Are you saying the problem keeps coming back week after week even if you quarantine the file? It could be that Firefox is running during that time, so removing the file is not effective. Instead of deleting the prefs.js file -- which would cause many Firefox preferences to experience a factory reset -- try this:

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful.

(2) In the search box above the list, type or paste keyw and pause while the list is filtered

(3) Right-click the keyword.URL preference and choose Reset to clear it

Firefox should save the change to prefs.js within a minute or two. Hopefully future scans will then come up clean. If not, an add-on or external process may be re-inserting that setting.

Good question, Jscher2000,

Two answers: Avira immediately tells me that it's blocked a registry change - so I have no idea what's going on (I used Defender for the past decade and don't understand a lot of the technical language w/this AV).

I don't know and I said I wasn't sure, but it's always Firefox. I am sure FF is always open.

Let me clarify - it's always a PUP Spigot warning (I can't see it to write it correctly) and it always has C:\User\Firefox in it. The message that contains Yahoo search Greentea is the part that I cannot swear is constant.

Result: I got browser.keywordURLPromptDeclined.

Thank you.

I'm not sure I understand this part --

Result: I got browser.keywordURLPromptDeclined.

-- you got that trying to Reset the preference???

I am sorry, jscher2000,

I followed your instructions, When I pasted keyword.URL, that was one of the two choices that appeared. The other choice was less like what you expected me to find,

What does it mean - anything?

Thank you.

CiaoBella1 said

I followed your instructions, When I pasted keyword.URL, that was one of the two choices that appeared.

Hmm, instead of pasting, try typing keyw in the search box above the list and see what appears.

Does the keyword.URL line on about:config show a status of "Locked" or "user set"? If it says "user set", then right-clicking the preference and choosing Reset should clear it. There should not be anything about a prompt or being declined

After re-reading your earlier reply, this part sounds odd:

Avira immediately tells me that it's blocked a registry change - so I have no idea what's going on

When you clear the keyword.URL preference, Firefox should only be editing the prefs.js file and not modifying the Windows Registry. So this is a very strange message to get in this context.

Firefox doesn't use keyword.URL any more because it was so easily hijacked, but it's troubling that some software keeps reinserting it. Does Avira have a feature to prevent or roll back changes to browser settings?

It was user set and I reset it.

The Avira message pops up after (while) I select delete for the PUP Optional Spigot entry in MBAM. I don't know if Avira is telling me that it can't clear it because the PUP is in the registry. I assume that's what the message is - which is why the whole thing (capture and delete?) is confusing to me.

I ran MBAM Friday and there were no issues.

I'll answer your q about Avira if it is still relevant,

Thank you.

CiaoBella1 said

The Avira message pops up after (while) I select delete for the PUP Optional Spigot entry in MBAM. I don't know if Avira is telling me that it can't clear it because the PUP is in the registry. I assume that's what the message is - which is why the whole thing (capture and delete?) is confusing to me.

I really don't know what is going on there.

Was this YOUR question? "After re-reading your earlier reply, this part sounds odd:"

   "Avira immediately tells me that it's blocked a registry change - so I have no idea what's going on."

it's should be IT HAS blocked.

I have been sloppy. My apologies.