Topsafetab.com hijacking your homepage ? Topsafetab.com is a browser hijacker that changes browser’s settings such as homepage and search provider.
Name: Topsafetab.com
Type: Adware/Browser Hijacker
Danger Level: Low/Medium
Symptoms: browser opens search.topsafetab.com, redirects to random websites, a lot of asnnoying ads
Distribution Method: Topsafetab.com browser hijacker is integrated into the installation package of various free programs
HijackThis may show infection:
R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.topsafetab.com/{param}
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.topsafetab.com/{param}
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.topsafetab.com/{param}
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.topsafetab.com/{param}
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.topsafetab.com/{param}
R0 – HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.topsafetab.com/{param}
R0 – HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://search.topsafetab.com/{param}
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = hxxp://search.topsafetab.com/{param}
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = hxxp://search.topsafetab.com/{param}
O4 – HKCU\..\Run: [xxx] explorer.exe hxxp://search.topsafetab.com/{param}
FRST may show infection:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.topsafetab.com/{param}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.topsafetab.com/{param}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.topsafetab.com/{param}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.topsafetab.com/{param}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = hxxp://search.topsafetab.com/{param}
HKU\{clsid}\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.topsafetab.com/{param}
SearchScopes: HKU\{clsid} -> {clsid} URL = hxxp://search.topsafetab.com/{param}
StartMenuInternet: IEXPLORE.EXE – C:\Program Files\Internet Explorer\iexplore.exe hxxp://search.topsafetab.com/{param}
CHR HomePage: Default -> search.topsafetab.com/{param}
CHR DefaultSearchURL: Default -> hxxp://search.topsafetab.com/{param}
CHR DefaultSearchKeyword: Default -> search.topsafetab.com
CHR DefaultSuggestURL: Default -> hxxp://search.topsafetab.com/{param}
