ScaryBear Software

Get down-to-earth facts about the iStartSurf browser hijack, the processes that precede this infestation, and thoroughly verified removal instructions.

Those who never saw an adware program in action are lucky ones because this species of malicious software is an awful nuisance, making users feel entrapped and helpless. The annoyance part of adware activity is a mere side effect, while the main goal pursued is to make money through displaying sponsored information that gets rewarded at the end of the day.

A really demonstrative instance of this unwanted phenomenon is the iStartSurf infection. For clarity’s sake, imagine you launch your browser someday and instead of the web page that was configured to open right away – the homepage – a completely different URL is resolved for some reason. Strange, isn’t it? Well, what most users would do in this case is type the desired site’s address or title in the omnibox; oddly enough, this will only get them to the same wrong web page. How come? It’s easy to explain but tough to handle: you’ve got adware on board, and in the case of the threat in question, the homepage and the search provider now default to http://istartsurf.com. All attempts to retype the right URL in the respective browser settings interfaces have a zero effect because, again, you’re dealing with adware which will twist the configuration each time.

This malicious code is hardly ever installed by someone who is aware it’s a program called iStartSurf. A most frequently encountered workflow is bundling, which means this payload is attached to some free applications or bogus software updates.

Not only does this hijacker affect three major web browsers, it also distorts the web address line in the shortcut settings for different applications so that iStartSurf.com gets visited whenever these programs are launched on the infected machine. The web page mentioned above serves as a hub for further distribution of thus acquired traffic and also contains a number of ads on it. As you type in a search query on that landing page and hit Enter or click Search, you don’t stay on the same domain. A script reroutes you to a different search engine such as Google. This leads us to a takeaway that iStartSurf was not designed to be a genuine search system – it’s simply an ad-stuffed page that outsources users’ queries to a reputable provider of information lookup services. In the meanwhile, every ad view drops an additional few pennies to the makers of this adware.

The fix for iStartSurf browser problem is a matter of leveraging several removal vectors ranging from the Control Panel transactions all the way to shortcut settings cleanup and uninstalling the affiliated bad extension from the compromised browser.

iStartSurf removal with automatic cleanup tool

An optimal workflow for eliminating the iStartSurf virus is to leverage a security application which will identify all potentially malicious software on your computer and handle it the right way. This approach ensures thoroughness of the removal and system remediation, and allows avoiding unintended damage that might occur as a result of manual malware deletion.

1. Download and install iStartSurf removal software. Launch it and click the Start New Scan button. Wait for the application to check your computer for threats

2. When the app is done scanning your system, it will come up with an extensive list of detected objects. Click the Fix Threats option to have the utility completely remove this adware and affiliated infections found on your PC.

Uninstall troublemaking software through Control Panel

– Go to Start menu and select Control Panel on the list

– Click on the Add or Remove Programs (Uninstall a program) button

– Take a good look at the software list displayed. Search for iStartSurf proper or affiliated apps that were installed recently and prior to the hijack issues. These are usually free browser helper objects, Flash-related software, file format converters, media apps, dubious “critical” updates and the like. A list of these undesired apps is as follows: WPM, HQPure, supWPM, GlobalUpdate. When found, the culprit should be uninstalled

– Note that iStartSurf may not be listed on Control Panel therefore it may be problematic to figure out which particular program is associated with the virus in your case. If you are unsure, stick to the automatic cleanup advice and / or try the browser reset option described below.

Remove iStartSurf virus from compromised browsers

This part of the guide encompasses easy-to-follow steps required for terminating the activity of the adware under consideration on major web browsers it affects.

iStartSurf.com removal for MS Internet Explorer

– Go to Tools –> Manage add-ons

– When on the Manage add-ons interface, click on Search Providers in its left-hand section and select a service that you would like to use as your preferred engine by right-clicking it and picking Set as default option. Also, do not fail to eliminate iStartSurf from this list by selecting Remove in the context menu

– Click Toolbars and Extensions item on the same screen, find iStartSurf there and delete it through the same procedure as the one described in the previous step

– In order to set the preferred IE homepage, select Internet Options under Tools, then proceed to the General tab and type in the desired address under Home page instead of http://iStartSurf.com or http://www.iStartSurf.com

– To get the altered IE launch settings back to what they should be, right-click on the respective shortcut, select Properties, click on the tab called Shortcut and delete the entire string beginning with http://www.iStartSurf.com/ from the field that says Target. Save the changes

iStartSurf.com removal for Mozilla Firefox

– Type about:config in the address bar and hit Enter

– When Firefox comes up with the warranty alert, read it and click the confirmation button as shown on the image below

– Type istartsurf in the Search field and press Enter. Doing so will return en entire list of Firefox preferences associated with this adware. Right-click on every one of these entries and select Reset from the menu each time

– Firefox shortcut settings can be debugged by doing the following: right-click on it, pick Properties in the pop-under menu, hit the Shortcut tab, and erase http://www.iStartSurf.com/ along with all subsequent symbols. Save the changes made and exit

iStartSurf.com removal for Google Chrome

– Go to the Chrome Menu icon and pick Settings on the list

– Click on the Show advanced settings button

– Click on the button reading Reset browser settings

– On the notification box that pops up, review the consequences of Chrome reset and click Reset if it’s ok with you

– Making the Chrome shortcut settings right is doable in the following way: right-click on the shortcut and select Parameters. Proceed to the Shortcut tab (the middle one), find the Target field below, and delete http://www.iStartSurf.com/ from there. Be sure to save the changes before exiting

Double-checking never hurts

To make sure the iStartSurf hijacker has been removed, consider running an additional security scan as a completion of the cleanup procedure