I think a bad add-on is the most likely vector for this infection. Here's my suggested procedure for tracking down and cleaning up bad add-ons, hijackers, and ad injectors. I know it seems long, but it's not that bad. (1) Open the Windows '''Control Panel''', Uninstall a Program. After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. ''Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.'' Take out as much trash as possible here. (2) Open Firefox's '''Add-ons page''' using either: * Ctrl+Shift+a * "3-bar" menu button (or Tools menu) > Add-ons * in the Windows "Run" dialog, type or paste <br><code>firefox.exe "about:addons"</code> In the left column, click '''Plugins'''. Set nonessential and unrecognized plugins to "Never Activate". In the left column, click '''Extensions'''. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions. ''Bear in mind that all extensions are optional, none come with Firefox, and you can learn more about them by checking their reviews on the Add-ons site.'' Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step. Next, try restoring your preferred home page and search engine. See: * [[Startup, home page, tabs, and download settings]] * [[Change your default search settings in Firefox]] Do your settings work now? (3) You can search for remaining issues with the '''scanning/cleaning tools''' listed in our support article: [[Troubleshoot Firefox issues caused by malware]]. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case. Success? If that doesn't work, see: https://malwaretips.com/blogs/remove-safesear-ch/