Faststartpage.com

Posted by Max Lehmann on March 13, 2017

What is Faststartpage.com?

A new browser hijacker Faststartpage.com working exactly like Personal-Spage.com, Searchbuw.com, and Loadblanks.ru has been recently detected by malware experts working at anti-spyware-101.com. It is not an ordinary browser hijacker for sure because it does not change browsers’ settings, e.g. homepage, New Tab URL, and default search provider like other prevalent browser hijackers tend to do. Instead, it hijacks shortcuts of all browsers users have installed on their computers. At the time of writing, it is compatible with Internet Explorer, Google Chrome, and Mozilla Firefox, so if you have all these three web browsers installed on your computer, you will notice that they all open Faststartpage.com. It should be emphasized that users see the Faststartpage.com domain for a second only because it immediately redirects to http://net-quick.com/ivi/. As a consequence, some people think that the latter URL has taken over their browsers and belongs to malicious software, which is not exactly true. test test test

What does Faststartpage.com do?

In order to launch together with web browsers, the Faststartpage.com browser hijacker hijacks all browsers’ shortcuts the second it enters the computer. It adds such or a similar line pointing to a .bat file there: %Homedrive%:\Users\{username}\AppData\Roaming\Browsers\exe.xoferif.bat. It does that instead of changing parameters (e.g. homepage and default search tool) of browsers. These changes are applied so that Faststartpage.com would be automatically opened for users every day. If we look inside batch files, e.g. exe.xoferif.bat located in the Browsers folder this browser hijacker places in %APPDATA%, we will see that it contains a command inside, for example, start "" "c:\PROGRA~1\INTERN~1\iexplore.exe" "http://faststartpage.com/". It forces browsers to open Faststartpage.com. As has already been mentioned in the first paragraph, users might not notice this domain because of another web page (http://net-quick.com/ivi/) opened. This page looks like a decent search provider at first, but, according to researchers, it cannot be trusted fully either. Its main drawback is that it presents users with the commercial content. Ads associated with dubious third-party pages are located on its start page. In addition, users might see them located on the search results page too if they use this search provider as a default search tool. Researchers have not found this finding disturbing at all because this search engine uses Google Custom Search which can be modified and adapted to one’s needs. Users who use the search engine opened for them as the one and only tool to perform web searches might help people behind this page to earn the pay-per-click revenue. Unfortunately, users themselves might only get a bunch of undesirable software instead. Bad applications can sneak onto the computer even if the dubious website is opened for a second after clicking on any of these displayed ads.

Where does Faststartpage.com come from?

Undoubtedly, Faststartpage.com is launched for you automatically when you open any of your web browsers because a browser hijacker has successfully entered the computer and applied changes to browsers. More specifically, browsers’ shortcuts have been hijacked and a folder containing .bat files has been dropped on the computer. We are sure you have not voluntarily installed this threat on your system because, as research carried out by specialists at anti-spyware-101.com has revealed, it is spread through bundled malicious installers in most cases. The word “bundled” means that it usually does not travel alone. We cannot tell you the names of programs that come together with it because they change depending on the user’s location. The only thing we surely know is that untrustworthy applications could have been installed on your PC together with the Faststartpage.com browser hijacker. If you do not do anything to protect your PC, e.g. install a reputable security application, you might find other dubious programs on your PC any time soon.

How do I delete Faststartpage.com?

Do not even bother resetting your web browsers to their default settings because this will not remove Faststartpage.com from browsers. Instead, remove the folder with .bat files from %APPDATA% belonging to this browser hijacker and erase all hijacked shortcuts of browsers. Then, go to create new shortcuts to be able to quickly and conveniently open your web browsers. Our instructions (they are located below this paragraph) should help you to take care of this computer infection, but if you do not trust your skills in malware removal at all, you can delete the Faststartpage.com browser hijacker automatically with an automatic scanner, such as SpyHunter, as well.

Remove Faststartpage.com manually

Open the Windows Explorer.
Type %APPDATA% in the URL box at the top to open this directory.
Locate the Browsers folder there.
Delete it.
Remove hijacked browsers’ shortcuts from the following places: