How to remove Fireball virus

Fireball malware is a browser hijacker that can function as a backdoor

Fireball virus is a highly dangerous Chinese malware^[1] (created by Rafotech) that has compromised over 250 million computers worldwide. The malicious software hijacks victims’ web browsers and replaces current homepage, new tab and default search engine values with URL that points to Rafotech search engine. Results brought by this questionable search tool seem to be provided by giant companies like Google or Yahoo, although actually they are filled with advertisements promoting possibly dangerous sites. Each of the fake Rafotech search tools contains tracking pixels that are used to record private users’ data. However, despite posing a threat to victim’s privacy, displaying intrusive pop-up ads and manipulating search results, the hijacker is capable of doing so much more. It turns out that Fireball malware^[2] can be easily transformed into a weapon that could give the attackers opportunity to infect the compromised machines with additional viruses. It is a must to remove Fireball hijacker as soon as possible because frauds can easily leverage it to execute any type of code on the system. For its removal, we highly suggest using FortectIntego or MalwarebytesMalwarebytes software. Below, you can see part of search engines run by Rafotech:

• Trotux.com;
• attirerPage.com;
• Startpageing123.com;
• Youndoo.com;
• Hohosearch.com;
• Yessearches.com;
• Luckysearch123.com.

Research shows that the malicious Fireball adware mostly affected residents of India, Brazil, Mexico, Indonesia, and the United States. The developer of the malware, known as Rafotech, denies creating browser hijackers, but praises being a successful digital marketing company that provides a possibility to access over 300 million users worldwide. However, the activity of this virus clearly discloses its relations with this company. On top of that, the cyber threat demonstrates a great sophistication level – it has anti-detection features, the structure of multiple layers and also ability to communicate with a Command & Control server. This doesn’t look like a typical browser hijacker to us – rather something way more powerful and malicious. In fact, the software reminds us of a critical backdoor^[3]. It goes without saying that Fireball malware removal should become your top-priority task. If you are unsure whether your PC is infected with this malware or not, we suggest scanning the system with anti-malware software ASAP. Remember that only reputable and up-to-date programs will detect the virus.

Distribution of Rafotech’s malware

Bundling is the main attack vector used by Fireball hijacker’s developer. At the moment, it is known that the hijacker is actively distributed with the help of DealWifi, Mustang Browser, Soso Desktop, FVP Imageviewer and much more. Users must be careful when installing free programs from the Internet, no matter if they appear to be legitimate at first sight. The problem is, the developer of the described malware balances on the edge of legitimacy and leverages the fact that adware/browser hijackers are theoretically legitimate programs. At the moment of Fireball’s installation, none of the malicious programs are installed alongside it. However, cyber security experts have expressed their beliefs that the malware is distributed with the help of additional methods such as spam. What is more, the company is suspected of buying installs from malicious actors.

To prevent Fireball malware attack, avoid installing software from suspicious web sources. On top of that, always choose Custom or Advanced settings when installing software. These options allows modifying components of downloaded software packs, meaning you can deselect unwanted additions and install only the software you were initially looking for.

Remove Fireball malware from your machine

Fireball virus has been bothering computer users for years, changing their browser settings and performing other intolerable activities. If you have been bothered by the aforementioned search engines at least once in your lifetime, you must scan the system to remove Fireball malware ASAP. Please do not try to root out the infection manually – it is a highly sophisticated threat that, as we mentioned, obfuscates itself on the system to avoid detection. The virus sneaks into the system using different names, and that is another reason why it could be impossible to detect it manually.