Threat Database Browser Hijackers Safesear.ch Hijacker

Safesear.ch Hijacker

By Domesticus in Browser Hijackers

Threat Scorecard

Ranking: 7,408
Threat Level: 50 % (Medium)
Infected Computers: 34,626
First Seen: October 14, 2013
Last Seen: March 27, 2024
OS(es) Affected: Windows

Security analysts have observed browser hijackers associated with the Safesear.ch domain. These are typical adware or browser hijacker infections that take over affected Web browsers and force them to visit Safesear.ch repeatedly, as well as causing other symptoms on the affected Web browser. Usually, browser hijackers associated with Safesear.ch are Web browser toolbars or add-ons that may affect the most popular Windows Web browsers on the market. These are usually referred to as PUPs, Potentially Unwanted Programs, and are not considered as unsafe or destructive as trojans, viruses, or other forms of threats. However, this does not mean that PUPs associated with Safesear.ch are not a problem; their irritating symptoms and intrusive tactics may interfere with normal usage of the affected computer. Because of this, PUPs associated with Safesear.ch should be removed right away from the infected computer.

The Various Unwanted Actions Performed by Safesear.ch and Its Associated PUPs

There are several reasons why PC security researchers consider that Safesear.ch and its associated PUPs represent a potential danger to your computer. These include the following:

  1. PUPs associated with Safesear.ch cause browser redirects. This means that the affected Web browser is forced to visit Safesear.ch repeatedly in order to boost this website's traffic and page ranking.
  2. PUPs associated with Safesear.ch cause the appearance of irritating pop-up windows. These may contain advertising or marketing material that is intrusive and poorly regulated. These are particularly worrying because they may expose your computer to unreliable forms of threats or to known online scams.
  3. Browser hijackers linked to Safesear.ch may also cause the Safesear.ch website to appear.
  4. Many computer users have complained that these types of PUPs make unauthorized changes to the affected Web browser. Some of the most common changes include altering the affected Web browser.
  5. Toolbars and adware related to Safesear.ch are able to follow the course of your online activity and search history, tracking this information for use in marketing and to deliver advertisements to your Web browser.

SpyHunter Detects & Remove Safesear.ch Hijacker

File System Details

Safesear.ch Hijacker may create the following file(s):
# File Name MD5 Detections
1. manager.exe 9334e382c91e61c9b76004899c0d31ee 19,789
2. manager.exe fb886e83224a004d23efd871b67497ab 3,689
3. manager.exe eaf32af23d90494efd69fbee86c05a33 93

Registry Details

Safesear.ch Hijacker may create the following registry entry or registry entries:
CLSID
{A7D53A0C-8D59-5C09-B2C9-747344531055}
{D52A5776-1B1D-5341-816B-0578116A2B37}
{EB5BA3FA-8132-5857-A0F8-2534CB842257}
Regexp file mask
%LOCALAPPDATA%\NSManager\manager.exe
%PROGRAMFILES%\Like\Like.dll
%PROGRAMFILES%\Mozilla Firefox\browser\searchplugins\safesearch.xml
%PROGRAMFILES(x86)%\Like\Like.dll
%PROGRAMFILES(x86)%\Mozilla Firefox\browser\searchplugins\safesearch.xml
%UserProfile%\Local Settings\Application Data\NSManager\manager.exe
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\safesear.ch
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\safesear.ch
SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.safesear.ch
Software\Classes\MIME\Database\Content Type\application/x-avs-safesearch
Software\Microsoft\Internet Explorer\DOMStorage\safesear.ch
Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\safesear.ch
Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f66635a8-9629-5d06-9a76-d8c57f5ad806}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{f66635a8-9629-5d06-9a76-d8c57f5ad806}
SOFTWARE\Mozilla\Firefox\Extensions\{jid1-vS7biDmom8YxhA@jetpack}
SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{jid1-vS7biDmom8YxhA@jetpack}

URLs

Safesear.ch Hijacker may call the following URLs:

domecontain.com
https://safesear.ch/
pairsavvy.com
varietyconstant.com

Trending

Most Viewed

Loading...