Bing Search deeply embedded starts through

I've worked through this problem with the help of Smittychat on this thread and we are at an impasse.  So Smittychat suggested posting the problem here.

I'll try to describe it so that no one will jump to the obvious rudimentary troubleshooting questions, because I think Smittychat, I and another poster worked through all of those.  Smittychat is obviously experienced and skilled, and he worked through all the rudimentary troubleshooting steps anyone with experience would go through.

The problem is this: all my browsers open to Bing Search at this address:

In other words, it's the standard Bing Search's url -- http// -- with an odd argument tacked on: ?pc=COSP&ptag=AABF01BDF90604DD4AEF&form=CONMHP&conlogo=CT3210127

It wasn't until a September 30 post by Lylesx, who is having a similar problem, that I found out that flashes in the address bar before  It took me about five times to catch it because my browser opens too fast, but I did finally catch it.  If you type into an address bar it does become that Bing Search with the odd argument.  So it appears as if has teamed up with or is using Bing to disguise itself.

Note these characteristics:

  • My home page and my default search engines have not been changed anywhere in the system. They are not changed in either of the browser settings (I'm using IE11 and Firefox 32) or in all the likely places that all the different people, both here and around the net, have suggested.  I've looked through the registry in the key settings for IE and Firefox, where I've found that they remain the same as I've set them to be. 
  • That means, when I open a browser it goes to Bing Search, but if I click on my home page icon, I go to my home page. 
  • When I'm at my home page, my default search next to the address bar then becomes my designated default search as it always has been. All the evidence in settings shows my default is not being changed even when the Bing Search page is up.

I have tried all the standard fixes related to and tuvaro. Those fixes are also to be found suggested in this forum, I searched and found them.  This issue at least appears to be something other than those.

I have also searched the Internet for where to look in the registry.  The solutions I've found did not address this issue.

Whatever this intrusion into my system is, it's very well hidden or disguised.  I am not a novice, I've been troubleshooting Windows OS's back to Windows 3.1.  I'm not a trained techie but I have a lot of experience troubleshooting software.

I am at a loss as to where to look next.  It doesn't seem to be taking over anything other than the two browser's openings at this point, so it seems more a nuisance than a virus.  Nevertheless, because no one so far can figure out where it is in my system, that's not very comforting. So I don't want it in my system.  If no one here has any new ideas, I'm considering loading the image I created back in March, which I hope resets everything where ever this is.  Otherwise, it's scrub the hard drive time and start from scratch.

I assembled my system and installed Windows 8.1/64 Pro on March 10, 2014. 

I'm using Windows Defender and running Malwarebytes for defense.  I have an additional protection in Firefox: Bluhell Firewall 2.4.0.

I'll appreciate any efforts to help.

Somehow this nuisance got installed by getting past those defenses, and is installed in a disguise or where I can't find it.


Thanks for all the replies.

A very perceptive LyleSx found the source of the problem in the other thread where I've been working through this problem.  He found it in his friend's laptop he's been troubleshooting.  It is the solution that works for me, so this is a fixed problem now:  Essentially it gets embedded in the shortcuts on the desktop and apparently no where else.  I'm guessing it was installed by one of the PUPs my malwarebytes removed. If it comes back.... well, maybe it's not fixed.  We'll see.

LyleSx wrote:

I found the cause of the problem on my friend's laptop. All the browser icons had the offending URL tacked onto the end of the target, so the browser was always launching to offending URL, no matter what the homepage was set to.

After removing it, the browsers load the correct home pages when launched


1 person was helped by this reply


Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.


Question Info

Last updated March 20, 2020 Views 1,943 Applies to: