Click on screenshot to zoom
Danger level 7
Type: Browser Hijackers
Common infection symptoms:
  • Hijacks homepage
  • Changes default search engine might look like a regular search tool, but, in reality, it is a browser hijacker that is likely to corrupt your browser’s homepage without your permission. Based on the tag at the bottom of the hijacker’s home page, it is most likely that it comes packaged with the BetterNewtab extension. An official website representing this extension does not exist, which means that the hijacker is not introduced to users in an official manner either. Unfortunately, it is quite possible that you have faced this suspicious software as you were interacting with a third-party installer offering multiple programs at the same time. Legitimate software bundles exist, but malicious ones exist as well, and it is possible that you have encountered one of those if the hijacker has managed to take over your web browser. Whether you only need to remove or a bunch of different unreliable programs at the same time, we are here to assist you. Please read the report carefully, and if questions come up while reading, use the comments section to start a discussion.

Imali Media is the alleged developer of It is also linked to,,, and other known hijackers that we advise deleting as well. It is possible that one company is responsible for all hijackers and extensions, but it is more likely that Imali Media has simply provided different developers with a platform that enables them to produce identical-looking software. According to our researchers, Imali hijackers are usually spread via unreliable file-sharing sites, and you should be especially cautious about the installers found on,,,, and similar websites. Potentially unwanted programs and dangerous malware could be bundled along with the hijacker, and you have to be very careful about those. Even if you do not see malware, we advise examining your operating system with a legitimate malware scanner to check if clandestine infections have managed to slither in along with If they have, remove them as soon as possible, before they initiate malicious activity. One thing to note is that bogus malware scanners exist, and, of course, you need to install a reliable one to know for sure which threats require removal and which ones are harmless.

The interface of is truly boring, and the only tool is the search dialog box in the center. If you enter search keywords into this box, you will be redirected to Google Search. Do not rush to assume that this is a good thing. Although this search provider might be familiar to you, the results shown could be modified to include the links that Imali Media was paid to promote, and they could be unreliable. Considering that the only feature of the hijacker is worthless, we are sure that you already realize that it is best to remove it from your browser. There is one more reason to do that: can record personally identifiable information. There is no denying that this infection is suspicious and unpredictable, and we are sure that you do not want it collecting data about you, even if it is not personally identifiable. Keep in mind that the data trackers employed by this infection could remain active even after you delete it. Due to this, we strongly recommend clearing the cache and erasing the cookies. To do that, open the infected browser and tap keys Ctrl+Alt+Delete. Next, select the data you want to clear and then confirm your choice. This works on all browsers.

You do not need a lot of knowledge or previous experience to delete from your web browser. Of course, we advise eliminating the BetterNewtab extension first because that might automatically disable the hijacker as well. Chrome users can erase it via the “chrome://extensions/” menu, Firefox users can operate via the “about:addons” menu, and IE users might have to uninstall the app via Control Panel. If that does not do the trick, follow the instructions below to overwrite the undesirable homepage URL. We also have to remind you that other threats might have corrupted your PC. Due to this, we suggest scanning your computer beforehand. If you discover threats that you can eliminate yourself, do not waste any time. If you discover complex malware, install anti-malware software for automatic removal instead. Removal

Google Chrome:

  1. Simultaneously tap Win+E to access Windows Explorer.
  2. Type %LocalAppData%\Google\Chrome\User Data\ into the box at the top and tap Enter.
  3. If multiple profiles exist, open your {unique Chrome profile name} folder. Otherwise, move to Default.
  4. Delete the files called Preferences, Secure Preferences, and Web Data. Alternatively, you can open these files with a text reader and overwrite the hijacker’s URL in them.

Mozilla Firefox:

  1. Simultaneously tap Win+E to access Windows Explorer.
  2. Type %AppData%\Mozilla\Firefox\Profiles\ into the box at the top and tap Enter.
  3. Open your {unique Firefox profile name} folder and then open the file named prefs.js.
  4. Overwrite the hijacker’s URL and then save the file.

Internet Explorer:

  1. Simultaneously tap Win+R to access RUN.
  2. Enter regedit.exe into the dialog box and click OK to launch Registry Editor.
  3. In the pane on the left navigate to HKCU\Software\Microsoft\Internet Explorer\Main.
  4. Right-click the value named Start Page and select Modify.
  5. Overwrite the hijacker’s URL and click OK.
  6. Navigate to HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.
  7. Open the value (repeat with all values listed below), overwrite the hijacker’s URL, and click OK.
    • FaviconURL
    • FaviconURLFallback
    • TopResultURL
    • URL
Download Spyware Removal Tool to Remove*
  • Quick & tested solution for removal.
  • 100% Free Scan for Windows

Post comment — WE NEED YOUR OPINION!

Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.