[User Name]\AppData\Local folder. Mine was ijegurixuqugaro.dll, but the name may be random.
You can right-click on the process and end it, but you still won't be able to delete the file, as it reports as "in-use" by just about every application you have when you try.
At this point, I rebooted in Safe Mode w/Command prompt (by pressing F8 continually during startup and selecting it from the list of Windows startup options).
From a command prompt, it's "cd \Users\[User name]\AppData\Local" to get to the directory. Then, "del yourfilename.dll" to delete it.
Now restart normally. Firefox is now fixed, but you're going to get an error during windows startup about that .dll you just deleted. That's because the malware also added an entry to windows startup (which is how it reloads itself each time). Hit Start and type msconfig in the search box to bring up windows System Configuration. Go to the Startup tab and look through the entries for something oddly named with "Unknown" under the Manufacturer column. Mine was "Dkazugarorohu." You CAN simply uncheck the box so it will no longer run at startup, but I didn't want that entry listed, at all.
Here's how to get rid of the entry in startup. The "Location" column in the startup config will show you where that entry is in the registry. It should be: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run. Edit the registry (regedit) and delete that entry. That's it, right? Well, probably not, but almost. For me, I got an error to the effect that it couldn't delete the entry completely. Close and re-open the registry, however, and it was gone. The line is still in the msconfig startup, though, so what gives?
The final piece of the puzzle is to find the 2nd place in the registry this thing lives as it relates to the msconfig startup entry. Some more searching about msconfig startup led me to this. Go here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg. I had a folder there named after my startup item (Dkazugarorohu). Delete that entire folder and you're, finally, done.
Admittedly, it's a bit of work. Personally, though, I'm a little hesitant to blindly run malware program after malware program if it's not absolutely necessary.
Modified by barr88
Ok here is the thing, don't even waste your time deleting add ons and extensions because the malware is deeply enbeded into your system. Meaning when you delete the extension it will just replicate itself. To combat this you must remove it from the source of the problem wich usually runs as root updt.exe process. Malwarebytes, CC cleaner ect will not detect it. THE ONLY SOFTWARE THAT DETECTED THIS MALWARE IS NORTON POWER ERASER by symantec corporation and AVIRA MALWARE AND VIRUS REMOVAL... just run a scan and remove all malware detected.. another malware software that detected the problem was Avira malware remover.. other than that the Power Eraser did the job after hours of trying to figure out what this thing was.
Hey! I have the same problem. I installed Malwarebytes but it didn't scan at all, the window completely closed, and when i try to open it back up, it said it cannot access the specified file path or (...). what do i do about THAT? AND google chrome not work anymore, it says the same thing in the error message! Aaaah! I don't even have AVG!
had the same problem for a couple of days, then tried to disable one add on at a time and it worked. in my case it was https everywhere which caused the problem, firefox 7.0.1 on mac os x 10.6.3 here.
It is funny that merritsal3 mentioned updt.exe, because I had that same virus a few days ago but you guys don't need Norton for it. Actually I have found that virus (like most viruses I have seen for windows 7) like to go in C:\Users\"user"\AppData\Local\Temp with names such as: 0.0019058180973293704.exe i4jdel0.exe BUT LOOK OUT FOR NAMES SUCH AS: winupd.exe svhostu.exe
(You can find most of these viruses by the time and date it was created)
C:\Users\"user"\AppData\Roaming 0.0019058180973293704.exe i4jdel0.exe BUT LOOK OUT FOR: ldr.ini iexplore.exe (I found it liked to make exe files with the name of the programs I had opened at the time)
AND FOLDERS WITH STRANGE NAMES SUCH AS: OIIIVrrzONtA0uS tfRRZZ9hTXwjC Most folders will have nothing in them, but there is a couple with the main culprit such as: yQQJJ6ddWK8RLhT.exe (you can get rid of this just be renaming the exe to something else then deleting it) How I found the main culprit is by right clicking the new icon on my desktop and finding where it lead to by going to properties.
Now as for this Trojan with Firefox, I have a slightly different deal, it does redirect, and does have an "'overlay.xul, xulcache.jar"' and "'xulcache.js. xulcache.js is obvious and funny because I opened that up in notepad++ and it reads: pref("extensions.xulcache.PLEASE_DONT_TOUCH.u", "44ab8f94-4dc3-4cda-9f48-1775d22f0294"); pref("extensions.xulcache.PLEASE_DONT_TOUCH.a", "1552"); pref("extensions.xulcache.PLEASE_DONT_TOUCH.i", "473"); pref("extensions.xulcache.PLEASE_DONT_TOUCH.s", "0");
I have never read code yet (at least code from professionals) that have sentences as the code, especially when it is telling you to do something (like they where expecting you to come and find something wrong and in a last ditch effort try and fool you) which is a dead give away. It is classic when you think about it. The thing is, it is most likely a virus from the Chinese because their Engrish (yes I spelled English like that on purpose) gives them away because of their international translation protocol. In Chinese, please has a totally different meaning to the west, over there it really means an order. Oh and some of the files didn't even have English lettering to it which is dead give away as well.
Modified by DMalenfant1
Exact same thing happening here. Think i found the root cause of the infection but the redirects were still happening. That is until i disabled the 'XUL Cache 1.0' extension. No idea what it was but the 'more info' link didnt tell me squat and everything was working fine after i disabled and removed.