What is Webstarts.biz?
Webstarts.biz may look like a typical search engine but is far from being one. Our security experts have classified it as a browser hijacker and advise that you remove it as soon as you notice that it has replaced your browser’s homepage address. It comes bundled with malicious installers designed to inject it into your browser secretly. Furthermore, this type of browser hijacker also hijacks the Target line, so getting rid of it may be tricky, but possible nonetheless. Please read this whole article and consult the removal guide presented below.
What does Webstarts.biz do?
In all honesty, this hijacker works like a regular search engine. You can enter a search query in its search box, and it will present you with search suggestions and search results when you click it. In short, it looks like a typical search engine. While it has links to sites such as Twitter, Facebook, eBay, and Amazon, among others, it does not appear like its purpose is to generate advertising revenue. However, that is exactly the reason it was created and distributed.
Like all browser hijackers, Webstarts.biz is designed to promote third-party content in its search results. While it does not have an EULA that usually vaguely mentions advertising, we are positive that it should promote some third-party content in one way or another because setting up this hijacker for the sake of setting it up is pointless. It must have a purpose, and we do not see a purpose other than that of showing promotional links in its search results as a means of making money. Take note that it redirects all search queries to Plusnetwork.com which generates the search results. Plusnetwork.com is known to use Yahoo’s search results, so you would use Yahoo with some shady links thrown into the mix.
Another important aspect worthy of note is the fact that Webstarts.biz can collect information about you. While it does not feature a Privacy Policy, we believe that, at the very least, it should collect anonymous information such as your browsing history, clicked promotional links, entered search queries, approximate geographical location, IP address, and so on. This and other anonymous information is gathered automatically. It is stored and can even be shared with third parties. However, its main purpose is to aid the developers in figuring out what ads to show to what person. Essentially, this information is used to customize the promotional links/ads to make more money.
Before we move on to discussing its origins, we want to elaborate more about Webstarts.biz’s Target line hijacking feature. Not many hijackers hijack the Target line anymore, but this practice used to be common. Now, the malicious installer is configured to enter http://Webstarts.biz at the end of the Target line of a browser’s shortcut. Take note that it can do this to Mozilla Firefox, Microsoft Internet Explorer, and Google Chrome. So even if you change the homepage address via the Options menu, the homepage address will be changed back to Webstarts.biz the next time you reopen the web browser. Target line hijacking prevents you from getting rid of this hijacker, but you do not need to worry as you can fix this problem easily. (Check the guide below for more information.)
Where does Webstarts.biz come from?
This browser hijacker comes from the same secretive developer as Esurf.biz, Foryourweb.net, and Safesurfs.com. Hence, it comes from an established developer that has made dozens of browser hijackers in the past. We have found that, for the time being, Webstarts.biz is most popular in the US and India, but that is subject to change.
We believe that this popularity boils down to the medium and place it is distributed in. Therefore, we suspect that this malicious search engine could be featured on a free software distributing site that bundles its featured free software with shady search engines such as this one. Therefore, it should be a site that is popular in both the US and India, but it could also be featured on several sites that are popular in their respective countries. In any case, it would appear that the distribution website involves configuring the installer not to show the presence of Webstarts.biz and, possibly, other shady software it may come with so that you should not deselect their installation.
How do I remove Webstarts.biz?
Based on the information we have obtained, it is evident that this browser hijacker can only get on your computer through deceit. Given its malicious distribution tactic, its likelihood to promote shady content and tendency to collect information about you, we recommend that you remove it from your web browser as soon as you can. Please consult the guide below on how to do this.
Fix the Target line
- Right-click the web browser’s shortcut.
- Select Properties and open the Shortcut tab.
- Erase “Webstarts.biz” from the Target line.
- Click OK.
Change the homepage address
Google Chrome
- Press Windows+E keys.
- Enter C:\Users\{user name}\AppData\Local\Google\Chrome\User Data\Default in the address line and hit Enter.
- Find Preferences, Secure Preferences and Web Data files.
- Right-click each of them.
- Select Open with and select Notepad.
- Find and replace http://Webstarts.biz with another search engine address
- Save and Close.
Mozilla Firefox
- Press Windows+E keys.
- In the File Explorer’s address bar, type C:\Users\{user name}\AppData\Roaming\Mozilla\Firefox\Profiles and hit Enter.
- Go to {Unique Mozilla ID} folder.
- Locate prefs.js and right-click it.
- Select Open with and select Notepad.
- Find and replace http://Webstarts.biz in the user_pref("browser.startup.homepage", " http://Webstarts.biz"); string.
- Save and Close.
Microsoft Internet Explorer
- Press Windows+R keys.
- Type regedit in the dialog box and hit Enter.
- Navigate to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Find the Start Page registry string.
- Right-click it and click Modify.
- In the Value data line, erase http://Webstarts.biz and enter a new homepage address.
- Click OK.
tested removal of Webstarts.biz*
0 Comments.