A browser hijacker is a form of malware or spyware that replaces the existing internet browser home page, error page, or search page with its own. These are generally used to force hits to a particular website.
Contents |
Morwill Search is a browser hijacker that is implemented as IE Browser Helper Object. This spyware redirects browser searches to morwill search engine or some other search engines.
CoolWebSearch (CWS) was one of the first browser hijackers. It redirected the existing home page to the rogue CWS search engine, with its results as sponsored links. With most antivirus and antispyware programs unable to properly remove this particular hijacker, a man named Merijn Bellekom developed a special tool called CWShredder specifically to remove this hijacker. Cool websearch is a popular browser hijacker and is owned by fun web products.
Another common browser hijacker that became popular in 2009-2010.
Search-daily.com is a hijacker that may be downloaded by the Zlob trojan. It redirects the user's searches to pornography sites. It also is known to slow down computer performance.
Many people believe that browser hijackers were designed for simple annoyance. Most hijackers redirect a page to force hits to their websites which contain ads. This then drives up the advertising cost for that website, thus profiting the site's webmaster.
Malware and many trojans have many marketing uses. This malicious software can hijack your browser even adding exceptions to your browsers security settings and pop up blockers. Most malware software is picked up with something so simple as opening an email or clicking a link. Be aware of ALL links and the content of the URL that you click. Many of us still will click a link without even looking at the URL its destined for. Awareness is your first line of defense when browsing the web.
However in some cases the hijack is being done without the knowledge of the website. The webmaster sets up an account on an advertising platform (where they pay for traffic to be directed to their site via legitimate means—just like Google adWords) and a hijacker starts forcing traffic to that page so the website owners have to pay money each time a user arrives at the page. In this case the hijacker is making money, however the website the user is being forced toward is actually losing a lot of money.
Most new hijackers will not allow a user to change back to their home page through Internet Properties. Modern hijackers' settings will most likely return upon reboot, however, well-updated antispyware software will likely remove the hijacker. Some spyware scanners have a browser page restore function to set your page back to normal or alert you when your browser page has been changed.
Some rogue security software will also hijack the start page generally displaying a message such as "WARNING! Your computer is infected with spyware!" to lead to an anti-spyware vendor's page. The start page will return to normal settings once the user buys their software. Programs such as WinFixer are known to hijack the user's start page and redirect it to the website.
In 2006, Earthlink started redirecting mistyped domain names over to a search page. This was done by interpreting the error code NXDOMAIN at the server level. The announcement led to much negative feedback, and Earthlink offered services without this feature.