Click on screenshot to zoom
Danger level 7
Type: Browser Hijackers
Common infection symptoms:
  • Hijacks homepage
  • Changes default search engine might give you the impression of a legitimate, safe, and reliable search engine but, the reality is that there is nothing safe or reliable about it. It is a malicious search engine that we have classified as a browser hijacker due to the way in which it is distributed. You should remove it if it were to secretly replace your browser’s homepage address because it was configured to show modified search results that can feature links to shady websites that can jeopardize your computer’s security if you click them. Not only that, but this hijacker was configured to collect information about you and use it to customize the ad campaign and maximize the developers’ profits.

We have received information that this hijacker’s developers have made arrangements to distribute it in malicious software bundles that inject it into your browser secretly. The websites that host software bundles that include this hijacker are not yet known, but this method of distribution does not surprise us in the least because that is how most browser hijackers are distributed. We have found that is hosted on the IP address which is located in the US. However, our analysis has shown that this hijacker is most popular in India, so we assume that it is distributed via free software distributing sites based in this country.

We think that this hijacker comes without a browser extension because it has several clones that include,, and that were also distributed without an extension. Hence, the bundled software installers were configured to perform the malicious action of injecting into your browser without your knowledge or approval.

This hijacker was configured to inject into your browser, provided that you use Google Chrome, Mozilla Firefox or Microsoft Internet Explorer. It was set to replace their homepage addresses and force you to use it as your main search engine. And, indeed, you can use it as a regular search engine, but there is a problem. Even though, it redirects all search queries through, it shows modified search results that can feature promotional links that might not be safe to click. Indeed, some of the links can be malicious and jeopardize your computer’s security because they can redirect you to scam sites or sites that feature malware downloads.

We also want to mention the fact that this browser hijacker can collect some anonymous information about you and use it to show customized and personalized promotional links. We believe that might have been configured to automatically collect non-personally identifiable information such as your browsing history, entered search queries, IP address, browser type, operating system type, and so on. While this information cannot be used for illicit purposes, it can be used to personalize and, thus, disguise promotional links as regular search results, so you might not want this malicious search engine keeping tabs on you.

In closing, is a highly malicious search engine that you can do without. It can hijack your browser and force you to use if for searching the web and you might not know that its search results were modified to show promotional links of unverified legitimacy that can prove to be dangerous to click. If you want to remove this hijacker, then please consult the instructions provided below this article.

How to replace your browser’s homepage

Google Chrome

  1. Hold down Win+E keys to open Windows Explorer.
  2. Enter C:\Users\{User name}\AppData\Local\Google\Chrome\User Data\Default in the address box.
  3. Hit Enter.
  4. Delete Secure Preferences, Preferences, and Web Data files.

Mozilla Firefox

  1. Hold down Win+E keys to open Windows Explorer.
  2. Type C:\Users\{User name}\AppData\Roaming\Mozilla\Firefox\Profiles in the address box and enter the randomly named folder (e.g. zzx2krkp.default-1431425175768)
  3. Search for the file named prefs.js and open it with Notepad.
  4. Locate and Delete in user_pref("browser.startup.homepage", "");

Microsoft Internet Explorer

  1. Hold down Win+R keys to open Run.
  2. Enter regedit in the window and click OK.
  3. Go to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  4. Then, look for Start Page on the right side of the window and double-click it.
  5. Replace the Value data with your preferred address and click OK.
  6. Close the Registry Editor.
Download Spyware Removal Tool to Remove*
  • Quick & tested solution for removal.
  • 100% Free Scan for Windows

Post comment — WE NEED YOUR OPINION!

Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.