UPhotoRun browser extension (virus) - Free Guide

What is UPhotoRun browser extension?

The UPhotoRun extension causes unwanted pop-ups, banners, and redirects in your browser

UPhotoRun spams users with unwanted advertisements and causes redirects

UPhotoRun is a browser extension that causes unwanted commercial content to appear in places it should not. These kinds of applications are classified as browser hijackers because they change the settings and monetize user activity. The ads can start appearing in the form of pop-ups, banners, links injected in the search results, or unexpected redirects.

Because the developers do not care about user privacy or security, they do not filter the ads that can appear on your screen. As a result, you might see ads with sensational content and messages that urge you to click. These can be giveaways, surveys, and free software offers.

If this happened on your family computer which your children and other family members use, it is especially important to eliminate the intruder as sometimes the ads could be promoting sites for adults. Besides, they can click on links that lead them to dangerous sites where they can get tricked into downloading other PUPs (potentially unwanted programs)^[1] or even malware.^[2]

Hijacker distribution methods

On rare occasions, such apps like UPhotoRun can be downloaded from the official web stores like the chrome web store. Even though all the applications go through an extensive review process, online stores have trouble determining what is an unwanted program. A particular browser extension could be found useful by one person and by the other one considered to be a virus.

However, official web stores are still the most reliable place for web-based apps. You just have to do your research – read the reviews, look at the ratings, and how many users it has. Browser hijackers usually have very little information about them, or they claim that the app was developed in collaboration with Google or another big tech company in the description, which is a red flag.

UPhotoRun is spread on shady websites that are unregulated

More commonly, browser hijackers are spread on shady websites that engage in illegal activities because they are unregulated. They are full of deceptive ads and redirects. That is why you should never install anything from a page that opened randomly. As you can see in the picture above, this is the page that you might have seen. There is no extension name, or what it does.

The website only says that the extension is recommended and that it is available in the chrome web store, to make it seem trustworthy. The best thing you can do is avoid illegal streaming platforms, peer-to-peer file-sharing sites, and other shady sites that are unsafe.

Remove the intruder

Hijacker infections are quite common because people cannot distinguish them from legitimate apps. Luckily, you can remove it the same way as any other browser extension via settings:

Google Chrome

• Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
• In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

MS Edge:

1. Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
2. From the list, pick the extension and click on the Gear icon.
3. Click on Uninstall at the bottom.

MS Edge (Chromium)

• Open Edge and click select Settings > Extensions.
• Delete unwanted extensions by clicking Remove.

Mozilla Firefox

• Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
• Select Add-ons.
• In here, select unwanted plugin and click Remove.

Safari

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Internet Explorer:

1. Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
2. Pick Manage Add-ons.
3. You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.

Once you eliminate the intruder, it is recommended to clear your browsers because of various tracking technologies. Web-based apps can use cookies to track your browsing behavior, like the websites you visit, links you click on, and things you purchase online.

Normally, they are used to personalize the user experience but they can also be sold to third parties and used to target you with ads even more. If the digital products and services you use do not have strong security systems in place, cookies can be hijacked and used for malicious purposes.

That is why it is crucial to regularly clean them and FortectIntego is a perfect tool for that. It can clear your browsers automatically without you having to worry about it. Besides, this powerful software can fix various system errors, registry issues, and corrupted files which is especially helpful after a virus infection.

PUAs are the secret invaders

In some cases, removing only the extension is not enough. You might still experience redirects, pop-ups, and banners appearing in your machine. If that is the case, you might have a PUP hiding in your system which generates commercial content and collects revenue for your clicks.^[3]

Potentially unwanted applications infiltrate the system disguised as “handy” tools or as bundled software – they come attached as a package in the installer together with the intended program. Identifying the app responsible for hijacking your browser might be difficult if you have never done this before. The program could look like antivirus software, system optimizer, media player, video, or image editing software.

If you are not sure what to do and you do not want to risk deleting the wrong files, we suggest using SpyHunter 5Combo Cleaner or Malwarebytes anti-malware tools that will scan your machine, eliminate it, and prevent such infections in the future by giving you a warning before a PUA can make any changes.

If manual removal is what you still prefer, we have instructions for Windows and Mac machines:

Windows 10/8:

1. Enter Control Panel into Windows search box and hit Enter or click on the search result.
2. Under Programs, select Uninstall a program.
3. From the list, find the entry of the suspicious program.
4. Right-click on the application and select Uninstall.
5. If User Account Control shows up, click Yes.
6. Wait till uninstallation process is complete and click OK.

Windows 7/XP:

1. Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
2. In Control Panel, select Programs > Uninstall a program.
3. Pick the unwanted application by clicking on it once.
4. At the top, click Uninstall/Change.
5. In the confirmation prompt, pick Yes.
6. Click OK once the removal process is finished.

Mac:

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

To avoid the installation of PUPs, try avoiding freeware^[4] distribution sites as they include additional programs in the installers that monetize user activity. You can also choose the “Custom” or “Advanced” installation method, so no steps would be hidden from you. Read the Privacy Policy and Terms of Use. The most important part is inspecting the file list up for the installation. Untick the boxes next to any unnecessary programs.