Browser hijacking
 |
This article may require cleanup to meet Wikipedia's quality standards. (September 2010) |
Browser hijacking is the modification of a web browser's settings by malware, spyware or a virus. The term "hijacking" is used as the changes are performed without the user's permission. A browser hijacker may replace the existing home page, error page, or search page with its own.[1] These are generally used to force hits to a particular website.
Some browser hijacking can be easily reversed, while other instances may be difficult to reverse. Various software packages exist to prevent such modification.
Contents |
Examples of hijackers[edit]
Onewebsearch[edit]
Onewebsearch, referred to as the onewebsearch virus, or onewebsearch.com redirection virus is malware, categorized as a browser hijacker. Onewebsearch utilizes browser hijackers and black-hat techniques to infect a computer system and attach add-ons, extensions, and toolbars to popular internet browser without permission, which in turn causes internet browsers like Chrome, Firefox, and Internet Explorer to redirect to onewebsearch.com, search.onewebsearch.com, home.onewebsearch.com, start.onewebsearch.com, related web pages, and third party domain names.
Conduit Search[edit]
Conduit distributes user customized toolbars. The toolbars modify the browser default search engine and homepage and several other browser settings.[2]
Search.us.com[edit]
Search.us.com Toolbar is a browser hijacker, which is promoted via other free downloads, and once installed it will add the Search.us.com Toolbar, change your browser homepage and default search engine to start.search.us.com. Search.us.com will display advertisements and sponsored links in your search results, and may collect search terms from your search queries.[3]
CoolWebSearch[edit]
CoolWebSearch (CWS) was one of the first browser hijackers. It redirected the existing home page to the rogue CWS search engine, with its results as sponsored links. With most antivirus and antispyware programs unable to properly remove this particular hijacker, a man named Merijn Bellekom developed a special tool called CWShredder specifically to remove this hijacker. Cool websearch is a popular browser hijacker and is owned by fun web products.
Search-daily.com [edit]
Search-daily.com is a hijacker that may be downloaded by the Zlob trojan. It redirects the user's searches to pornography sites. It also is known to slow down computer performance.[4]
MyStart.Incredibar Search[edit]
Mystart Incredibar Search is a browser hijacker which often comes embedded with many download applications and installers such as HyperCam. It is known to install itself into the following browsers: Firefox, Internet Explorer and Google Chrome.[5]
Removing Incredibar can be a daunting task since there are many different variations and most infected systems can expect to find undesirable windows registry changes, browsers configuration changes and files with random strings that are installed into the users local settings folders and depending on the version of your Microsoft Windows you use the location will vary from one version to the next. In some variations of Incredibar it appeals to be a removable add-on within Google Chrome and Firefox, simply removing Incredibar via the inbuilt browser add-on removal process is not enough since the infected system has combined registry and file installs of which reinstalls itself upon a system reboot.
A few virus and spyware removal applications such as Webroot Spysweeper and Eset NOD32 are known to remove Mystart Incredibar Search, but by using these applications to do so will not revert to your default search engine. Manual removal seems the most effective method as it will revert all changes while giving you a good understanding how to remove should you get something similar again.
Babylon Toolbar[edit]
Babylon's translation software prompts to add the Babylon Toolbar, identified as a browser hijacker. The toolbar also comes bundled as an add-on with other software downloads.[6] It changes browser preferences such as the user's home page and search engine, changes that can be very difficult to reverse.[7] Many users, trying desperately to get rid of Babylon, have searched for help on different support forums.[8] The toolbar is listed as an unwanted application by anti-spyware software such as SpyHunter, Stopzilla, and Spybot – Search & Destroy.
In 2011, the Cnet site Download.com started bundling the Babylon Toolbar with open-source packages such as Nmap. Gordon Lyon, the developer of Nmap, vented his anger online over the way the toolbar was tricked on users.[9][10] The vice-president of Download.com, Sean Murphy, released an apology: The bundling of this software was a mistake on our part and we apologize to the user and developer communities for the unrest it caused.[11]
Removal[edit]
Most new hijackers will not allow a user to change back to their home page through Internet Properties. Modern hijackers' settings will most likely return upon reboot, however, well-updated antispyware software will likely remove the hijacker. Some spyware scanners have a browser page restore function to set your page back to normal or alert you when your browser page has been changed.
Rogue security software[edit]
Some rogue security software will also hijack the start page generally displaying a message such as "WARNING! Your computer is infected with spyware!" to lead to an anti-spyware vendor's page. The start page will return to normal settings once the user buys their software. Programs such as WinFixer are known to hijack the user's start page and redirect it to the website.
Beginning features confused with browser hijackers[edit]
EarthLink[edit]
In 2006, EarthLink started redirecting mistyped domain names over to a search page. This was done by interpreting the error code NXDOMAIN at the server level. The announcement led to much negative feedback, and EarthLink offered services without this feature.[12]
See also[edit]
References[edit]
- ^ "Browser Hijacking Fix & Browser Hijacking Removal". Microsoft. Retrieved 23 October 2012.
- ^ "So long, uTorrent". First Arkansas News. 2010-12-15. Retrieved 2011-08-11.
- ^ "Remove Search.us.com Toolbar (Uninstall Guide)". Malware Tips. 2010-12-15. Retrieved 2013-05-1.
- ^ "Browser Hijacker". MySearchCorp. Retrieved 3 July 2012.
- ^ "How To Remove The MyStart By Incredibar Browser Search Redirection Virus (Search.Incredibar.com)". Botcrawl.com=10 July 2012.
- ^ Getting rid of Babylon Jay Lee, The Houston Chronicle, July 25, 2012
- ^ Remove FBI & Babylon Zombie Virus PCPitstop.com, author Steve Hogan, October 11, 2012
- ^ Lesson Learned the Hard Way: Pay Attention to the Source of Your Downloads Don Tennant, IT Business Edge, September 11, 2012
- ^ Download.com sorry for bundling Nmap with crapware The Register December 9, 2011
- ^ Popular network tool Nmap in CNET security brouhaha Naked Security December 6, 2011
- ^ A note from Sean regarding the Download.com Installer Download.com December 7, 2011
- ^ Mook, Nate (2006-09-06). "EarthLink Criticized for DNS Redirects". betaNews. Retrieved 9 May 2012.
