How to remove IncognitoSearchWeb browser hijacker

IncognitoSearchWeb claims to let you browse anonymously

IncognitoSearchWeb is a browser hijacker which means it takes over the browser by changing the most important settings, like the homepage, new tab address, and search engine. The name implies that by using this add-on or PUP you can browse the web anonymously – but that is not true. There is nothing that implies such functions of portal.incognitosearchweb.com. Quite the opposite – the hijacker collects various information about the user. Until people take care of this problem, they are forced to use the homepage and search engine set by the intruder which raises many privacy and security concerns.

The developers of this hijacker have released hundreds of these and it is still unknown who they are. Some of the previous ones we already wrote about are JustVideoSearch, GameSearchTech, and BestConverterz. All of them have a lot in common. They all look the same and have the same couple of functions – a PDF file converter, currency and crypto converter, calculator, and an ability to bookmark websites. This is probably an attempt to stay relevant and appear useful. The truth is, that you can access any of these functions on almost every browser with a click of a button so it is just not worth it to trade your privacy for it. 

A completely changed user experience

The browser add-on or PUA responsible for all the changes also implements a different search engine. It redirects your search queries through feed.incognitosearchweb.com and shows the results from various shady search engines. You most likely will receive results from these ones:

• Yahoo
• Searchlee
• Bing
• Nearbyme

Although Yahoo and Bing are legitimate and popular engines, the other ones are not. They can deliver inaccurate results leading to misinformation. The results are also filled with promotional links and ads at every corner. Hijacker developers rarely create their own search engines, they usually use already existing ones just to make them functional. Because there is only one purpose for this.

And that is to generate revenue from pay-per-click advertising.^[1] Every ad and promoted link you click on, places money into IncognitoSearchWeb authors' hands. That is why this is so unsafe. They do not care about user safety and privacy so the do not filter what ads show up. As a result, you can end up on some shady sites that can trick you into providing your personal information or downloading other PUPs and malware.

How was my browser hijacked?

This is the most important question you should be asking yourself. One of the main reasons for such intruders is users' own careless nature. Many think that the Internet is a safe place and they can click on random links without thinking about it. For a long time now, cyber attacks have been increasing in numbers as well as online fraud schemes.

Most often, users do not add these kinds of plugins or download PUPs on their own will. Usually, they see a false ad for it or get redirected to a page that tricks them into downloading it. There is also a possibility that you got it while installing freeware from unofficial sources. Software bundling^[2] is a very common method used to spread PUAs and malware.

These sites that let you download software for free, still need to make money somehow, so they implemented other ways to do that. They include additional programs in the installers and do not disclose that prior. Most people find the installation process boring and just skip through it. As a result, they do not realize that they installed other apps as well.

Start the removal by going to your browser settings

First, you need to check if this is caused by a plugin:

Google Chrome

• Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
• In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

MS Edge:

1. Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
2. From the list, pick the extension and click on the Gear icon.
3. Click on Uninstall at the bottom.

MS Edge (Chromium)

• Open Edge and click select Settings > Extensions.
• Delete unwanted extensions by clicking Remove.

Mozilla Firefox

• Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
• Select Add-ons.
• In here, select unwanted plugin and click Remove.

Safari

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Internet Explorer:

1. Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
2. Pick Manage Add-ons.
3. You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.

After you have finally got rid of the hijacker, you might still experience messed-up settings. We suggest using FortectIntego repair tool to clear your browsers and to completely get rid of any remaining damage. By the way, it can also optimize your device and improve performance.

There still might be a PUP hiding in your machine

As we said before, you can infect yourself with PUAs by not paying attention during the installation process and browsing through shady sites. If the previous removal method did not get rid of the intruder, and you still experience changed settings, you most likely have an unwanted program^[3] performing tasks without your consent.

Identifying the program responsible for hijacking your browser might be difficult if you do not have experience. It could be disguised as an antivirus, image editing software, or anything else and look like a “handy” tool you may need. If you are not sure what to do and you do not want to risk eliminating the wrong files, we suggest using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes security tools that will scan your machine for suspicious processes, eliminate them, and prevent such infections in the future by giving you a warning before a malicious program can make any changes.

If manual removal is what you prefer, we have instructions for Windows and Mac machines:

Windows 10/8:

1. Enter Control Panel into Windows search box and hit Enter or click on the search result.
2. Under Programs, select Uninstall a program.
3. From the list, find the entry of the suspicious program.
4. Right-click on the application and select Uninstall.
5. If User Account Control shows up, click Yes.
6. Wait till uninstallation process is complete and click OK.

Windows 7/XP:

1. Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
2. In Control Panel, select Programs > Uninstall a program.
3. Pick the unwanted application by clicking on it once.
4. At the top, click Uninstall/Change.
5. In the confirmation prompt, pick Yes.
6. Click OK once the removal process is finished.

Mac:

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

The next time you want to install free software, do this:

• Choose the “Custom” or “Advanced” installation method
• Although it may be boring, we strongly suggest reading the Terms of Use and Privacy Policy to find out what data will be gathered and what the app will be able to do on your device
• Check the file list and see if there are any additional apps. If you see some, untick the boxes next to their names so they would not install in your machine