How to remove Regnation.ru ads

Regnation.ru says your Internet will stop working unless you install a browser extension

Regnation.ru is a deceptive site created by crooks to gain access to your browser. It uses social engineering techniques to make people install a bogus browser extension that can change the main settings, like the homepage, new tab address, and search engine. It can also start displaying pop-up ads, banners, and cause redirects.

Links embedded in the pop-ups can lead to dangerous pages that try to trick users into providing personal information, downloading PUPs (potentially unwanted programs),^[1] and malware^[2]. You should remove the intuder as soon as possible, especially if there are other people using the affected machine.

When the Regnation.ru page opens, users are met with this message:

Computer memory is overloaded!

We highly recommend cleaning up errors and increasing the speed of your computer! To do this, you need to install the extension.

If the errors are not cleared, you will not be able to use the Internet!

You may notice that the site background is blue and it can remind people of legitimate system alerts. But make no mistake, no big tech company is related to this fraudulent campaign. Crooks have learned how to create professional-looking websites and how to write a convincing message. They do not have to have any hacking skills and can use social engineering to make users install malicious programs themselves.

Distribution techniques

Pages such as Regnation.ru can appear seemingly out of nowhere while people are surfing the web. The appearance can be caused by a click on a random link or a deceptive ad. For example, illegal streaming sites are unregulated, so no one oversees users' privacy and security. You should avoid browsing through suspicious sites and clicking on random advertisements. 

Another reason why you could have been taken to this site is that you already have a browser hijacker installed in your browser that can initiate redirects to websites from rogue advertising networks. We recommend using only official web stores and developer sites to download any software and web-based apps.

You should also do your research, and look at the reviews, ratings, and how many users they have. You will often find that there are almost no related results when you type in the name of the hijacker into the search. It is always best to choose applications that you can find plenty of feedback about.

Such apps can also be added by adware that is hiding in your system. Most of the time these PUPs sneak into the system from freeware^[3] distribution sites because they use software bundling to include additional programs in the installers that monetize user activity.

Eliminate the bogus extension

The first thing you should do is check if the extension is added to your browser. We recommend removing the extensions one by one to see if you notice any changes since it is unknown how the plugin is called:

Google Chrome

• Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
• In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

MS Edge:

1. Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
2. From the list, pick the extension and click on the Gear icon.
3. Click on Uninstall at the bottom.

MS Edge (Chromium)

• Open Edge and click select Settings > Extensions.
• Delete unwanted extensions by clicking Remove.

Mozilla Firefox

• Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
• Select Add-ons.
• In here, select unwanted plugin and click Remove.

Safari

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Use FortectIntego maintenance tool to clear your browsers and to completely get rid of any remaining damage. It is capable of getting rid of cookies^[4] and cache that are used to collect various browsing-related data. Information like your IP address, geolocation, links you click on and things you purchase online can be sold to advertising networks or other third parties.

This powerful software can also optimize your device and improve performance by deleting all junk you do not need and fix much more complicated problems like system errors, corrupted files, registry issues, and BSoDs which is especially helpful after virus infections.

PUP removal from the system

The first removal method may not have worked if you have a PUP hiding in your system. Simply changing the settings will not help because a PUA can just keep messing with your browser until you completely eliminate it. Crooks make money with such apps by displaying pop-ups, banners, and causing redirects.

Freeware distribution platforms often disguise PUAs as “handy” tools and include them in the installers. Many people skip through the installation process so they do not notice the bundled software. Although it might get costly, it is best to get software from official sources as you will not have to wonder if it is safe.

There are also steps that you can take to minimize the risk of infection. Do not rush through the installation process when installing new programs, especially from peer-to-peer file-sharing platforms. Always choose the “Custom” or “Advanced” installation method and inspect the file list. Just untick the boxes next to the files if you see something suspicious.

Identifying the program responsible for hijacking your browser might be difficult if you have never done this before. It could be disguised as an antivirus, image editing software, or anything else. If you are not sure what to do and you do not want to risk eliminating the wrong files, we suggest using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes security tools that will scan your machine, eliminate it, and prevent such infections in the future by giving you a warning before a malicious program can make any changes.

Otherwise, follow the guide below for Windows and Mac machines:

Windows 10/8:

1. Enter Control Panel into Windows search box and hit Enter or click on the search result.
2. Under Programs, select Uninstall a program.
3. From the list, find the entry of the suspicious program.
4. Right-click on the application and select Uninstall.
5. If User Account Control shows up, click Yes.
6. Wait till uninstallation process is complete and click OK.

Windows 7/XP:

1. Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
2. In Control Panel, select Programs > Uninstall a program.
3. Pick the unwanted application by clicking on it once.
4. At the top, click Uninstall/Change.
5. In the confirmation prompt, pick Yes.
6. Click OK once the removal process is finished.

Mac:

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.