Amisites.com

Posted by Lisa Blanc on June 30, 2016

What is Amisites.com?

We want to inform you that Amisites.com is, in fact, a malicious search engine that falls into the category of browser hijackers, so it would be for the best if you removed it. Its developers employ dishonest and illicit distribution methods to get as many computers infected with it as possible. The reason for doing so is making as much money as possible because this hijacker not only modifies your web browser’s settings but also promotes third-party content from its search results. We want to make you aware that the promoted content comes from unknown sources, and thus, can hardly be trusted. So, without further ado, let us jump into how this hijacker is distributed. test

Where does Amisites.com come from?

Our malware analysts say that it is a brand new infection, so all of its distribution methods are unknown, but they think that it may have more than one. Software bundling is the most likely method, however, because it ensures a high number of infected computers. Nevertheless, the infections depend on popularity on the freeware websites that host them and the software they are bundled with. If that is the case, then this hijacker is probably installed in secret without giving you the opportunity to opt out. It does not look like this hijacker comes with a browser extension, so it depends on the installer to inject it into a browser during the installation process of the bundled software.

We also want to mention that this particular browser hijacker comes from an established malware developer. So this hijacker belongs to the Elex family which also includes hijackers called Ooxxsearch.com, Maniihome.com. Also, the developer responsible for releasing these hijackers has also published an adware-type program called AdSkip that claims to block advertisements but renders more of them instead. So the Elex malware family is nothing to joke about as they are serious about their malware.

How does Amisites.com work?

Amisites.com works just like any other browser hijacker would — it hijacks the settings of a particular browser to force you to use it for online search. It is configured to hijack the homepage address for Internet Explorer and Chrome and the search provider for Mozilla Firefox and Chrome. So it modifies settings for each browser differently. However, the intention of this hijacker is clear — to change your browser’s settings and redirect you to its address at Amisites.com.

Usually, browser hijackers display modified search results, but we did not observe this in this particular hijacker. Moreover, by “modified search results” we mean search results that have additional advertisements injected or customized by the browser hijacker. However, as mentioned, it does not look like this particular browser hijacker features additional ads, but it has to make money somehow and at present it looks like it does not generate any revenue. It uses the standard Google.com search engine to process the search queries which means that it cannot modify the search results to include additional promotional links.

In any case, Amisites.com has been configured to gather information about your browsing habits. As a result, this hijacker’s developers can obtain information such as your browsing history, search history, geographical location, and so on. We do not know the reason behind collecting data about you because it currently does not modify the search results, so there is no need to gather information which is often used to tailor the promotional links.

How to remove Amisites.com

Given Amisites.com’s distribution methods we had no choice but to classify it as a browser hijacker. It is set to modify relevant browser settings for some unknown reason because it does not inject commercial ads in the search results. Also, it collects information about you, so there is no need to allow it to remain on your PC, and we recommend that you delete it using our instructions.

Manual Removal

Mozilla Firefox

Press Windows+E keys.
In the address bar, enter C:\Users\{ your user name}\AppData\Roaming\Mozilla\Firefox\Profiles\{Unique Mozilla ID}
Find prefs.js and open it with Notepad.
Replace the URL in user_pref("browser.startup.homepage", "http://maniihome.com"); string.
Save and Close.

Google Chrome

Press Windows+E keys.
In the address bar, enter C:\Users\{ your user name}\AppData\Local\Google\Chrome\User Data\Default
Locate Preferences, Secure Preferences and Web Data files.
Open them with Notepad and replace http://maniihome.com with your desired homepage.
Alternatively, you can delete these files.