Severity scale:  

Remove (Removal Guide) - Aug 2016 update

removal by Alice Woods - -   Also known as Safesurfs | Type: Browser hijacker

Can I stay safe while using Safesurfs?

If virus showed up on your browser, you should know that you have become a victim of a browser hijacker. Just like its “twin”, it spreads like a useful search engine which is capable of improving people’s browsing. Unfortunately, but neither the first page nor the second is capable of showing you legitimate search results. They are designed to modify your computer, hijack each of web browsers, and display search results that are considered untrustworthy. Because of these results, you may find yourself redirected to malicious domains seeking to infect your computer with malware. There is no doubt that you must think about Safesurfs removal and stop using this search engine because it has nothing in common with staying safe while browsing on the Internet. The easiest way to fix computer is to rely on such programs as ReimageIntego. We used it while testing this redirect virus and we must say that it showed great results in detecting each of its components. Of course, it is also possible to remove this hijacker manually. For that, you should scroll down to see each of removal steps.

Once installed on the system, Safesurfs virus is assigned to each of web browsers that are installed on the affected PC system. Beware that it can affect each of web browsers, including Mozilla Firefox, Google Chrome, Safari, Microsoft Edge, etc. Here, it appears instead of the start page, a default search engine, and a new tab page. For protecting itself, this hijacker uses various browser helper objects, such as third party installers, browser plugins and similar components that can be seen easily. They start working as soon as they get a notification that user is trying to reset browser settings and remove Safesurfs from the system. 

The picture of virus

Questions about

Why should you be careful with This search engine is commercial one and its developers have been using it to promote suspicious third parties in exchange for money. So, you should realize that its search results are corrupted and filled with sponsored links. After clicking one of such search results, so you can easily be redirected to a malicious website. In addition to redirect activity, there is another thing that you must keep in mind. It is related to previously-mentioned BHOs (browser helper objects) that can not only protect this browser hijacker. These “objects” can also track people and collect information related to their activity on the Internet. Unfortunately, we can’t guarantee that personal information that you share thru Safesurfs can’t get into hands of unreliable people. If you are against tracking and redirected searches, you should not postpone the removal of this browser hijacker. 

The picture of virus

Why should I treat this search engine as risky and how can I avoid it?

While seems like a trustworthy search engine with a search box and quick links, security experts believe it to be a risk (although minor) to people’s privacy and virtual security. There are several reasons for such assumptions. The research has revealed that this search engine is quite controversial. Although it may boast being able to provide selectively chosen and customized search results, it may rather present people with altered search results. It means that the majority of links and advertisements that it provides may be sponsored, i.e. linked to affiliate websites. Unfortunately, but its redirects can make you visit both, reliable and unsafe, domains which is why this search engine is considered a threat to people’s virtual security.

To prevent yourself from Safesurfs hijack, you must monitor installation of the freeware by selecting Advanced or Custom installation option. Also, make sure you read the Privacy Policy, End User’s License Agreement and similar information provided by the developer of the software. If you can find suspicious statements, you should choose another program. However, if you have been using this browser hijacker, you need to think about removal from the system. For that, you can use instructions that are provided down below.

How can I remove

We hope that you understand that you must remove Safesurfs from your computer because it is a seriously suspicious program which uses BHOs for tracking its users. Security experts have already warned people by saying that they discovered about the accumulation of personally identifiable and non-identifiable information. For example, it may accumulate search terms, downloads and uploads, software and hardware information, browser’s type, language, email address, and so on. However, third parties may apply it for unfair purposes, so there is no doubt that removal should be considered. Of course, just like any other PUP, it may pose you difficulties while trying to get rid of it, so we highly recommend you to apply an automatic removal method. Using a reliable anti-spyware will eliminate this hijacker along with its counterparts without any difficulties. However, if you do not want to use additional software, you can use the guide given below:

You may remove virus damage with a help of ReimageIntego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove, follow these steps:

Eliminate from Windows systems

Security experts have revealed several free programs which are used to spread this browser hijacker. To make sure that removal from Windows OS is successful, you need to uninstall each of these programs: VPlay, LessTabs, WebCake-related entries, Conduit-related entries, Yontoo, Yealt, and others. Of course, don’t forget to remove SafeSurfs and its entries as well. To fix your browser helper shortcuts, you should eliminate //… from the target field. 

  1. Click Start Control Panel Programs and Features (if you are Windows XP user, click on Add/Remove Programs). Click 'Start -> Control Panel -> Programs and Features' (if you are 'Windows XP' user, click on 'Add/Remove Programs').
  2. If you are Windows 10 / Windows 8 user, then right-click in the lower left corner of the screen. Once Quick Access Menu shows up, select Control Panel and Uninstall a Program. If you are 'Windows 10 / Windows 8' user, then right-click in the lower left corner of the screen. Once 'Quick Access Menu' shows up, select 'Control Panel' and 'Uninstall a Program'.
  3. Uninstall and related programs
    Here, look for or any other recently installed suspicious programs.
  4. Uninstall them and click OK to save these changes. Right click on each of suspicious entries and select 'Uninstall'
  5. Remove from Windows shortcuts
    Right click on the shortcut of Mozilla Firefox and select Properties. Right click on browsers' icon and select 'Properties'
  6. Go to Shortcut tab and look at the Target field. Delete malicious URL that is related to your virus. Select 'Shortcut' tab and delete '' or other suspicious URL

Repeat steps that are given above with all browsers' shortcuts, including Internet Explorer and Google Chrome. Make sure you check all locations of these shortcuts, including Desktop, Start Menu and taskbar.

Erase from Mac OS X system

When trying to uninstall manually, you should remove each of its entries. We also recommend you to uninstall these suspicious applications from Mac OS X: VPlay, LessTabs, WebCake-related entries, Conduit-related entries, Yontoo, Yealt, etc.

If your macOS is displaying some infection symptoms, proceed with the following guide:

Remove from Applications folder:

  1. From the menu bar, select Go > Applications.
  2. In the Applications folder, look for entries.
  3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)Uninstall from Mac 1

To fully remove, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

  1. Select Go > Go to Folder.
  2. Enter /Library/Application Support and click Go or press Enter.
  3. In the Application Support folder, look for any dubious entries related to and then delete them.
  4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the entries.Uninstall from Mac 2

Remove from Internet Explorer (IE)

Remove dangerous add-ons:

  1. Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
  2. Pick Manage Add-ons.
  3. You will see a Manage Add-ons window. Here, look for and other suspicious plugins. Click on these entries and select Disable.Remove add-ons from Internet Explorer

Change your homepage if it was altered:

  1. Open IE and click on the Gear icon.
  2. Select Internet Options.
  3. In the General tab, delete the Home page address and replace it by your preferred one (for example,
  4. Click Apply and then select OK.Reset IE homepage

Delete temporary files:

  1. Press on the Gear icon and select Internet Options.
  2. Under Browsing history, click Delete…
  3. Select relevant fields and press Delete.Clear temporary files from Internet Explorer

Reset Internet Explorer:

  1. Click on Gear icon > Internet options and select Advanced tab.
  2. Select Reset.
  3. In the new window, check Delete personal settings and select Reset again to complete removal.Reset Internet Explorer

Delete from Mozilla Firefox (FF)

  1. Remove dangerous extensions
    Open Mozilla Firefox, click on the menu icon (top right corner) and select Add-ons Extensions. Click on menu icon and select 'Add-ons'
  2. Here, select and other questionable plugins. Click Remove to delete these entries. Select 'Extensions' and look for malicious entries. Click 'Remove' to get rid of each of them
  3. Change your homepage if it was altered by virus:
    Click on the menu (top right corner), choose Options General.
  4. Here, delete malicious URL and enter preferable website or click Restore to default.
  5. Click OK to save these changes. When in 'General' tab, delete malicious URL from 'Home Page' section or click on 'Restore to Default' button. Click 'OK' to save changes
  6. Reset Mozilla Firefox
    Click on the Firefox menu on the top left and click on the question mark. Here, choose Troubleshooting Information. Click on menu icon and then on '?'. Select 'Troubleshooting Information'
  7. Now you will see Reset Firefox to its default state message with Reset Firefox button. Click this button for several times and complete removal. Click on 'Reset Firefox' button for a couple of times

Uninstall from Google Chrome

  1. Delete malicious plugins
    Open Google Chrome, click on the menu icon (top right corner) and select Tools Extensions. Click on menu icon. Select 'Tools' and 'Extensions'
  2. Here, select and other malicious plugins and select trash icon to delete these entries. Look for malicious entries and delete each of them by clicking on the Trash bin icon
  3. Change your homepage and default search engine if it was altered by your virus
    Click on menu icon and choose Settings.
  4. Here, look for the Open a specific page or set of pages under On startup option and click on Set pages. After clicking on menu and 'Settings', select 'Set pages'
  5. Now you should see another window. Here, delete malicious search sites and enter the one that you want to use as your homepage. Click 'X' to remove malicious URLs
  6. Click on menu icon again and choose Settings Manage Search engines under the Search section. When in 'Settings', select 'Manage search engines...'
  7. When in Search Engines..., remove malicious search sites. You should leave only Google or your preferred domain name. Click 'X' to remove malicious URLs
  8. Reset Google Chrome
    Click on menu icon on the top right of your Google Chrome and select Settings.
  9. Scroll down to the end of the page and click on Reset browser settings. When in 'Settings', scroll down to 'Reset browser settings' button and click on it
  10. Click Reset to confirm this action and complete removal. Click on 'Reset' button to complete your removal

Eliminate from Safari

  1. Remove dangerous extensions
    Open Safari web browser and click on Safari in menu at the top left of the screen. Once you do this, select Preferences. Click on 'Safari' and select 'Preferences'
  2. Here, select Extensions and look for or other suspicious entries. Click on the Uninstall button to get rid each of them. Go to 'Extensions' and uninstall malicious add-ons
  3. Change your homepage if it was altered by virus:
    Open your Safari web browser and click on Safari in menu section. Here, select Preferences as it was displayed previously and select General.
  4. Here, look at the Homepage field. If it was altered by, remove unwanted link and enter the one that you want to use for your searches. Remember to include the "http://" before typing in the address of the page. When in 'General', delete malicious URL and enter your desired domain name
  5. Reset Safari
    Open Safari browser and click on Safari in menu section at the top left of the screen. Here, select Reset Safari.... Click on 'Safari' and select 'Reset Safari...'
  6. Now you will see a detailed dialog window filled with reset options. All of those options are usually checked, but you can specify which of them you want to reset. Click the Reset button to complete removal process. Select all options and click on 'Reset' button

Protect your privacy – employ a VPN

There are several ways how to make your online time more private – you can access an incognito tab. However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of Private Internet Access VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise. Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and Private Internet Access VPN will let you browse the Internet without a feeling of being spied or targeted by criminals. 

No backups? No problem. Use a data recovery tool

If you wonder how data loss can occur, you should not look any further for answers – human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence. In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.

If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. Data Recovery Pro is one of the leading file recovery solutions you can find on the market – it is likely to restore even lost emails or data located on an external device.

About the author
Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Alice Woods
About the company Esolutions

Removal guides in other languages

  1. 2Egisss2 says:
    October 19th, 2015 at 11:57 pm

    Hi guys!! Ive found this hijacker on my computer right after installing a PDF viewer. It doesnt bother me a lot, but it has been redirecting me to websites that I see for the first time. Ive removed it successfully, but I have some doubts that it might have helped other threats infect my computer because I keep receiving ads during browsing.

  2. Patricia says:
    October 20th, 2015 at 12:14 am

    Hi 2Egisss2! I have the same issue in my web browser. Im using Chrome, but I cant get rid of it manually. I have removed it from the plug-ins list and replaced it by in the field of homepage. However, it reappears as soon as I reopen my web browser. What did I do wrong?

  3. LeoB says:
    October 20th, 2015 at 1:17 am

    I dont know whats the problem with me because its a second time when hijacks my computer. I assume that it has infiltrated my computer as a free addition of a freeware. The next time I will install free programs much much much more carefully.

  4. MirandaEdgley says:
    October 20th, 2015 at 2:43 am

    I cant believe Ive been using this search engine instead of Google! It actually seemed to be useful until Ive noticed that most of the links that it provides are sponsored. Dont use hijacker because it can cause you inconveniences and expose to suspicious websites! To remove it, Ive used SpyHunter. Successfully detected and removed.

Your opinion regarding