CT3332016 in the Bing link would indicate to Conduit malware.

Do a malware check with several malware scanning programs on the Windows computer.

• https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure you update each program to get the latest version of their databases before doing a scan.

• Malwarebytes' Anti-Malware:
  https://www.malwarebytes.com/
• AdwCleaner:
  https://www.bleepingcomputer.com/download/adwcleaner/
  https://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
• SuperAntispyware:
  https://www.superantispyware.com/
• Microsoft Safety Scanner:
  https://www.microsoft.com/security/scanner/en-us/default.aspx
• Windows Defender:
  https://windows.microsoft.com/en-us/windows/using-defender
• Spybot Search & Destroy:
  https://www.safer-networking.org/en/index.html
• Kasperky Free Security Scan:
  https://www.kaspersky.com/security-scan

You can also do a check for a rootkit infection with TDSSKiller.

• Anti-rootkit utility TDSSKiller:
  https://support.kaspersky.com/viruses/disinfection/5350

https://support.kaspersky.com/viruses/utility

BingPopup.exe (C:\Users\Jerry\AppData\Local\Microsoft\CLR_v4.0\UsageLogs)

The Bing search engine pop-up, screen and recommendations has superseded the Firefox selected default, and still stated, search engine. The following appears to be the installation of it. However, I have no idea as to how to uninstall it: 1,"fusion","GAC",0 1,"WinRT","NotApp",1 3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\594d60461acceac13ce80832549c89e5\System.ni.dll",0 3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\a8b9264f5404041b3ca7990d0c870eea\System.Core.ni.dll",0 3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\9bc269d94588e5851ab5430121020ac6\System.Drawing.ni.dll",0 3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\dca7ad09cd35273a889606994391f9c0\System.Windows.Forms.ni.dll",0 3,"CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\565f8a93d92bc82ec2b51a58cecfbcfc\CustomMarshalers.ni.dll",0 3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\a735c36b364fecbd4bf5cb11860567e7\System.Management.ni.dll",0 3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\4463fd7855bf3afd17a358d42b242f0d\System.Xml.ni.dll",0 3,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web\3dc0e6a96fd70701be3f0e55a5a8cd76\System.Web.ni.dll",0 3,"System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a#\7cd4af74f07a9c4ee3df45672d465d0f\System.Web.Extensions.ni.dll",0 3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\4fe9b888a2c823ebca746b7a37317174\System.Configuration.ni.dll",0 3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\174f2f1f57bd55acc7fad3a68a3e0a78\System.ServiceProcess.ni.dll",0 3,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\60301fadb791de3ae639e442427ae0f3\System.ServiceModel.ni.dll",0 3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\6feed415c7ea4080aec4dbedfd7d779b\System.Runtime.Serialization.ni.dll",0 3,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\bcefb49eb025c7dbe0b6299510ac28e7\SMDiagnostics.ni.dll",0 3,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\6e8bd209b94378d2684592d79f16e584\System.ServiceModel.Internals.ni.dll",0 3,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\9d4bbce0517f910265bad3e312041eb5\System.IdentityModel.ni.dll",0

Hi savmort, is that information from a malware scanner?

A common vector for search hijacks in Firefox is an extension. You can view, disable, and usually remove unwanted or unknown extensions on the Add-ons page. Either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions. On the right side, find the "Manage Your Extensions" heading.

If there is at least one extension before the next heading -- "Recommended Extensions" -- please continue:

Then cast a critical eye over the list below that heading. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage.

Anything suspicious or that you just do not remember installing or why? If in doubt, disable anything you can live without for a few hours, and remove anything you don't need or don't fully trust. For your privacy and security, don't let mystery programs linger here.

Any improvement?

Answer to your question: The BingPopup.exe and log listed above was discovered by my search of the date and time of changes to my Windows Directory. I am running Avast Professional. I did a scan, it found nothing.

I checked my 5 extensions, turned them all off, but that had no affect. So, I removed the last 3, which I could not remember installing on Firefox since the original install; and rebooted, but that had no affect.

It appears to me the BingPopup.exe file log indicates a number of changes to ni.dll files found in various sub-directories.

Seems I need to run an exe file to counter the BingPopup.exe. or reset the OS to previous date, neither of which I have any experience with.

Hi savmort, if you are not confident that Avast is cleaning your system, you could supplement it with the tools listed in our article here: Troubleshoot Firefox issues caused by malware.

Just to confirm the situation:

• Your default search engine is Google, or DuckDuckGo, or something else that doesn't use Bing for its results: Change your default search settings in Firefox
• When you start typing a query in the address bar, Firefox shows on the top line of the drop-down that it is going to use your selected default search engine, but when you submit the query, results appear on https://www.bing.com/ instead
• This occurs even with all extensions disabled

I finally found an easy way to fix this. Please excuse if this solution has already been posted.

In Firefox Preferences>>>Search>>>Search Shortcuts>>>Restore Default Search Engines

By clicking "Restore Default Search Engines" and deleting Bing and restoring Google as my preferred default search engine.

Now if I could just figure out how to stop Bing from worming its way in after every reboot despite deleting it many times. I resent this intrusion greatly and for this reason I WILL NEVER USE BING!!!