Вредоносное ПО: Перехват браузера и его последствия

Form of unwanted software
Browser hijacking is a form of unwanted software that modifies a web browser's settings without a user's permission, to inject unwanted advertising into the user's browser. A browser hijacker may replace the existing home page, error page, or search engine with its own. These are generally used to force hits to a particular website, increasing its advertising revenue. Some browser hijackers also contain spyware, for example, some install a software keylogger to gather information such as banking and e mail authentication details. Some browser hijackers can also damage the registry on Windows systems, often permanently. While some browser hijacking can be easily reversed, other instances may be difficult to reverse. Various software packages exist to prevent such modification. Many browser hijacking programs are included in software bundles that the user did not choose and are included as "offers" in the installer for another program, often included with no uninstall instructions, or documentation on what they do, and are presented in a way that is designed to be confusing for the average user, to trick them into installing unwanted extra software. There are several methods that browser hijackers use to gain entry to an operating system. Email attachments and files downloaded through suspicious websites and torrents are common tactics that browser hijackers use.

Some rogue security software will also hijack the start page, generally displaying a message such as "WARNING! Your computer is infected with spyware!" to lead to an antispyware vendor's page. The start page will return to normal settings once the user buys their software. Programs such as WinFixer are known to hijack the user's start page and redirect it to another website.

The Domain Name System is queried when a user types in the name of a website (e. g., wikipedia. org) and the DNS returns the IP address of the website if it exists. If a user mistypes the name of a website then the DNS will return a Non Existent Domain (NXDOMAIN) response. In 2006, EarthLink started redirecting mistyped domain names over to a search page. This was done by interpreting the error code NXDOMAIN at the server level. The announcement led to much negative feedback, and EarthLink offered services without this feature.

Unwanted programs often include no sign that they are installed, and no uninstall or opt out instructions.

A number of hijackers change the browser homepage, display adverts, and/or set the default search engine; these include Astromenda (www. astromenda. com); Ask Toolbar (ask. com); ESurf (esurf. biz) Binkiland (binkiland. com); Delta and Claro; Dregol; Jamenize; Mindspark; Groovorio; Sweet Page; Mazy Search; Search Protect by Conduit along with search. conduit. com and variants; Tuvaro; Spigot; en.4yendex. com; Yahoo; etc.

Babylon Toolbar is a browser hijacker that will change the browser homepage and set the default search engine to isearch. babylon. com. It is also a form of adware. It displays advertisements, sponsored links, and spurious paid search results. The program will collect search terms from your search queries. Babylon's translation software prompts to add the Babylon Toolbar on installation. The toolbar also comes bundled as an add on with other software downloads. In 2011, the CNet site Download. com started bundling the Babylon Toolbar with open source packages such as Nmap. Gordon Lyon, the developer of Nmap, was upset over the way users of his software were tricked into using the toolbar. The vice president of Download. com, Sean Murphy, released an apology: The bundling of this software was a mistake on our part and we apologize to the user and developer communities for the unrest it caused. Similar variants of the Babylon toolbar and search homepage exist including: Bueno Search, Delta Search, Claro Search, and Search GOL. All of these variants state to be owned by Babylon in the terms of service. All of the toolbars were created by Montiera.

Conduit is a PUP / hijacker. It steals personal and confidential information from the user and transfers it to a third party. This toolbar has been identified as Potentially Unwanted Programs (PUPs) by Malwarebytes and is typically bundled with free downloads. These toolbars modify the browser's default search engine, homepage, new tab page, and several other browser settings. There are similar variants of conduit search such as trovi. com, trovigo. com, better search. net, seekforsearch. com, searchitdown. com, need4search. com, clearsearches. com, search armor. com, searchthatup. com, premiumsearchweb. com, along with other variants which were created in a customized way for the toolbar creation service Conduit Ltd used to offer. A program called "Conduit Search Protect", better known as "Search Protect by conduit", can cause severe system errors upon uninstallation. It claims to protect browser settings but actually blocks all attempts to manipulate a browser through the settings page; in other words, it makes sure the malicious settings remain unchanged. Search Protect has an option to change the search homepage from the "recommended" search home page Trovi, however, users have reported it changing back to Trovi after a period of time. The uninstall program for Search Protect can cause Windows to be unbootable because the uninstall file not only removes its own files, but also all the boot files in the root of the C: drive. and leaves a BackGroundContainer. dll file in the start up registry. Conduit is associated with malware, spyware, and adware, as victims of this hijacker have reported unwanted pop ups and embedded in text advertisements, on sites without ads. Perion Network Ltd. acquired Conduit's ClientConnect business in early January 2014, and later partnered with Lenovo to create Lenovo Browser Guard, which uses components of Search Protect. Victims of unwanted redirections to conduit. com have also reported that they have been attacked by phishing attempts and have received unwanted email spam, junk mail, other messages, and telephone calls from telemarketers. Some victims claim that the callers claimed to be Apple, Microsoft, or their ISP, and are told that personal information was used in some phone calls, and that some of the calls concerned their browsing habits and recent browsing history. Personal information used in phishing attempts may be associated with spyware.

The browser hijacker istartsurf. com may replace the preferred search tools. This infection travels bundled with third party applications and its installation may be silent. Due to this, affected users are not aware that the hijacker has infected their Internet Explorer, Google Chrome or Mozilla Firefox browsers.

Search daily. com is a hijacker that may be downloaded by the Zlob trojan. It redirects the user's searches to pornography sites. It is also known to slow down computer performance.

A previous installer of SourceForge included adware and PUP installers. One particular one changes the browser settings of Firefox, Chrome and Internet Explorer to show the website "istartsurf. com" as the homepage. It does so by changing registry settings and installing software which resets the settings if the user tries to change them. On June 1, 2015, SourceForge claimed that they stopped coupling "third party offers" with unmaintained SourceForge projects.

Vosteran is a browser hijacker that changes a browser's home page and default search provider to vosteran. com. This infection is essentially bundled with other third party applications. The identity of Vosteran is protected by privacyprotect. org from Australia. Vosteran is registered through Whiteknight.

It can be found when installing "Cheat Engine" or a different version of "VLC Player" on www. oldapps. com, or when downloading applications from certain freeware sites, such as Softonic. com or Download. com. Trovi uses Bing (a legitimate search engine) to provide results to the user. Although the address bar changes to Bing. com when showing search results, search keywords are executed through Trovi regardless. Trovi formerly used its own website to show search results with the logo at the top left hand corner of the page but later switched to Bing in attempt to fool users more easily. Trovi is not as deadly as before with taking the ads out of the search results depending on what browser is being used, but is still considered a browser hijacker. It also controls the homepage and new tab page settings to prohibit the ability to change them back to the original settings. Depending on whatever browser is being used, ads may appear on the page. When it infects, it makes a browser redirect from Google and some other search engines to trovi. com. Trovi was created using the Conduit toolbar creation service and has known to infect in similar ways to the Conduit toolbar.