Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Safesearch4.ru Redirect Remove It from Your PC

safesearch-ru-homepage-sensorstechforumA hoax browser search engine has been detected by malware researchers several days ago. The search engine exhibits a strange behavior and has the ability to display advertisements, modify web browser settings and also display advertisements that may turn out to be harmful. Since Safesearch4.ru is classified as a potentially unwanted program and is together with what many refer to a browser hijacker. Users who see the homepage of Safesearch4.ru are advised to immediately take down this PUP using the information provided in this article.

Threat Summary

Name Safesearch4.ru hijacker
Type Browser Hijacker, PUP
Short Description Each browser application on your computer can be affected. The hijacker will redirect you and show various advertisements.
Symptoms Browser settings which could be modified are the homepage, the search engine and the new tab window.
Distribution Method Freeware Installations, Bundle Packages
Detection Tool See If Your System Has Been Affected by Safesearch4.ru hijacker

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss Safesearch4.ru hijacker.

How Did I Get Safesearch4.ru Hijacker

The most likely method that may have gotten the suspicious web page to open every time you start Chrome, Firefox or Internet Explorer is called bundling. Since it is very similar to another hijacker – Safesearch1.ru, it involves the adding of indirectly dangerous programs like Safesearch4.ru on the computer of the user disguised “as free extras”. These programs are also known as fake “helpers”, apps that aim to improve the online experience, like seemingly useful toolbars and other forms. Such bundled installers may be downloaded without the user realizing they are bundled. Usually this happens when third-party websites who provide widely downloaded freeware, like well-known media players, torrent programs and even antivirus programs, ironically enough. These websites make money by including the free installers of those fake helpers in the form of either an installation step having a convincing statement as if the app is a part of the installation process:

  • “Add Safesearch4.ru to improve your browsing experience.”
  • “Insall Safesearch toolbar utility to help you find what you are looking for faster”.

Since these type of threats are classified as low-level, antivirus programs may do nothing to stop them, because of their sheer size in numbers. This is why users are advised to use advanced tools for removing them.

Safesearch4.ru Hijacker – More Information

When it has been successfully situated onto an affected computer, the hijacking software begins to modify Windows Registry Entries heavily. It may primarily target the subkeys of the web browsers that are installed on a given PC, for example:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
HKEY_CURRENT_USER\Software\Vendor\Name\Extensions
HKEY_LOCAL_MACHINE\Software\Vendor\Name\Extensions
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Vendor\Name\Extensions
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions
HKEY_CURRENT_USER\Software\Mozilla\Thunderbird\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Thunderbird\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Thunderbird\Extensions
HKEY_CURRENT_USER\Software\MozillaPlugins\plugin-id
HKEY_LOCAL_MACHINE\Software\MozillaPlugins\plugin-id

The modifications of those subkeys and the values in them as well as some other tweaks may change the home page of the web browser to the default home page of Startsearch4.ru:

safesearch-ru-homepage-sensorstechforum

The page Startsearch4.ru itself is nothing special. For starters, it is created to faintly resemble Google and includes Google Custom Search which is essentially a searching service by google, indicating the search engine does not have it’s original searching database. In addition to this, the search engine also does not possess it’s own custom HTTPs encryption which is a strong indicator that the software is a hoax search engine due to the fact that most official search engines are properly secured.

Another very suspicious behavior the suspicious hijacker connected with Startsearch4.ru exhibited was that it uses cookies to collect different information, like:

  • Search history.
  • Online clicks.
  • Banners.
  • Possibly user information, if entered.

safesearch-ru-cookies-sensorstechforum

The software also does not have a privacy policy which increases the risk of using Safesearch4.ru, because it may be the opposite of safe. Another indicator that the program is solely created for the interests of it’s owner is that it displays ad-supported search results that may be based on what you search, here is what we received when searching for something online:

ad-supported-search-results

In addition to that, Safesearch4.ru also advertises third-party software with a suspicious character directly on it’s home page.

toolbar-start-ad-sensorstechforum

Safesearch4.ru – Conclusion and Removal Instructions

As a bottom line, the suspicious Safesearch4.ru search engine is an indicator that your computer is at risk. It may display advertisements that lead to dangerous websites that may either be scamming or directly infect your computer with malware.

Not only this, but Safeseaarch4.ru is primarily created for profit, this is why it may cause multiple redirects or advertisements in other forms to generate traffic to hoax websites or generate funds via pay-per click or other schemes.

This is why it is strongly advisable to remove Safesearch4.ru hijacker from your computer in full. To do this, you should follow the instructions which we have posted below. They are carefully designed to guide you in removing this PUP manually and if you do not have the experience or the time, automatically with a specific anti-malware tool.

Manually delete Safesearch4.ru hijacker from Windows and your browser

Note! Substantial notification about the Safesearch4.ru hijacker threat: Manual removal of Safesearch4.ru hijacker requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Remove or Uninstall Safesearch4.ru hijacker in Windows
2. Remove Safesearch4.ru hijacker from Your Browser and Your Registry Editor

Automatically remove Safesearch4.ru hijacker by downloading an advanced anti-malware program

1. Remove Safesearch4.ru hijacker with SpyHunter Anti-Malware Tool and back up your data
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.