Removal Guide
THREAT REMOVAL Removal Guide redirect removal

The redirect is a new browser hijacker that is actively being used to infect users worldwide. The malware code retrieves personal data from the victims and can institute additional threats to the compromised hosts.

Threat Summary
TypeBrowser Hijacker, PUP
Short DescriptionThe redirect is a typical example of a hijacker that redirects the users to a hacker-controlled site and can cause dangerous system changes to the infected computer.
SymptomsThe redirect code changes the default home page, search engine and new tabs page to point to the hacker-controlled page.
Distribution MethodFreeware Installations, Bundled Packages
Detection Tool See If Your System Has Been Affected by


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss – Delivery Techniques

The redirect infections are primarily caused by using the most popular delivery tactics employed by the hacker controllers. Such malware are usually part of malware browser plugins that are found on the software repositories. The hackers behind the threats utilize fake developer credentials and user reviews in order to infect as many users as possible.

Email messages constitute the other option used by the hackers which is usually made in two distinct forms. The first one relies on malware hyperlinks inserted in the body contents of the messages. They coerce the targets into clicking on them by posing as password reset links, notifications or other messages that are frequently sent by web services. In a lot of cases the hacker developers hijack text and graphics from popular sites in order to manipulate the users into interacting with the malware element. The other tactic uses file attachments that are sent directly to the users.

In a similar way the malware files can be hosted on download sites and file sharing networks such as BitTorrent.

In the past few months we have detected that more and more criminals rely on the use of two additional tactics.

The first one relies on the inclusion of the malware code in software installers. The way they ar is made by takin the legitimate installers from the official vendor sites and bundling them with the dangerous code. The resulting file is then uploaded to download sites or BitTorrent trackers. The redirect malware can also be bundled within documents as well. They can be of different types (rich text documents, spreadsheets or presentations) and once they are opened a notification prompt is spawned which asks the victims to run the built-in code (macros). This leads to the actual infections. – More Details

The redirect follows the typical behavior tactics that make it compatible with the most popular web browsers: Microsoft Edge, Internet Explorer, Opera, Safari, Google Chrome and Mozilla Firefox. Such threats are modeled to harvest sensitive user and system information. This is usually done by introducing a tracking cookie and other web beacons.

Once the users open up their browsers the next time they will notice that the home page, search engine and new tabs page will be changed to reflect the malware page. Such changes are part of the malware’s instructions.

The instituted tracking components relay sensitive information about the infected hosts that is usually classified in two major groups:

  • Personally-Identifiable Data — The computer criminals can use the harvested data to directly expose the victims identity. This includes data such as names, addresses, telephone numbers, preferences, account credentials and passwords.
  • Anonymous Data — This information consists mainly of data related to the operating system: version information, available hardware components and etc. redirect infections can also be used to deploy additional malware as a first stage delivery mechanism — ransomware, Trojans and other advanced computer threats.

The site is designed using a typical site template that poses as a search engine. It is dominated by a search engine box in the center with a small logo above it and two options — text and image search. On the bottom bar there are links to the privacy policy and terms of use documents.

All interaction with the malware site leads to a profile building operation. Using the information gathering technology the redirect code will create a full profile of the user which may include demographic and sensitive data that is pooled into a large database. Such sites are usually created in groups and are part of a whole network operated by a single company. The collected data is then usually sold to marketing agencies and other interested parties for profit. As a result all user searches and interactions will be recorded.

We also warn that browser hijackers are a popular mechanism for spreading malware scripts. The sites may redirect the users to false pages, ads, banners, pop-ups. A popular tactic is to insert affiliate links in e-commerce sites which generates income for the hackers every time the victims purchase something on the Internet. – Privacy Policy

The privacy policy reads that the redirect is operated by a company called Coinup Ltd. It lists that the service is hosted on a Microsoft Cloud account. No further information is revealed about the company (such as their contact details) which is highly suspicious.

The documents list that upon the first site visit the user automatically give their consent to share sensitive data with the site. Cookies and other web technology are deployed automatically. The following types of data are collected by the malware:

  • Your Name
  • Your Email address
  • Time and date you access and use the Service
  • Approximate geographical location
  • Internet Service Provider (ISP)
  • IP address
  • Preferred language
  • Preferred search settings
  • Browser type
  • Operating system type
  • Other Data you provide

How to Remove Redirect

Below are listed all the steps that will help you to remove redirect completely from an affected Chrome, Mozilla, Explorer, or Safari browser. The guide includes steps that reveal how to remove the nasty program from the Windows system as well. You can choose whether to follow a manual or an automatic removal. However, you should know that the manual instructions are not always enough to eliminate the infection as some leftovers may remain on the system. As a result, you may still experience redirects to website while browsing the net. Maximum efficiency can be achieved with the help of an advanced anti-malware tool as it can quickly locate all leftovers.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share