May 11, 2016 • no comments

How to remove OurSurfing.com redirect virus

What is OurSurfing.com?

OutSurfing.com is a shady search page that shouldn’t be trusted. The page appears without user’s permission and does everything possible to redirect people on affiliate sites. For this the malware takes the control over browsers and replaces main pages and search engines with its own after which it blocks the settings change. Additionally the hijacker can initiate random redirections, which are hard to avoid and predict. And finally it may imitate system notifications and survey pop-ups to raise users’ interest and make them click these messages, which once again will cause redirections. Since there is a possibility that such forwardings will lead to infected sites, it’s wise to remove OurSurfing.com hijacker as soon as possible.

OurSurfing.com page

How OurSurfing.com got installed on your computer?

In the majority of cases, if you have OurSurfing.com hijacker it means that you’ve got it during the recent installation of freeware. Even if the applications that you’ve downloaded are not malicious, they still can carry a few additional installations that will bring malware to your system. That is the reason why we recommend paying attention to the information presented in setup wizard. The most important things you should hold to are choosing Advanced mode over Default one, thorough reading the EULA, and not accepting complementary elements until you are 100% sure in their safety.

Symptoms of OurSurfing.com infection

  • First and the most striking proof of having a browser hijacker is change of the main page. Usually it is a search engine page that is designed so that user would believe in its legitimacy.
  • Generally, hijackers cause redirections when user makes a search query on its page or tries to reach a blocked site (usually another search engine or anti-malware sites)
  • Another indicator of hijacker infection is appearance of new programs, toolbars and browser extensions that you don’t remember installing and processes in start-up queue.
  • Also, you may notice the significant slowdown in the system operating, since running of the applications required for malware activity may consume a lot of CPU.
  • Besides, hijacker infection may as well negatively affect the speed of Internet connection.

How to remove OurSurfing.com?

To make sure that the hijacker won’t appear again, you need to delete OurSurfing.com completely. For this you need to remove the application from the Control Panel and then check the drives for such leftovers as OurSurfing.com files and registry entries.
We should warn you that performing some of the steps may require above-average skills, so if you don’t feel experienced enough, you may apply to automatic removal tool.

Download SpyHunter

Performing an antimalware scan with Norton would automatically search out and delete all elements related to OurSurfing.com. It is not only the easiest way to eliminate OurSurfing.com, but also the safest and most assuring one.

Steps of OurSurfing.com manual removal

Uninstall OurSurfing.com from Control Panel

As it was stated before, more likely that the hijacker appeared on your system brought by other software. So, to get rid of OurSurfing.com you need to call to memory what you have installed recently.

How to remove OurSurfing.com from Windows XP

  1. Click the Start button and open Control Panel
  2. Go to Add or Remove Programs
  3. Find the application related to OurSurfing.com and click Uninstall

How to remove OurSurfing.com from Windows 7/Vista

  1. Click the Start button and open Control Panel
  2. Go to Uninstall Program
  3. Find the application related to OurSurfing.com and click Uninstall

How to remove OurSurfing.com from Windows 8/8.1

  1. Right-click the menu icon in left bottom corner
  2. Choose Control Panel
  3. Select the Uninstall Program line
  4. Uninstall the application related to OurSurfing.com

How to remove OurSurfing.com from Windows 10

  1. Press Win+X to open Windows Power menu
  2. Click Control Panel
  3. Choose Uninstall a Program
  4. Select the application related to OurSurfing.com and remove it

noteIf you experience problems with removing OurSurfing.com from Control Panel: there is no such title on the list, or you receive an error preventing you from deleting the application, see the article dedicated to this issue.
Read what to do if program won’t uninstall from Control Panel

Remove OurSurfing.com from browsers

Since some of hijacker threats use a disguise of a browser add-on, you will need to check the list of extensions/add-ons in your browser.

How to remove OurSurfing.com from Google Chrome

  1. Start Google Chrome
  2. Click on Tools, then go to the Extensions
  3. Delete OurSurfing.com or other extensions that look suspicious and you don’t remember installing them

How to remove OurSurfing.com from Internet Explorer

  1. Launch Internet Explorer
  2. Click on the Tools/Gear icon, then select Manage Add-ons
  3. Delete OurSurfing.com or other extensions that look suspicious and you don’t remember installing them

How to remove OurSurfing.com from Mozilla Firefox

  1. Start Mozilla Firefox
  2. Click on the right-upper corner button
  3. Click Add-ons, then go to Extensions
  4. Delete OurSurfing.com or other extensions that look suspicious and you don’t remember installing them

How to remove OurSurfing.com from Microsoft Edge

  1. Start Microsoft Edge
  2. Click the three-dot button in the upper right corner
  3. Choose Extensions
  4. Click the gear icon near OurSurfing.com or other extensions that look suspicious and you don’t remember installing them
  5. Choose Remove

Reset your browsers

How to reset settings in Google Chrome

  1. Click on the icon in the right-upper corner
  2. Choose Settings
  3. Click Show advanced settings
  4. Click the Reset Settings button

How to reset settings in Mozilla Firefox

  1. Click the icon in the upper right corner
  2. Choose Help
  3. Select Troubleshooting Information
  4. Click the Reset Firefox… button

How to reset settings in Internet Explorer

  1. Click on the Tools button
  2. Go to Internet options
  3. Go to the Advanced tab
  4. Click Reset

How to reset settings in Microsoft Edge

  1. Start Microsoft Edge
  2. Click the three-dot button in the upper right corner
  3. Choose Settings
  4. Under the Clear browsing data category select Choose what to clear
  5. Select everything and click Clear

Delete files and registry entries added by OurSurfing.com

Sometimes removal via Control Panel is not enough since the built-in application can leave some files that shortly will restore the hijacker. So, you need to find all of the following items and delete them

Remove OurSurfing.com files and folders:

%ProgramFiles%\XTab\
%ProgramFiles%\XTab\BrowerWatchCH.dll
%ProgramFiles%\XTab\BrowerWatchFF.dll
%ProgramFiles%\XTab\BrowserAction.dll
%ProgramFiles%\XTab\CmdShell.exe
%ProgramFiles%\XTab\conf
%ProgramFiles%\XTab\ffsearch_toolbar!1.0.0.1031.xpi
%ProgramFiles%\XTab\HPNotify.exe
%ProgramFiles%\XTab\IeWatchDog.dll
%ProgramFiles%\XTab\install.data
%ProgramFiles%\XTab\msvcp110.dll
%ProgramFiles%\XTab\msvcr110.dll
%ProgramFiles%\XTab\ProtectService.exe
%ProgramFiles%\XTab\searchProvider.xml
%ProgramFiles%\XTab\skin\
%ProgramFiles%\XTab\skin\about.png
%ProgramFiles%\XTab\skin\about_bk.png
%ProgramFiles%\XTab\skin\btn.png
%ProgramFiles%\XTab\skin\btn_apply.png
%ProgramFiles%\XTab\skin\close.png
%ProgramFiles%\XTab\skin\conf.xml
%ProgramFiles%\XTab\skin\conf_back.png
%ProgramFiles%\XTab\skin\image\
%ProgramFiles%\XTab\skin\input_bk.png
%ProgramFiles%\XTab\skin\logo.png
%ProgramFiles%\XTab\skin\main.xml
%ProgramFiles%\XTab\skin\radio_1.png
%ProgramFiles%\XTab\skin\radio_2.png
%ProgramFiles%\XTab\skin\rigth_arrow.png
%ProgramFiles%\XTab\skin\settings.png
%ProgramFiles%\XTab\SupTab.dll
%ProgramFiles%\XTab\uninstall.exe
%ProgramFiles%\XTab\web\
%ProgramFiles%\XTab\web\data.html
%ProgramFiles%\XTab\web\img\
%ProgramFiles%\XTab\web\img\google_trends.png
%ProgramFiles%\XTab\web\img\icon128.png
%ProgramFiles%\XTab\web\img\icon16.png
%ProgramFiles%\XTab\web\img\icon48.png
%ProgramFiles%\XTab\web\img\loading.gif
%ProgramFiles%\XTab\web\img\logo32.ico
%ProgramFiles%\XTab\web\indexIE.html
%ProgramFiles%\XTab\web\indexIE8.html
%ProgramFiles%\XTab\web\js\
%ProgramFiles%\XTab\web\js\common.js
%ProgramFiles%\XTab\web\js\ga.js
%ProgramFiles%\XTab\web\js\jquery-1.11.0.min.js
%ProgramFiles%\XTab\web\js\jquery.autocomplete.js
%ProgramFiles%\XTab\web\js\js.js
%ProgramFiles%\XTab\web\js\library.js
%ProgramFiles%\XTab\web\js\xagainit-ie8.js
%ProgramFiles%\XTab\web\js\xagainit2.0.js
%ProgramFiles%\XTab\web\main.css
%ProgramFiles%\XTab\web\ver.txt
%ProgramFiles%\XTab\web\_locales\
%ProgramFiles%\XTab\web\_locales\en-US\
%ProgramFiles%\XTab\web\_locales\en-US\messages.json
%ProgramFiles%\XTab\web\_locales\es-419\
%ProgramFiles%\XTab\web\_locales\es-419\messages.json
%ProgramFiles%\XTab\web\_locales\es-ES\
%ProgramFiles%\XTab\web\_locales\es-ES\messages.json
%ProgramFiles%\XTab\web\_locales\fr-BE\
%ProgramFiles%\XTab\web\_locales\fr-BE\messages.json
%ProgramFiles%\XTab\web\_locales\fr-CA\
%ProgramFiles%\XTab\web\_locales\fr-CA\messages.json
%ProgramFiles%\XTab\web\_locales\fr-CH\
%ProgramFiles%\XTab\web\_locales\fr-CH\messages.json
%ProgramFiles%\XTab\web\_locales\fr-FR\
%ProgramFiles%\XTab\web\_locales\fr-FR\messages.json
%ProgramFiles%\XTab\web\_locales\fr-LU\
%ProgramFiles%\XTab\web\_locales\fr-LU\messages.json
%ProgramFiles%\XTab\web\_locales\it-CH\
%ProgramFiles%\XTab\web\_locales\it-CH\messages.json
%ProgramFiles%\XTab\web\_locales\it-IT\
%ProgramFiles%\XTab\web\_locales\it-IT\messages.json
%ProgramFiles%\XTab\web\_locales\pl\
%ProgramFiles%\XTab\web\_locales\pl\messages.json
%ProgramFiles%\XTab\web\_locales\pt\
%ProgramFiles%\XTab\web\_locales\pt\messages.json
%ProgramFiles%\XTab\web\_locales\pt-BR\
%ProgramFiles%\XTab\web\_locales\pt-BR\messages.json
%ProgramFiles%\XTab\web\_locales\ru\
%ProgramFiles%\XTab\web\_locales\ru\messages.json
%ProgramFiles%\XTab\web\_locales\ru-MO\
%ProgramFiles%\XTab\web\_locales\ru-MO\messages.json
%ProgramFiles%\XTab\web\_locales\tr-TR\
%ProgramFiles%\XTab\web\_locales\tr-TR\messages.json
%ProgramFiles%\XTab\web\_locales\vi-VI\
%ProgramFiles%\XTab\web\_locales\vi-VI\messages.json
%ProgramFiles%\XTab\web\_locales\zh-CN\
%ProgramFiles%\XTab\web\_locales\zh-CN\messages.json
%ProgramFiles%\XTab\web\_locales\zh-TW\
%ProgramFiles%\XTab\web\_locales\zh-TW\messages.json
%AppData%\oursurfing\
%AppData%\oursurfing\567.json
%AppData%\oursurfing\images\
%AppData%\oursurfing\images\bg.png
%AppData%\oursurfing\images\bg1.png
%AppData%\oursurfing\images\bk_shadow.png
%AppData%\oursurfing\images\button.png
%AppData%\oursurfing\images\button1.png
%AppData%\oursurfing\images\checkbox.png
%AppData%\oursurfing\images\checkbox_select.png
%AppData%\oursurfing\images\checked.png
%AppData%\oursurfing\images\close.png
%AppData%\oursurfing\images\code\
%AppData%\oursurfing\images\code\code1.jpg
%AppData%\oursurfing\images\code\code2.jpg
%AppData%\oursurfing\images\code\code3.jpg
%AppData%\oursurfing\images\code\code4.jpg
%AppData%\oursurfing\images\code\code5.jpg
%AppData%\oursurfing\images\code\code6.jpg
%AppData%\oursurfing\images\code\Thumbs.db
%AppData%\oursurfing\images\loading_bg.png
%AppData%\oursurfing\images\loading_light.png
%AppData%\oursurfing\images\min.png
%AppData%\oursurfing\images\scrollbar.bmp
%AppData%\oursurfing\images\Thumbs.db
%AppData%\oursurfing\images\unchecked.png
%AppData%\oursurfing\MessageBox.xml
%AppData%\oursurfing\uninstallDlg2.xml
%AppData%\oursurfing\UninstallManager.exe
C:\ProgramData\IHProtectUpDate\
C:\ProgramData\IHProtectUpDate\update\
C:\ProgramData\IHProtectUpDate\update\conf
C:\ProgramData\WindowsMangerProtect\
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
C:\ProgramData\WindowsMangerProtect\update\
C:\ProgramData\WindowsMangerProtect\update\conf

Remove OurSurfing.com registry entries:

HKLM\SOFTWARE\Policies\Google\Chrome\HomepageLocation www.jogostempo.com?oem=unknown&uid=SG12412&tm=
HKLM\SOFTWARE\Policies\Google\Chrome\RestoreOnStartupURLs\1 www.jogostempo.com?oem=unknown&uid=SG12412&tm=
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\ ""%ProgramFiles%\Mozilla Firefox\firefox.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command\ ""%ProgramFiles%\Google\Chrome\Application\chrome.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\ "C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Clients\StartMenuInternet\Safari.exe\shell\open\command\ ""%ProgramFiles%\Safari\Safari.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\ ""%ProgramFiles%\Mozilla Firefox\firefox.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\shell\open\command\ ""%ProgramFiles%\Google\Chrome\Application\chrome.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\ "C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Safari.exe\shell\open\command\ ""%ProgramFiles%\Safari\Safari.exe" www.jogostempo.com?oem=unknown&uid=SG12412&tm="
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid=
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.oursurfing.com/web/?type=dspp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid=&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\oursurfing uninstall
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} 1
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
HKLM\SOFTWARE\Wow6432Node\FFPluginHp
HKLM\SOFTWARE\Wow6432Node\IHProtect
HKLM\SOFTWARE\Wow6432Node\oursurfingSoftware
HKLM\SOFTWARE\Wow6432Node\SupDp
HKLM\SOFTWARE\Wow6432Node\supTab
HKLM\SOFTWARE\Wow6432Node\supWindowsMangerProtect
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL "http://www.oursurfing.com/web/?type=ds&ts=&z=&from=amt&uid=&q={searchTerms}"
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL "http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid="
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page "http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid="
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page "http://www.oursurfing.com/web/?type=ds&ts=&z=&from=amt&uid=&q={searchTerms}"
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\OperaStable\shell\open\command\ ""%ProgramFiles%\Opera\Launcher.exe" http://www.oursurfing.com/?type=sc&ts=&z=&from=amt&uid="
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\oursurfing uninstall
HKLM\SYSTEM\CurrentControlSet\services\IHProtect Service
HKLM\SYSTEM\CurrentControlSet\services\WindowsMangerProtect
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page "http://www.oursurfing.com/web/?type=dspp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid=&q={searchTerms}"
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page "http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid="
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL "http://www.oursurfing.com/web/?utm_source=b&utm_medium=amt&utm_campaign=install_ie&utm_content=ds&from=amt&uid=&ts=1427324607&type=default&q={searchTerms}"
HKLM\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command\ ""%ProgramFiles%\Opera\Launcher.exe" http://www.oursurfing.com/?type=sc&ts=&z=&from=amt&uid="
HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\Default_Search_URL "http://www.oursurfing.com/web/?type=ds&ts=&z=&from=amt&uid=&q={searchTerms}"
HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\Default_Page_URL "http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid="
HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page "http://www.oursurfing.com/?type=hppp&ts=1427324597&z=b823f0a7e4f8a904deb2f52gezbc0edz0tee6ceq8z&from=amt&uid="
HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\Search Page "http://www.oursurfing.com/web/?type=ds&ts=&z=&from=amt&uid=&q={searchTerms}"
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top
mobile desktop