Qone8.com obtrusively meddles with one’s online surfing by hijacking the web browser on the affected computer. Ultimately, this activity leads to your default homepage getting modified (to start.qone8.com) and your web search provider changed in a forcible fashion (to search.qone8.com). Moreover, no matter how hard you try to manually restore the right preferences, Qone8 will keep coming back despite your effort.
Whereas the web page concerned has not actually been found malicious, the sole fact of this URL popping up without your consent is a nuisance in itself; furthermore, the associated symptoms are likely to testify to the presence of adware or other malicious code inside your machine. As the recent security research shows, this hijacker tends to emanate from downloads or updates of certain applications, some examples of which are Omiga-Plus, GoPlayer and Desk 365. A distinguishing trait of this adware is that it’s not labeled as Qone8 or anything similar in the Control Panel or amongst your browser add-ons. Instead, the extensions responsible for homepage and search engine replacement are third-party ones, most likely something you installed recently.
The underlying reasons for Qone8.com jacking up your web browser are all about gaining illicit online advertising revenue. Entering a particular query will in fact return search results, but quite a few ads alongside as well. Furthermore, up-to-date information about Internet users’ search preferences is fairly valuable for advertising companies, so it’s basically a product for sale which is in great demand. Therefore, by enforcing the use of their own search engine in such an unethical way, the people behind it are obviously seeking profit from generating traffic to certain online services.
Getting rid of this hijacker and stopping it from further web surfing interference is a matter of several phases. First off, you will need to utilize an automatic cleanup tool to detect and eliminate the malicious code proper. Then it’s recommended to double-check and verify whether the issue has been completely addressed, and if certain side effects are still there – manually restore the affected web browser to its normal state by remediating the changes previously made by Start.qone8.com adware.
CCleaner by Piriform is an efficient solution designed to automatically uninstall persistent malware such as the unwanted browser extensions related to Qone8 hijacker, as well as cease the web surfing redirect activity.
1. Download free or paid version of CCleaner by Piriform and save it to your Desktop. Install and run the software.
System Requirements: Runs on Microsoft Windows XP, Vista, 7, 8 and 8.1. Including both 32-bit and 64-bit versions.
2. Click on the Cleaner button in the left-hand navigation menu, select Windows and Applications tabs in turn, and click Analyze option for each. Once the analysis has been completed, click Run Cleaner.
3. Now go to Tools in the navigation menu and select the Startup option. Search the entries under all available tabs (Windows – Context Menu) for dubious items that might be related to Qone8 adware (Wsys Control, DProtect, Omiga-Plus, etc.) and choose Disable and Delete for each one.
4. You can also use the Uninstall functionality under Tools to completely get rid of browser add-ons / toolbars that cannot be deleted manually.
5. Uninstall malicious extension(s) from Control Panel:
• On Windows XP: go to Start –> Control Panel –> Add/Remove Programs
• On Windows Vista / 7: go to Start –> Control Panel –> Uninstall a Program
• On Windows 8: click on Search icon –> type in ‘add or remove‘ (this will suffice) –> select Add or remove programs
When on the dedicated screen for program removal, look for the following items:
- Desk 365
- Extended Protection
- Wsys Control
- eSave Security Control
- New Tabs Uninstall
If located on the list, these should be uninstalled immediately as they were found to cause search.qone8.com to show up in one’s web browser. Anything like Qone8 proper is not likely to be indicated on the list, so do not bother searching for it. It’s affiliated programs / extensions to blame.
• In the Firefox address field, type in ‘about:config‘ (without quotes) and press Enter
• You will see a message reading “This might void your warranty!”. Click “I’ll be careful, I promise!”
• In the Filter box, type in ‘Qone8‘
• The filter will come up with all entries related to the relevant modified preferences. What you should do is right-click on each one and select Reset option.
• Now you need to remove Qone8 URL from your Mozilla shortcut’s target. Right-click on the Firefox shortcut and choose Properties. Click on the Shortcut tab and delete http://start.qone8.com from the Target field.
• Save the changes.
• Click the Customize and control Google Chrome option and pick Settings in the drop-down menu
• Within the On startup section, select Set pages
• The interface will list your startup pages. Locate the entry related to Qone8 and click the X button next to it in order to remove it.
• Navigate to the Appearance section under Settings, put a check mark next to Show Home button option, and click Change
• Activate the Use the New Tab page radio button and click OK
• Go to the Search section and click Manage search engines…
• Make a desired search engine your default one, other than Qone8 of course. Then click the X button next to Qone8 to remove it from the list.
• Since the hijacker modifies browser shortcut settings as well, you need to undo these changes. Right-click on Google Chrome shortcut and choose Properties. Select the Shortcut tab and delete http://start.qone8.com from the Target field.
• Click OK to save the changes made.
• Select Manage add-ons from the Tools menu
• In the Manage add-ons window, click on Search Providers item in the left-hand part of the screen. Choose your preferred search provider from the list and click Set as default.
• Click on Qone8 in the list of search providers and then click Remove at the bottom.
• In order to fix the shortcut for Internet Explorer, right-click on it and select Properties.
• When the Properties screen opens up, click on the Shortcut tab at the top and delete http://start.qone8.com from the Target area, so that only the executable process for IE remains in there.
• Save the changes
• Go to Tools –> Internet options –> select General tab.
• Set your homepage to a preferred value (URL) and click OK to save the changes.
Screenshots from Remove Qone8.com virus.