SearchThatNow Browser Hijacker

SearchThatNow is a browser extension that masquerades as a tool to enhance web search experiences by providing quick access to recent search queries. However, beneath this facade lies a browser hijacker that manipulates browser settings to redirect users to potentially unsafe websites, compromising user privacy and system security.

---

Overview of SearchThatNow Browser Hijacker

Upon installation, SearchThatNow alters critical browser settings, including the homepage, default search engine, and new tab page, redirecting users to the dubious mwsrc4you.com. This redirection often leads to legitimate search engines like Yahoo, but the intermediary steps can expose users to unwanted advertisements and potential tracking.

---

Threat Summary

Attribute	Details
Threat Type	Browser Hijacker, Redirect, Search Hijacker, Toolbar, Unwanted New Tab
Associated Domain	mwsrc4you.com
Detection Names	Not available
Symptoms of Infection	Altered homepage and search engine settings, unexpected redirects, appearance of unfamiliar browser extensions, increased pop-up ads, and potential slowdown in browser performance.
Damage & Distribution	Compromises user privacy by tracking browsing habits, collects personal data, and distributes through deceptive pop-up ads and bundled software installations.
Danger Level	Moderate
Removal Tool	SpyHunter

---

In-Depth Analysis

How Did I Get Infected?

SearchThatNow often infiltrates systems through deceptive means, such as being bundled with free software downloads or through misleading advertisements that prompt users to install the extension under the guise of enhancing their browsing experience.

What Does It Do?

Once installed, SearchThatNow takes control of browser settings to redirect users to mwsrc4you.com. This site may further redirect to legitimate search engines, but the initial redirection allows the hijacker to track user behavior, collect data, and display targeted advertisements. The extension may also employ persistence techniques to prevent easy removal, such as reverting changes made by the user to browser settings.

Should You Be Worried?

Yes. While SearchThatNow may not directly harm your system, its ability to track your browsing habits, collect personal information, and expose you to potentially malicious advertisements poses significant privacy and security risks. Additionally, the difficulty in removing the hijacker can lead to prolonged exposure to these threats.

---

Option 1: Manual Browser Hijacker Removal

Step 1: Uninstall Suspicious Software

For Windows:

1. Press Windows + R, type appwiz.cpl, and press Enter.
2. Look for recently installed or unknown software.
3. Select the suspicious program and click Uninstall.
4. Follow the uninstaller’s prompts.

For Mac:

1. Open Finder > Applications.
2. Locate any unfamiliar apps you didn’t intentionally install.
3. Drag them to the Trash.
4. Right-click the Trash and select Empty Trash.

---

Step 2: Reset Each Web Browser Affected

Google Chrome:

1. Go to chrome://settings/reset.
2. Click Restore settings to their original defaults > Reset settings.
3. Then, visit chrome://extensions and remove any suspicious add-ons.
4. Change your search engine:
   Settings > Search Engine > Manage search engines — remove unwanted entries and set a trusted one like Google.

Mozilla Firefox:

1. Click the menu icon (three lines) > Help > More Troubleshooting Information.
2. Click Refresh Firefox.
3. After reset, check Add-ons and Themes and remove unwanted extensions.
4. Navigate to Settings > Home/Search and revert changes to your preferred provider.

Microsoft Edge:

1. Click menu (three dots) > Settings > Reset Settings > Restore settings to their default values.
2. Open edge://extensions and remove any unfamiliar plugins.
3. Reconfigure your homepage and search engine if needed.

Safari (Mac Only):

1. Open Safari > Click Safari in the top menu > Clear History (select All History).
2. Go to Preferences > Extensions, remove unknown entries.
3. Under General, set your homepage.
4. Under Search, revert to your preferred search provider.

---

Step 3: Check and Clean Your Hosts File

On Windows:

1. Open Notepad as Administrator.
2. Go to:
   C:\Windows\System32\drivers\etc\hosts
3. Look for unknown IPs or domains — remove them.
4. Save changes and reboot.

On Mac:

1. Open Terminal.
2. Run: sudo nano /etc/hosts
3. Identify and remove hijacker entries.
4. Press Control + O to save and Control + X to exit.

---

Option 2: Automatic Removal Using SpyHunter

If you want a faster and safer solution — especially if the hijacker reinstalls after manual removal — use SpyHunter, a trusted anti-malware tool.

Step 1: Download SpyHunter

Visit the official download page: Download SpyHunter

Need help with the installation? Follow this page: SpyHunter Download Instructions

Step 2: Install and Launch the Program

1. Run the installer and follow the steps for your OS.
2. Open SpyHunter after installation.

Step 3: Perform a Full System Scan

1. Click Start Scan Now.
2. Wait while SpyHunter analyzes your computer for browser hijackers, malware, and other PUPs.
3. Once the scan completes, click Fix Threats to eliminate them.

Step 4: Reboot and Recheck Your Browser

After cleaning, restart your device. Open your browser and check if your homepage and search settings are restored. If not, perform a quick browser reset using the manual steps above.

---

How to Prevent Future Infections

• Avoid downloading freeware from third-party sites.
• Use custom/advanced installation and deselect optional offers.
• Keep your browser and OS updated.
• Regularly scan your system with SpyHunter for proactive defense.
• Don’t click strange pop-ups or redirect links from unknown sources.

Conclusion

SearchThatNow is a deceptive browser hijacker that compromises user privacy and alters browser functionality under the pretense of enhancing search capabilities. Its presence on your system can lead to unwanted data collection and exposure to potentially harmful content. Prompt removal using a reputable anti-malware tool like SpyHunter is recommended to restore your browser settings and protect your personal information.