Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.

You can try these free programs to scan for malware, which work with your existing antivirus software:

• Microsoft Safety Scanner
• MalwareBytes' Anti-Malware
• Anti-Rootkit Utility - TDSSKiller
• AdwCleaner (for more info, see this alternate AdwCleaner download page)
• Hitman Pro
• ESET Online Scanner

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Windows 8 has antivirus built-in already.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!

Are you sure you don't have any mystery extensions? Just to make sure, would you mind starting Firefox in its Safe Mode, where the self-hiding feature of some extensions doesn't work for them? (Firefox's Safe Mode is a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Diagnose Firefox issues using Troubleshoot Mode.)

If Firefox is not running: Hold down the Shift key when starting Firefox.

If Firefox is running: You can restart Firefox in Safe Mode using either:

• "3-bar" menu button > "?" button > Restart with Add-ons Disabled
• Help menu > Restart with Add-ons Disabled

and OK the restart.

Both scenarios: A small dialog should appear. Click "Start in Safe Mode" (not Refresh).

Then check the Add-ons page. Either:

• Ctrl+Shift+a
• "3-bar" menu button (or Tools menu) > Add-ons

In the left column, click Extensions. Anything listed here that you do not remember installing?

Thanks, Guigs2. I have a couple of malware and virus removers, but they found nothing.

jscher2000, thanks very much for your detailed instructions on checking for unwanted extensions. Unfortunately, there's nothing in there that I didn't intentionally install.

Did the problem still occur in Firefox's Safe Mode? In that case, it could be an example of a new type of malware that embeds into a settings file in Firefox's program folder. To remedy that, try this:

Clean Reinstall

We use this name, but it's not about removing your settings, it's about making sure the program files are clean (no inconsistent or alien code files). As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed.

(1) Download a fresh installer for Firefox 38.0.5 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.)

(2) Exit out of Firefox (if applicable).

(3) Rename the program folder:

(32-bit Windows folder names)

C:\Program Files\Mozilla Firefox

to

C:\Program Files\OldFirefox

(64-bit Windows folder names)

C:\Program Files (x86)\Mozilla Firefox

to

C:\Program Files (x86)\OldFirefox

(4) Run the installer you downloaded in #1. It should automatically connect to your existing settings.

Does a cleanly reinstalled Firefox search Google normally??

Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders:

• \OldFirefox\Plugins
• \OldFirefox\browser\plugins

Sorry, jscher2000. I tried to follow those instructions, but don't really understand what you mean when you say rename the program folder.

I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again.

Which malware scanners did you run?

You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled.

Start Firefox in Safe Mode to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem.

• Switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance
• Do NOT click the Reset button on the Safe Mode start window

• https://support.mozilla.org/kb/Safe+Mode
• https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes

You can check the connection settings.

• Tools > Options > Advanced > Network : Connection > Settings
• https://support.mozilla.org/kb/Options+window+-+Advanced+panel

If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly.

See "Firefox connection settings":

• https://support.mozilla.org/kb/Firefox+cannot+load+websites+but+other+programs+can

You need to reinstall Firefox after having renamed the current Firefox program folder. The purpose is to do a clean reinstall of Firefox and that involved removing or renaming the existing Firefox program folder.

OurJud said

I went to Local Disk (C:) > Program Files > Mozilla Firefox, then renamed it as you suggest. But then when I tried to reopen firefox from my desktop icon to carry on reading your instructions, my computer couldn't find it. I had to put the folder name back to what it was so that I could make firefox work again.

Sorry, you'll need to copy/paste the steps to a word processing document or another program in that case!

cor-el said

Which malware scanners did you run?

---

You haven't confirmed that you have started Firefox in Safe Mode or merely checked in "Firefox/Tools > Add-ons > Extensions" which extensions are installed and enabled.

CCCleaner and Malwarebytes.

Sorry, I thought I'd made it clear that I'd done the Safe Mode check, in my reply to jscher2000's first post.

Now that I know I did the folder rename correctly, I'll try it again and see it through to the end.

Okay, did the re-install and it's still popping up.

Just to clarify, I can trigger it by typing into google, words which suggest I would like to shop.

See another example attached.

I think the next step is to try some different malware detectors.

OurJud said

I think the next step is to try some different malware detectors.

Yes, good idea.

You'll notice that the icon in the address bar which usually is gray padlock turned to a mixed content warning, probably due to something injected by the malware. If you want to see whether you can learn more about it, maybe you could pull out a bit more information:

• Open the "Inspector" tool by pressing Ctrl+Shift+i. This should display the HTML source code of the page in the lower part of the tab.

• Click the little icon in the upper left (looks like an arrow pointing to a box) and then click the upper left corner of the black bar. This should display a selection bar over the relevant portion of the HTML source down in the Inspector.

• Using the mouse, hover over the selected part of the HTML source and then the next element up, and so on, watching the blue highlight over the page, until you find what seems to be the outermost part of the source that is associated with the black box. Then click that to select it.

• To share the source code of that section of the page with forum volunteers, you can paste it on the Pastebin site (no registration needed). Right-click the HTML element you selected and choose Copy Outer HTML. Then go to http://pastebin.com/ and paste the code into the New Paste box.

• The code might be hard to read, but skim through it to make sure it doesn't have your email address or other personal information. To save, you can leave the various controls below the box at their default values, and assign a name like Black Box on Google (or more if you like) before clicking Submit. Then you should get a link you can paste back here for someone to look at.

Thanks for your continued help, jscher2000.

I installed and ran hitman pro, and was quite optimistic when it found several 'threats'. I let the program to its job and delte them all, but to no avail - the shopping pop-up is still lurking.

I actually beat you to your next advice, although I used Firebug to inspect the banner.

It highlighted the following code:

<nav class="indicator-groups">

??

Hmm, that's not enough to go on. When you use Copy Outer HTML you should get the full HTML of the entire block, which will have the URL of that image among other things. This might be called something different in Firebug, I haven't used it for a couple years now. Please try to get the entire block by navigating upwards in the HTML tree, as selecting by click often doesn't do that.

Hi, jscher2000.

I don't really know what I'm doing in terms of the code I have to share with you, and am reluctant to do so if you think personal information could be contained within.

I did find this in the code, which suggest the source is my avira virus software.

<a class="offers-best" data-element="Notification" data-type="Best" data-event="Offers - View" title="Backwards (Red Dwarf)" target="_blank" href="https://offers.avira.com/aviraoffers/api/v2/tracker?apiclien…ZmU2NzhkOGJhNTU3ZTFlZDBhZjcyNTE1ZDgyNzFhZWMtIy05MTgyNjY2MA==">

I've tried to kill the link, but can't.

Yes, it points the finger directly at Avira!

General info: http://www.avira.com/en/avira-offers

FAQ says:

Q: How do I enable or disable Avira Offers?

A: Avira Offers is included as a feature of the Avira Browser Safety extension. When you install it you will be notified that the feature is running. You can disable Avira Offers through the Avira Browser Safety settings page. Just click on the Settings icon inside the dashboard.

An old page that may or may not be relevant on how to remove the ads: https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1716

Phew! So it's nothing sinister then?

OurJud said

Phew! So it's nothing sinister then?

Perhaps only extremely annoying and not sinister.

Thank you so much for sticking with me on this, jscher2000.

I've now disabled it and the banner has gone!!

I owe you, and very much appreciate your help :)