Does Firefox also get started if you set another browser (i.e. not Firefox) as the default browser?

Do a malware check with several malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.

Make sure that you update each program to get the latest version of their databases before doing a scan.

• Malwarebytes' Anti-Malware:
  http://www.malwarebytes.org/mbam.php
• AdwCleaner:
  http://www.bleepingcomputer.com/download/adwcleaner/
  http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
• SuperAntispyware:
  http://www.superantispyware.com/
• Microsoft Safety Scanner:
  http://www.microsoft.com/security/scanner/en-us/default.aspx
• Windows Defender:
  http://windows.microsoft.com/en-us/windows/using-defender
• Spybot Search & Destroy:
  http://www.safer-networking.org/en/index.html
• Kasperky Free Security Scan:
  http://www.kaspersky.com/security-scan

You can also do a check for a rootkit infection with TDSSKiller.

• Anti-rootkit utility TDSSKiller:
  http://support.kaspersky.com/5350?el=88446

See also:

• "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

I agree with cor-el on scanning for malware, but there might be an additional step:

Last year, many users reported advertising tabs opening randomly, sometimes even when Firefox was closed. It turned out that a program had created scheduled tasks to open those pages at certain times of day.

You can check the Windows Task Scheduler:

• Windows Vista/7: Start button > Control Panel > System and Security > Administrative Tools > Task Scheduler

• Windows XP: Start button > [All] Programs > Accessories> System Tools > Scheduled Tasks

• Past threads on the "dsite" problem:
  • How can I keep Firefox from opening a window to website tofushopnews.com
  • How do I get rid of sponsorship tabs that open automatically?

I don't know if FF would still come up if I had IE as default. I've never used it unless I'm forced to, like to download something MS. Since no one else has suggested it, I will try it Just for you. It will take at least until tomorrow to see since it won't open again by itself today.

I am worse off than I was before, twice over. I wrote just about everything here, clicked on another link above and when I came back here it was all gone. Very frustrating.

I have done several of these tests before and some came up with bad stuff, which were all gone at previous tests a few weeks ago.

In the process of trying to figure this problem out I have deleted some Bing (still 66 files of various types) and Conduit files (all gone) that come up in Windows Explorer Search. I don't know what they were or what they do, couldn't get an answer from anyone. Now I hope it didn't contribute to the newest problem with Malwarebytes. I tried to use my paid version of Malwarebytes but it wouldn't run. Tried to download it and that gave me several error messages. Wrote to them asking for help.

I ran AdwCleaner and these are the results. I don't usually delete anything without someone telling me it's OK, so if I need to delete these let me know and I'll do it.

1. AdwCleaner v3.202 - Report created 23/04/2014 at 14:31:59
2. Updated 23/04/2014 by Xplode
3. Operating System : Windows 8.1 (64 bits)
4. Username : Dovee - DELL2013
5. Running from : C:\Users\Dovee\Downloads\adwcleaner(2).exe
6. Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5}
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{318A227B-5E9F-45BD-8999-7F8F10CA4CF5}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518

-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\Dovee\AppData\Roaming\Mozilla\Firefox\Profiles\crdjo39h.default\prefs.js ]

[ File : C:\Users\Dovee\AppData\Roaming\Mozilla\Firefox\Profiles\xlm21r1y.default-1381911480631\prefs.js ]

*************************

AdwCleaner[R0].txt - [945 octets] - [23/04/2014 14:32:00]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1004 octets] ##########

I don't want to loose all of this again so I'm going to post it and when I get the next tests done, I'll post those results. This is way too much to remember and have to retype a 3rd time.

Thanks, Bernadine

Hi Bernadine, some of the characters in the report (*) and (#) are being misinterpreted by the forum software. If you place a space in front of the line then it won't turn into bullets and numbers.

More test results.

I did read that characters in the report are not being interpreted right, I just got this little Snipping tool and I'm just delighted with it so I'll see if that works better here.

No word back from Malewarbytes yet. Windows Defender is turned off. I've worked a lot with PCHelp and they told me I didn't need it with the other programs I have. Didn't use Spybot Search & Destroy, again told not to have 2 similar programs on my computer. The rest are attached.

I'll do the last 2 tests soon. I'm awful tired and need to rest so I don't make any stupid mistakes. I don't know if I will get back to this tonight and tomorrow I have an appointment. I'll get the rest to you hopefully Friday if not sooner. And maybe they will help me get Malwarebytes to run again. And we can see what happens with IE now that it is default browser. It doesn't necessarily happen daily but recently it's been more often than not.

Oh, and I did check the Task Scheduler, after a long hunt for it in Win 8.1. Then I didn't know what I was looking for and I clicked around a few times and then even a longer list of things came up. I need to know what you want me to look for, file names or however else they can be identified. It would be good to have a little help finding Task Scheduler back, something like was on the Windows 7 page.

I have the Capture of the results of the Windows Explorer for Bing, would that help? I would send it now but I don't know how many files I can attach.

Thanks, Bernadine

Oh, one more question. Will the programs I just downloaded and used for the tests cause any problems with the security programs I already have? Do I need to delete them?

Security programs that run only on demand, and not in the background all the time, usually do not cause any conflicts.

In AdwCleaner, it indicates something it doesn't like in the prefs.js file. That file stores your settings such as home page, so I suggest not deleting it just yet, but we can open it up in a text editor and see what's in there that might look unusual.

Regarding the task scheduler, see whether you can find anything that looks as though it would open a web page. I haven't had the infection myself, so I don't know what it looks like.

Can you give me an easy way to find the task scheduler in 8.1? I know and use Control Panel, so I'm hoping I can get to it that way. I didn't count the number of files there, but it seemed like hundreds, I don't know if I can look through them all.

If you want me to open AdwCleaner in a test editor you will have to tell me how to do it.

I'm quitting for now. Just can't do anymore. Eyes are crossing and head is dizzy.

Thanks, Bernadine

The AdwCleaner report shows that there are at least two Firefox profiles and one has a time stamp appended (1381911480631: Oct 16, 2013) that may have been created as the result of a reset.

Which profile is Firefox currently using if you click the button in Help > Troubleshooting Information ?

You can use this button to go to the currently used Firefox profile folder:

• Help > Troubleshooting Information > Profile Directory: Show Folder (Linux: Open Directory; Mac: Show in Finder)

Hi BernadineAD, I don't have access to Windows 8.1 very often. However, I noticed Microsoft has suggested using the search box on the "charms" bar to find things that used to be on the old Start menu. You might try that to get into the Task Scheduler.

Regarding looking in prefs.js, if you open your current profile folder as described by cor-el, you can right-click prefs.js (or it might show as just prefs because Windows hides some file extensions) and choose Edit.

That said, it might be easier to use Firefox's about:config screen and search for conduit there. Here's how:

(1) In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.

(2) In the search box above the list, type or paste conduit and pause while the list is filtered (you can repeat with Bing or other terms you want to root out).

(3) If you find preferences pointing to Conduit, you can right-click > Reset them to return them to Firefox's normal setting.

Hi All, I'm replying in reverse order above.

"I noticed Microsoft has suggested using the search box on the "charms" bar to find things that used to be on the old Start menu. You might try that to get into the Task Scheduler. " I am a long time XP lover and had the tech set this up to look more like XP than 8. I don't use the Win 8 setup with all the strange screens and haven't figured out what "charms" are (other than for a bracelet). "(1) In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful. " Yes, much easier. Nothing in search for Conduit. There were a few for Bing, but the search in Windows Explorer is longer. I'm going to attach them also, maybe you will tell me what they are and if I can just get rid of them. Can I get rid of all of them? Or you said something about switching, I didn't quite understand.

"The AdwCleaner report shows that there are at least two Firefox profiles and one has a time stamp appended (1381911480631: Oct 16, 2013) that may have been created as the result of a reset." This is a new computer and when I bought it I had a tech person move my files from the old, almost dead computer to this new one. I was left with several duplicates of files, including these two profiles. I didn't know which was which or what either of them contain. I did the best I knew how and left these two because I didn't know if it was safe to delete either one of them. The profile that the Help>Troubleshoot took me to is XLM21rly.default, has the 1381911489631: Oct 16, 2013.

"In AdwCleaner, it indicates something it doesn't like in the prefs.js file. That file stores your settings such as home page, so I suggest not deleting it just yet, but we can open it up in a text editor and see what's in there that might look unusual." I won't delete anything until you tell me and I'm sure it's OK.

"Regarding the task scheduler, see whether you can find anything that looks as though it would open a web page. I haven't had the infection myself, so I don't know what it looks like. " "browser.search.order.3" I did something a while back that was supposed to delete Bing as a search engine. I found it back, it's through Control Panel>Internet Properties>Manage Add Ons>Search Providers. Google is the only search provider listed and the box is checked Prevent programs from suggesting changes to my default search provider.

I know I still need to do the other 2 tests and deal with the Malwarebytes problem, haven't heard back from them.

I'm not sure if I answered all the questions or gave you the information you wanted, getting a little confused where I'm at and where I've been. I see in my email there's a new post from you, so not to lose all of this I'm going to post this and see what else is new.

Thanks, Bernadine

Hi Bernadine, the charms bar should open if you move the mouse pointer to the upper right-hand corner of the screen. Then if you move the mouse straight down you should be able to use the global search box to look for the task scheduler.

I think the problem with the AdwCleaner flagging Firefox's prefs.js file is, we have no indication of what it was objecting to. So it sounds as though it might not be either Conduit or Bing.

The things that came up in your file search do not appear to be in Firefox's folders. I don't know whether they have anything to do with your Firefox symptoms.

I did the TDSS Killer test and it found no threats.

""Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked" This article looked like it was talking about pop ups. I have Adblock Plus and never have trouble with pop ups. Rather the problem I'm having is a Bing tab that is on FF when it opens without me starting it.

I should ask this question. Is there a way to tell FF to not open a particular web page? If I could say to it do not open bing.com, could that stop the problem. Actually, I don't even know what the cause of the problem is. Is it Bing opening FF when the computer starts for the first time for a date, or does it have something to do with the date change. I wish I knew how to even ask the question correctly. I haven't looked at "Past threads on the "dsite" problem: How can I keep Firefox from opening a window to website tofushopnews.com or How do I get rid of sponsorship tabs that open automatically? " Maybe you have already given me my answer. Guess that's next to do. Thanks, Bernadine

I was confused about much of the information on "How do I get rid of sponsorship tabs that open automatically? "

I did search for DSite, DSite.job with no results for either. The elevated* search showed a file but it was empty. See attached.

"firefox > addons > extensions & remove any suspicious entries (toolbars, things that you have not installed intentionally, don't know what purpose they serve, etc)." Everything there should be there, not a lot, do you want a picture?

"go to the windows control panel / programs and remove all toolbars or potentially unwanted software from there" Mostly things I know, some not sure, do you want a picture?

"Troubleshoot Firefox issues caused by malware" I followed the links to different pages but nothing fit what's going on here.

I tried looking at "check the Scheduled Tasks" again and went through all of them but I didn't see anything, of course I don't know what I was looking for.

I think I have addressed all of your suggestions. What's next?

Thanks, Bernadine

Hi Bernadine, if the unwanted page only opens when you start Windows, there are a couple of other ways that could happen. For example:

• Shortcut to Bing (or a site that redirects to Bing) in your Programs \ Startup folder
• Registry entry
• Another program starting up is opening the page

You can investigate the first two of those using a program from Microsoft named Autoruns. The volume of things that start up automatically can be a bit overwhelming, but I think you are looking for a web shortcut or URL, or anything referring to Firefox. http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Investigating that third possibility is difficult.

I'm so tired of this, I wrote a reply then clicked on your link and it took me to the website, when I came back here my reply was gone.

When I start the computer for the first time on a date, sometimes, but now more and more, FF will start up by itself. Someone or something other than me starts FF and puts a tab or tabs with bing.com on it. bing.com is in addition to my home page.

I went to the link and clicked download, it took me to files already on my computer. I guess they were already there. But I don't know which to use. I'm in way over my head here. Thanks, Bernadine

OK got Malwarebytes problem fixed and scanned with no problems found.

Although this is annoying, it doesn't seem dangerous, so I'm not sure it's worth spending a lot more time chasing it down...

When you clicked to download Autoruns, it could be that Firefox was showing the last folder where you saved files to see whether you want to save Autoruns there, too. That's my best guess, anyway.

But didn't you want me to check something by running autorun?

Hi Bernadine, the Autoruns program looks in a bunch of places for things that run at startup, so I think would be helpful to you tracking it down. It is not included with Windows, so you do have to download it.