One of your add-ons might be the culprit too. Try running Firefox in Diagnose Firefox issues using Troubleshoot Mode with all add-ons disabled. If that solves the problem, see Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems and possibly Troubleshoot issues with plugins like Flash or Java to fix common Firefox problems

Also your issue may be caused by Malware. You can run and update the following free anti virus software:

1. Malwarebytes (Free version) - http://www.malwarebytes.org

2. Spybot Search & Destroy - http://www.safer-networking.org

3.Spyware Terminator - http://www.spywareterminator.com

In addition, there are a number of forums you can use to help get rid of your infection. These include:

• http://www.bleepingcomputer.com/forums/

• http://forums.spybot.info/

• http://www.spywarewarrior.com/index.php

I have had the exact same problem for 5 days now and it's becoming worse. 9 times out 10 my search's are redirected to something I had no intention of opening. And when I do get a link open that I want, the Firefox browser starts opening other tabs to unwanted links.

I have followed the above recommendations going into "Safe Mode" and shutting down all add ons. This does not affect the problem at all. I have also ran MalwareBytes, Spybot S&D, and Kaspersky TDSS killer, and turn up no malware with any of these programs. I am thinking this has got to be a Firefox browser or Google search corruption. I'm at a loss on what to do at this point. Any and all suggestions appreciated.

I have had this problem for a couple of months. I fixed it today by "disabling" the extension Xulrunner 1.9.1. Seem this is a bogus entry and is the source of the redirecting (at least in my case). I used trial and error after trying all of the other methods posted everywhere on the internet. I disabled all of my extensions and turned them on one by one while doing a Google search after each one was turned back on. Xulrunner 1.9.1 was the one that resatrted the redirecting. Easy to try it yourself.

Hello Rossman, I'm sure it's an extension problem. I also fixed it today by disabling the extension "internal security 1.0" greetings.

Definitely XULRunner 1.9.1 (see https://support.mozilla.com/en-US/questions/749007).

There's no uninstall button for this addon, is this built in to Firefox?

Never mind, I found it. It's in the registry, in my case it was

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{01E4B69D-9BF0-4FDE-983A-BFF3E928F9FE}

Delete the registry key, delete the folder it points to.

In my case, the key to eliminating the XUL Runner 1.9.1 was in finding the registry entry:

HKEY_USERS\S-1-5-21-4084633196-3991238857-972333920-1000/software/mozilla/firefox/chrome. The “chrome” folder contained two files and a sub-folder named “content”. The Chrome folder contained the files “chrome manifest” and “install.rdf”. The content sub-folder contained the files “cfg.js” and “overlay.rdf”.

I found this path thanks to another poster here who tipped me off to the fact that the problem might be being caused by a Firefox extension. Then I was able to stop the problem by selectively disabling my extensions one by one till I found the one causing the redirections. I still wanted to uninstall the extension.

Finding the registry path was strictly hit-or-miss because I didn’t know the name of the files I was looking for. If someone else comes up with this problem, I’d suggest searching the registry for “cfg.js” and/or “overlay.rdf”. This should reveal the registry entry and enable them to eliminate it. Before I deleted the registry key, I took the precaution of saving the files and registry entries in a newly created file in My Documents in case whoever wrote this crap found a way to disable my computer if they were missing from the location where he stuck them.

The Microsoft Malicious software removal tool has found the problem (to my surprise) and it has a name : ALUREON.H

described here :

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Virus%3aWin32%2fAlureon.H

The microsoft Malicious software removal tool only partially deleted it, there is a part you'll have to do manually. But my redirecting stopped!!

I also know what did cause this redirecting problem... I've installed a kind of maffia wars autobot called :

"Mafiawars_Autobot_V3.exe" (about "Install_facebook_plug_in_1.0.3.exe" I'm not sure)

Since then the redirecting started.

I hope this was helpfull

Cheers,

Frederik

You guys are way above my level with this stuff.

What did you use to find these files that caused the issue. I went to the registry and I had none of theses files. I went to extension and the only thing I have there is Real player extension.

Sorry to be so un-informed, but what utility should I use? I have the Microsoft stuff loaded.

Signed; lost in the woods

The above mentioned "XULRunner 1.9.1" can be found in Tools > Add-ons > Extensions if it is installed.
If you do not have that extension then that suggestion doesn't apply to you.
See Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems

The same for the other possibilities.
If a malware check with the above mentioned AV scanners do not fix it and you can't solve it yourself then you should ask for help on one of the forums that deal with malware.

See "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked and What to do when searches take you to the wrong search website

(Note: When I say to run something, run it as the administrator if you are the administrator.)

1) Go to these links & download these things.  Do not open them, just save them.

● Latest non-beta firefox http://www.mozilla.com/en-US/

● MozBackup http://mozbackup.jasnapaka.com/download.php

● CCleaner http://www.filehippo.com/download_ccleaner/

2) Do not uninstall your current firefox (yet).  I cover that part below.

3) Install & run MozBackup, & backup your bookmarks.

4) Run your current firefox, click Tools > add-ons > extensions, & write down the names of all of the extensions that you have.  Use a text document in your documents folder.

5) Still running your current firefox, click Help > troubleshooting information.  Near the top of this page, click the "Open containing folder" button.  At the top, in the address bar, click "Roaming", close firefox, & delete the "Mozilla" folder.

6) Install & run CCleaner.  In CCleaner, after you configure it's options, click Tools > uninstall to uninstall your current firefox.

7) Still running CCleaner, run it's ordinary cleaner & especially it's registry cleaner.

8) Install the firefox setup that you downloaded.

9) Run firefox & click Bookmarks > organize bookmarks > import & backup (at the top) > restore > choose file > wherever you told MozBackup to put your backed-up bookmarks.

10) Open the text document in your documents folder that has a list of extensions that you use.  Go to

https://addons.mozilla.org/en-US/firefox/

& find the add-ons that you want to use.  Before you add ANY add-on, read the reviews for it (if there are any), because problems are sometimes reported in some reviews.  Also, be sure to ask about most add-ons on this message board before adding them.  Specifically, ask if anybody has had any problems with (add-on's name) installed on the latest non-beta firefox.  This is because sometimes an add-on can have zero bad reviews but still cause trouble (like TweakMDB).

LOL I have tried all the above no addon's in addition to what is asked I also have full version of McAfee, and Stopzilla and microsoft malicious software removal tool and used the tool from microsoft that scans your computer for viruses malware and reg iregularities. Also I tried the about:config fix

There are some fixes that seem to improve the success rate of being able to go to websites listed in a search but I have not gotten a 100% success rate yet as an example there are sites it never tries to redirect like when I type glasses most sites it tries to redirect but en.wikipedia.org/wiki/Glasses it go straight to the site I have the a Firefox tool that tries to stop redirects and it will give you an option to let it redirect you but en.wikipedia.org/wiki/Glasses never asks just straight to it. 

It would be nice if Fire fox would actually create a redirect fix that actually works.

I have no problems at all with "Safari" oddly enough and normal problems with IE.

Had this problem and ran about five different anti-virus programs. They always seemed to get rid of one or more of trojans, but not the redirects. Then I looked in my add-ons and found the list of extensions had two XULRunner 1.9.1 . I disabled the first one but no change. When I also disabled the second (both disabled), the redirects stopped. I'm keeping them till I find a safe way to investigate them.

As mentioned above, look in your Firefox add-ons to see if the bogus XULRunner 1.9.1 add-on has been installed.

Here's how I went about permanently removing it:

• Go to the URL 'about:support'.

• Note the ID of XULRunner.

• Close Firefox.

• Search for the corresponding registry entry. You should find the value under HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{<add-on ID here>} .

• Note the path in the registry key value.

• Delete the registry entry.

• Go to the path that you just noted. It should read something like:C:\Users\<your user name>\AppData\Local\<add-on ID here>

• Delete that folder.

Some extra precautionary housekeeping, if you like:

• Within the file C:\Users\<your user name>\AppData\Roaming\Mozilla\Firefox\Profiles\o0bi5lzk.default\extensions.rdf

• ...locate the RDF:Description block that contains the add-on ID. Note the RDF:resource value.

• Now delete the entire RDF block.

• Do the same with the corresponding RDF:Seq RDF block.

• Search for the RDF:Description block that contains the RDF:resource value noted above. Delete that block.

Test Firefox:

• Reopen Firefox.

• Check your add-ons to be sure that the XULRunner entry no longer exists.

• Search Google and ensure that searching for a popular term, such as 'antivirus' not longer redirects you via google.ad.sgdoubleclick.net. As a bonus, you should also find that that Google Instant Search has returned to operation.

I just wanted to let you know, with great relief, the problem is fixed. The culprit? An extension called Google Toolbar for Firefox 7.120100830W. BEWARE. Perhaps there are updates but i would rather just get on without it.

  Thanks for the easy to read and execute article. I now have a better understanding of extensions and add ons as well as more respect. Who would have thought one extension could ruin my whole browser experience. You live and you learn.

I had this problem and posted on the forum many months ago but no solution to the problem. This was a repeat of an incident nearly 18 months back when I got my PC clean via bleepingcomputer.com

I changed to Microsnot after being so disappointed at the failure of Firefox to live up to its claims of being secure.

Now this might be a neat and easy solution for those with similar problems.

I updated my free AVG (Grisoft) Anti-Virus to the 2011 version and noticed that there was a scan button for root-kit infections and sure enough it found the following: "";"C:\WINDOWS\system32\drivers\prosync1.sys";"IRP hook, \Driver\atapi IRP_MJ_INTERNAL_DEVICE_CONTROL -> prosync1.sys +0x661";"Moved to Virus Vault" "";"<unknown>";"IRP hook, \Driver\prodrv06 IRP_MJ_CLOSE -> 0xE20E67B0";"Object is inaccessible." "";"<unknown>";"IRP hook, \Driver\prodrv06 IRP_MJ_DEVICE_CONTROL -> 0xE20E67B0";"Object is inaccessible." "";"<unknown>";"IRP hook, \Driver\prodrv06 IRP_MJ_CREATE -> 0xE20E67B0";"Object is inaccessible." "";"<unknown>";"IRP hook, \Driver\prohlp02 IRP_MJ_CREATE -> 0x79C9261F";"Object is inaccessible." "";"<unknown>";"IRP hook, \Driver\prohlp02 IRP_MJ_CLOSE -> 0x79C9261F";"Object is inaccessible." "";"<unknown>";"IRP hook, \Driver\prohlp02 IRP_MJ_DEVICE_CONTROL -> 0x79C9261F";"Object is inaccessible."

On selecting each on the above list and asking AVG to deal with the file, hey presto, cured the problem.

I have tried all sorts of malware detection and to date AVG is the only one that has detected these root-kit infections and as I use AVG free (used to pay subscription but now too expensive, hence free version) it is a neat solution.

This might be a neat way of solving future problems as it seems that AVG are now on the case of these malicious root-kit infections that are not normally easily removed.

Hope this helps.

I ran all the anti-spyware and anti-malware too. No help. I saw that others had removed plug-ins, and didn't find any that were conspicuous (by their name). Turns out one of the ones called "Java Console" was the culprit. (All but one were version 6.x). It was calling itself version 1.0..already a problem. Anyway, I nuked the Java Consoles, and the problem was gone.

I ran all the anti-spyware and anti-malware too. No help. I saw that others had removed plug-ins, and didn't find any that were conspicuous (by their name). Turns out one of the ones called "Java Console" was the culprit. (All but one were version 6.x). It was calling itself version 1.0..already a problem. Anyway, I nuked the Java Consoles, and the problem was gone.

Here's the culpret: Tools | Addons | Plugins | Shockwave Flash 10.1.85.3 (10.1 r85)

More on how to reproduce: Restart Firefox, in iGoogle, search for something original related to cars: nissan xterra etc. Then view source, and see if a script is added in the search between <head> and <title> . Note that it only does this for your first search after restarting, only on iGoogle, only a search that you haven't done before, and only if you don't block scripts with NoScript.

I wonder if something infected only my local copy, or if Adobe got compromised.

Hope this helps!

update: well, you need that for youtube. So I uninstalled and reinstalled, and the redirect comes back. Any ideas how to get a non-compromised flash player?

I also have tried running in safe mode with ad ons disable , and using the same programs for malware removal. no luck.