Browser hijacking

From Wikipedia, the free encyclopedia
  (Redirected from Browser hijacker)
Jump to: navigation, search

Browser hijacking is the modification of a web browser's settings. The term "hijacking" is used as the changes are performed without the user's permission. A browser hijacker may replace the existing home page, error page, or search page with its own.[1] These are generally used to force hits to a particular website, increasing its advertising revenue.

Some browser hijacking can be easily reversed, while other instances may be difficult to reverse. Various software packages exist to prevent such modification.

The homepages that are set by hijackers are often search pages, and many of these programs are spyware programs that track personal data.

Most installers will give users the opportunity to accept or decline an offer to install a hijacker; however, the request to decline the offer is often ignored or presented in a very confusing manner. This is done for the sole reason of tricking users into installing excessive bloatware and malware.

Examples of hijackers[edit]

Babylon Toolbar[edit]

Babylon Toolbar is a browser hijacker that will change the browser homepage and set the default search engine to It is also a form of which displays advertisements, sponsored links, and spurious paid search results. The program will collect search terms from your search queries.

Babylon's translation software prompts to add the Babylon Toolbar on installation. The toolbar also comes bundled as an add-on with other software downloads.[2]

In 2011, the Cnet site started bundling the Babylon Toolbar with open-source packages such as Nmap. Gordon Lyon, the developer of Nmap, vented his anger online over the way the toolbar was tricked onto users.[3] The vice-president of, Sean Murphy, released an apology: The bundling of this software was a mistake on our part and we apologize to the user and developer communities for the unrest it caused.[4] Search[edit]

New Tab is a browser hijacker which will set the browser homepage and default search engine to It is also a form of adware which displays advertisements, sponsored links, and spurious paid search results. The program will collect search terms from user search queries.

It installs a Windows Service and runs on Windows start up.

Conduit Search[edit]

Conduit is a potentially dangerous browser virus which steals personal and confidential information from the user and transfers it to a third party. This toolbar has been identified as Potentially Unwanted Programs by Malwarebytes[5] and is typically bundled with other free downloads.[6][7] These toolbars modify the browser's default search engine, homepage, new tab page, and several other browser settings.[8]

A program called "Conduit Search Protect", better known as "Search Protect by conduit", can cause severe system errors upon uninstallation. It claims to protect browser settings but actually blocks all attempts to manipulate a browser through the settings page; in other words, it makes sure the malicious settings remain unchanged. The uninstall program for Search Protect can cause Windows to be unbootable because the uninstall file not only removes its own files, but also all the boot files in the root of the C: drive.[citation needed] and leaves a BackGroundContainer.dll file in the start-up registry. [9]Conduit is associated with malware, spyware, and adware, as victims of this hijacker have reported unwanted pop-up and in-text advertisements.

Victims of unwanted redirections to have also reported that they have been attacked by phishing attempts and have received unwanted email spam, junk mail, other messages, and telephone calls from telemarketers. Some victims claim that the people claimed to be Apple, Microsoft, or their ISP, that personal information was used in some phone calls, and that some of the calls concerned their browsing habits and recent browsing history. Personal information used in phishing attempts may be associated with spyware. This hijacker virus is currently added to the official PowerISO download, and the Vuze version update, for example.[10]


[[]] () was one of the first browser hijackers. It redirected the existing home page to the rogue CWS search engine, with its results as sponsored links. With most antivirus and antispyware programs unable to properly remove this particular hijacker, a man named Merijn Bellekom developed a special tool called CWShredder specifically to remove this kind of hijacker. CoolWebSearch is a popular browser hijacker and is owned by fun web products.

Coupon Server[edit]

Coupon Server is an adware program bundled with multiple apps that are downloaded from the Internet by users. This program may appear on PCs without a user's knowledge. Coupon Server may appear to be useful, but can be intrusive and display ads without users' permissions.[11] Coupon Server is also considered as a malicious domain and browser hijack. It will hijack your Internet browser and forcibly lead a user to its homepage, which is disguised as a legitimate search engine to fool visitors and benefit its website. It will direct the browser to a suspicious domain, alter browser settings and finally take over the whole browser.

Delta Search and Claro Search[edit]

Delta and Claro are programs that each offer a free search engine and toolbar often bundled with free downloads. These browser hijackers will redirect all searches to their own engines, to gain revenue. Automated tools are able to remove Delta, Claro, and their files, but the changes to the homepage and default search engine have to be reverted manually.


The ad-triggering software called GoSave is being reported to cause user experience issues because of its intrusive characteristics. Starting with installation where the victim is not appropriately informed, all the way to the absence of clear authorization for inserting ads into visited pages on the Internet – this piece of potentially unwanted code should certainly be exterminated from a computer it succeeded to compromise. The software developers who choose a free-of-charge setup model for their startups often conceal a substantial fact from their to-be customers. They mainly do monetize intellectual effort from the beginning by opting into the inclusion of third-party applications in the installation package for their tools. This type of promotion is okay, basically, as long as one important condition is kept: the affiliated software should be safe and unobtrusive. In the case with the program known as GoSave, though, the above-mentioned provision is highly doubtful. The involvement of free file downloaders into the proliferation of said adware, which GoSave definitely is, has been noted by malware researchers since this infection first emerged. Apps like Quick-Downloader, SendMyWay, Olcinium Software and File Factory are being exploited to push the malign code in a not-so-transparent manner. To their credit, these utilities mention that the user is about to get an extra item as a result of the setup, but sadly enough notifications like that are rarely paid attention to. Such somewhat covert infiltration of this threat into a PC being an event that went through, its operation instantly grows more than perceptible. It adds a plugin or extension to whichever one of the prevalent web browsers is used. It’s currently compatible with Internet Explorer, Firefox and Chrome. Important to know, the name of the troublemaking add-on isn’t necessarily "GoSave" – it varies and might be GS Booster, GS Sustainer or something else.

Groovorio[edit] (you can also find it named as Groovorio browser virus) is an annoying browser hijacker, which is used for promoting websites and programs that are related to it. installs into computer system as a browser extension and once it gets into your browser it can take over all the major settings of all browsers.


The mischievous browser hijacker may replace the preferred search tools illegally. This infection travels bundled with third party applications and its installation may be silent. Due to this, computer users are usually surprised to discover the hijacker when they launch the affected Internet Explorer, Google Chrome or Mozilla Firefox browsers.[12][edit] is a browser hijacker that affects Mozilla Firefox and Google Chrome web browsers. This application enters your computer without your knowledge and modifies your browser settings. This browser hijacker changes your default homepage to and even modifies New Tab settings to Jamenize as well.


Mixi.DJ offers a media player, but also a free toolbar and Conduit-based search engine, the toolbar being the one which they will prompt to add during installation. The toolbar is a new hijacker that alters a browser's homepage. It also adds itself to the computer's registry, creates strings in the memory, and changes the icon on Internet Explorer to a magnifying glass.


The main problem with is that this browser hijacker might look like a genuine search provider, and some users may not even realize they are infected. However, one of the best ways to determine whether something is wrong or not, is to check for commercial advertisements and various pop-ups. The presence of an adware application you are not familiar with is the first sign that something might not be right. Hence, if you see a lot of pop-ups and other types of advertisements on your search results page, check whether your default search engine is or not.

MyStart.IncrediBar Search[edit]

MyStart.Incredibar Search (Mystart Search IncrediBar, MyStart toolbar, MyStart Search, IncrediBar, IncrediBar Games-EN) is a very dangerous Internet browser hijacker, virus, and spyware that often comes embedded with many download applications and installers such as HyperCam. It is known to install itself into Firefox, Internet Explorer, Safari, and Google Chrome

Symptoms range from no symptoms at all (simple processor drainage) to complete system crashes so severe that the victim has to re-install their entire operating system.

MyStart uses browser helper objects (in this case search tools) and infects some users by installing MyStart search toolbar into their browser (Firefox is most vulnerable) which redirects internet users to MyStart’s websites, in particular. Some Internet users report that they are redirected for every search or webpage they visit.

If mystart is not removed:

  • Your computer can become malformed and operate improperly.
  • Your browser settings become corrupted and Internet usage is taken hostage by a constant redirection setting to drive-by-download websites, which can open the door for more infections, and overall cause a wide range of operating system related issues associated with Trojans.
  • Computer accesses may become blocked or locked if not MyStart is not addressed, similar to the behaviour of ransomware.
  • Most of your user-initiated browsing and search is redirected to MyStart-based websites while you're infected.
  • High levels of CPU usage are due to MyStart processes, which can cause systems to crash or become malformed.

Removing Incredibar can be an extremely daunting task since there are countless different variations and most infected systems can expect to find undesirable Windows registry changes, browser configuration changes, and files with random strings that are installed into the user's local settings folders and depending on the user's operating system, its version, and even computer the location will vary from one PC to the next. In one version of Incredibar it appears to be a removable add-on, plug-in, or extension within web browsers; however, simply removing Incredibar via the inbuilt browser add-on removal process is not enough since the program has already combined registry and file installs of which re-installs itself upon a system or browser reboot.

A few virus and spyware removal applications such as Webroot Spysweeper, Eset NOD32, AdwCleaner, and Junkware Removal Tool are known to remove Mystart.Incredibar, but using these applications to do so will not revert the user to their default search engine.

Nation Zoom[edit]

Nation Zoom is a browser hijacker that changes a browser's home page to and default search provider to[13]


Onewebsearch, referred to as the onewebsearch virus, or redirection virus is malware, categorized as a browser hijacker. Onewebsearch utilizes browser hijackers and black-hat techniques to infect a computer system and attach add-ons, extensions, and toolbars to popular internet browsers without permission, which in turn causes internet browsers like Chrome, Firefox, and Internet Explorer to redirect to, search-, home-, or, related web pages, and third party domain names.[edit] is a browser hijacker that alters a browser's homepage and default search engine. It can also slow down the victim's PC and prevent many programs from running.It keeps you redirecting to some unwanted web sites which includes adware[edit] is a browser hijacker which changes the browser's homepage, and also runs strings to slow down the victim's PC. It can be difficult to remove manually, or with Internet tools.[12]


RocketTab is a browser hijacker that runs as a program and browser plugin. It embeds its own search results from RocketTab when you search with other providers. RocketTab sets itself as a proxy and runs all http and https traffic through itself, it is known to create problems for security applications. Uninstalling the application removes the proxy, the targeted ads and search results RocketTab provides.


Searchassist is a browser hijacker which piggybacks on other downloads from untrusted websites.

It will change your new tabs to and opens searchassist on browser start-up. It is hard to remove,and is stubborn, hence the fact that you cannot uninstall it without deleting every file related to it, and if not uninstalled, will repeatedly change the browser tabs and homepage settings. It is meant to work with Firefox, Safari, Chrome, and Internet Explorer. It is compatible with only Windows and Linux. Searchassist can degrade your system if you do not treat it with anti-malware programs such as ADWcleaner, Spyhunter, and Malwarebytes. It is also known to slow down computer performance and cause the blue screen of death (BSOD), a screen that causes the computer to restart because of the viruses that come with searchassist. Searchassst, not unlike vosteran can have spyware links. It is highly recommended to redirect to another webpage through the address bar if you start on searchassist.

Review sites such as may recommend searchassist, but many users rate it poorly. Searchassist claims to be a legitimate search engine with great personal results, tempting victims of the hijack, making it one of the hardest hijacks to recognize because the image on search assist is very much like a google doodle. If you think you have fallen victim to searchassist, when the browser starts, check the address bar for [General](do not click this link). if you find this, make sure to uninstall via other anti-malware programs.

Though searchassist may be sneaky, it can be prevented by other programs like unchecky. Make sure to read every offer. [edit] is a hijacker that may be downloaded by the Zlob trojan. It redirects the user's searches to pornography sites. It is also known to slow down computer performance.[14][edit] is a mischievous browser hijacker that replaces users home page, new tab page and default search engine. The program is advertised as a browser add-on that is supposed to help customize tabs and protect browsers from being affected by other is associated with malware distribution. The website display a banner ad just below the search box. Most often, this will offer you to play some flash games[edit] (can also be found as Search-Gol) is a search engine, which may show up on the infected computer instead of the user's default search engine. The cause of it getting onto the homepage is unknown, and it is known for downloading malware onto the computer. It replaces the default homepage for no reason and without the user's permission. Numerous antivirus websites and blogs say that searchgol is a virus, but it is a potentially unwanted program (PUP) because it sneaks inside the system in a bundle with other programs and initiates some changes on the system without the user's permission. Removing Searchgol is not easy, as the victim must perform a browser restore, before removing programs related or downloaded by the browser hijacker.[edit] domain and the domain belong to the IAC Search & Media, Inc. This company is known by the name Ask Jeeves Inc. It has a lot of popular domains on the web and the most famous of them is When something is searched in the Searchnu search engine, the search results will redirect to and related websites. The user can still access Google, either by entering it in the address bar or by searching for it, but Searchnu is still the homepage. Searchnu has 3 "clones" which are, /409, and /421. However, removing Searchnu is easy following instructions.[edit] (Smartbar developed by Resoft) is potential malware, categorized as a browser hijacker and spyware, that causes Internet browsers to redirect to the search engine. Snap.Do can be manually downloaded from the Resoft website, though it can be concluded that many users are entrapped by their unethical terms. It affects Windows and can be removed through the Add/Remove program menu regularly. Snap.Do also can download many malicious toolbars, add-ons, and plug-ins like DVDVideoSoftTB, General Crawler, and Save Valet.

General Crawler, installed by, has been known to use a backdoor process because it re-installs and re-enables itself every time an affected user removes it through their browser(s). will disable the option to even change your homepage and default search engine.

Resoft will track the following information:

  • The Internet domain and IP address from which the user accesses the Resoft Products. (location, ID, etc.)
  • Screen resolution of the user's computer monitor (display).
  • The date and time the user intentionally or unintentionally accesses Resoft products.
  • The pages the user is visiting with the Resoft Products (with or without knowledge of using Resoft products,
  • If the user willingly or unwillingly linked to a Resoft website from another referring website, the address of that site.

By using the Resoft Products, the user consents to have their personal data transferred to and processed both within and outside of the United States of America.

By using the Resoft website, the user agrees to the preceding uses of their information in this way by Resoft.[15]


Trovi is a browser hijacker like search protect by conduit but a different brand that, according to a report from an anonymous user, can be found while installing Cheat Engine. It is reported to serve many ads, and hijacks the most common browsers' homepage. Manual removal is simple because in safe mode, there is no protection on the Trovi files which can easily be removed from the computer along with fixing browser settings.


Tuvaro (can also be found as is a browser hijacker that can take over the home page and search engine provider of the infected web browsers. There are many methods that Tuvaro employs to spread into the targeted computers. It can get inside a computer secretly and change (and lock) a browser's home page and search engine provider without the user's awareness.

TV Wizard[edit]

TV Wizard (by Injekt) is an Internet toolbar/plugin (for Internet Explorer it runs as a BHO, in Chrome and Firefox it will run as an extension) that plugs into the user's default web browser and will modify a number of settings such as taking control of the browser's search and home pages, new tab functionality as well as DNS 'not found' redirection. Additionally TV Wizard will change some security settings of the browser that might also lower the overall security of the user's PC. This is done in order to allow the program to run uninterrupted. Should the user attempt to uninstall TV Wizard using the standard methods in Add/Remove Programs, only parts of this PUP will be uninstalled and some items such as the modified search and home pages may still point to an unwanted web page. Also to note as disclosed in the privacy policy, the program will track and report behaviors of the user while the plugin is installed including but not limited to the URLs and web pages the user visits as well as search terms and search results the user queries.


Vosteran is a browser hijacker that changes a browser's home page and default search provider to This infection is essentially distributed bundled with other third-party applications. Vosteran carries the PUP virus. The identity of Vosteran is protected by from Australia. Vosteran is registered through Whiteknight. [16]

Browser Shop[edit]



Most new hijackers will not allow a user to change back to their home page through Internet Properties. Modern hijackers' settings will most likely return upon reboot, however, well-updated antispyware software will likely remove the hijacker. Some spyware scanners have a browser page restore function to set the user's homepage back to normal or alert them when their browser page has been changed. Manual removal is also a good choice to give the user a good understanding of what to do while reverting all changes. After you do this, you may want to check for left-overs. This way, if any part of the program was left uninstalled, you could delete it to ensure your safety.

Rogue security software[edit]

Some rogue security software will also hijack the start page generally displaying a message such as "WARNING! Your computer is infected with spyware!" to lead to an anti-spyware vendor's page. The start page will return to normal settings once the user buys their software. Programs such as WinFixer are known to hijack the user's start page and redirect it to the website.

Beginning features confused with browser hijackers[edit]


In 2006, EarthLink started redirecting mistyped domain names over to a search page. This was done by interpreting the error code NXDOMAIN at the server level. The announcement led to much negative feedback, and EarthLink offered services without this feature.[17]


A major sector of companies related to browser hijacking, as well as other, aggressive and, in parts, malicious adware and spyware, has grown in Israel's high tech region and is known as Download Valley.

See also[edit]


  1. ^ "Browser Hijacking Fix & Browser Hijacking Removal". Microsoft. Retrieved 23 October 2012. 
  2. ^ Getting rid of Babylon Jay Lee, The Houston Chronicle, July 25, 2012
  3. ^ [:///2011/12/09/download_nmap_toolbar_row_latest/ sorry for bundling Nmap with crapware] The Register December 9, 2011
  4. ^ A note from Sean regarding the Installer December 7, 2011
  5. ^ "How to remove Search Protect by Conduit Ltd". Lavasoft. 2013-06-01. Retrieved 2013-10-12. 
  6. ^ "Bundle Your Software with a Custom Toolbar & Start Making Money". Conduit Ltd. 2013. Archived from the original on 2014-03-13. Retrieved 2013-10-12. 
  7. ^ "Download me II—Removing the remnants of the Web’s most dangerous search terms". Ars Technica. 2013-08-25. Retrieved 2013-10-12. 
  8. ^ "So long, uTorrent". First Arkansas News. 2010-12-15. Retrieved 2011-08-11. 
  9. ^ "Fixing BackgroundContainer.dll Left Over by Conduit Ltd". appuals. Retrieved 20 March 2015. 
  10. ^ "How To Remove Search Protect By Conduit Ltd". Lavasoft. Retrieved 3 December 2014. 
  11. ^ "Remove "Ads by Coupon Server" virus (Removal Guide)". Remove "Ads by Coupon Server" virus (Removal Guide). Stelian Pilic. Retrieved March 25, 2014. 
  12. ^ a b "Remove istartsurf". Retrieved 24 June 2010. 
  13. ^ Abrams, Lawrence. " Browser Hijacker Removal Guide". Retrieved 9 December 2013. 
  14. ^ "Browser Hijacker". MySearchCorp. Retrieved 3 July 2012. 
  15. ^ "How To Remove Snap.Do Browser Hijacker". Lavasoft. Retrieved 4 August 2014. 
  16. ^ "Remove Vosteran". How To Remove. Retrieved 25 November 2014. 
  17. ^ Mook, Nate (2006-09-06). "EarthLink Criticized for DNS Redirects". betaNews. Retrieved 9 May 2012. 

External links[edit]