Referral spam caused by a suspicious redirecting domain, known as Googlemare(.)com has been reported to advertise a suspicious Firefox plugin that may collect various information from users. The referral spam can quickly corrupt Google Analytics data and affect users with a browser hijacker leading to a website called iLoveVitaly(.)com. The plugin changes Mozilla Firefox’s home page to iLoveVitaly(.)com and uses browser redirects. All users who have been affected by this nasty browser extension should immediately remove it from their computers.
|Name||IloveVitaly(.)com Browser Hijacker|
|Short Description||Sets hoax search engine as a home page and new tab page..|
|Symptoms||The user may witness online advertisements, browser redirects and PC slow-down.|
|Distribution Method||Via Referral Spam or bundled programs|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by IloveVitaly(.)com Browser Hijacker|
|User Experience||Join our forum to discuss IloveVitaly(.)com Browser Hijacker.|
IloveVitaly(.)com Browser Hijacker – How Is It Spread
The suspicious browser extension is distributed via Googlemare(.)com referral spam links. The referral spam may be either Ghost Referral or Web Crawler. The spam messages feature a web link whose host Is classified as a spam domain, called Googlemare(.)com.
The spam messages may redirect to the following web page:
The suspicious browser extension, called Google Improver may offer the user to set iLoveVitaly(.)com as a home page. In case you meet the questionable extension somewhere else, it is strongly recommended to keep away from it.
IloveVitaly(.)com Browser Hijacker – Description
Once installed on the user’s Mozilla Firefox, the Google Improver plugin begins to use different tracking technologies. One of them is a unique identifier, preventing the application to install twice, hence the pop-up below:
Other technologies used to collect user information may be pixels, cookies, tags, etc. and they are used by the extension most likely to display various advertisements to user PCs.
Furthermore, if the plugin is installed without adding the questionable website, it may begin to display ads and it causes a redirect to the following web link:
After this it redirects back to Google. This is most likely to obtain browser information, and all users who have installed the suspicious extensions may not be able to see it in Firefox’s plugins or extensions.
If the hoax search engine is somehow set as a homepage, similar to other hijackers like Sugabit(.)net it displays the following web page:
The web page claims to be a service to stop “Google greed” in the following message:
→“o-o-8-o-o prOject is the search shell from seal aviator with google search without greed, sites opening by only one first letter, and with a wide choice of search engines, torrent trackers, bookmarks to favorite websites and every time a new picture to set the mood. Beat with a shovel the weak google spots! Details about google greed, how it steals your time and how to cure it. To begin just enter text for search here and press Enter or Find or Download button.”
Furthermore, the search engine does not have encrypted connection, and this is something that is highly untypical for search engines. The search engine is also a hoax one, displaying search results from Google. Also, it contains numerous web links to various websites that may or may not be phishing ones.
Removing IloveVitaly(.)com Browser Hijacker Completely
To get rid of IloveVitaly(.)com you should know that the application may not be available for removal using conventional methods. This is why it is advisable to employ a specific anti-malware software. Installing such program will also stop further programs of such character from intruding your device.