How to Remove Gnk.cipath.net Virus from Internet Explorer/Firefox

Posted on March 20, 2014 by sguides

Gnk.cipath.net has recently appeared on the Net, successfully capturing the browsers of a large number of PCs. Without being authorized by users, the hijacker secretly modifies the original browser settings, forcibly erases users’ preset homepage and replaces the default search page with Gnk.cipath.net. This occurs because the cunning browser hijacker appears much like common search servers, eg, Google Chrome, Mozilla Firefox and Internet Explorer, which confuses uniformed PC users, deceiving them with its tricks.

More detail about Gnk.cipath.net

The Gnk.cipath.net homepage will display advertisements and sponsored links in your search results, and may collect search terms from your search queries. The Gnk.cipath.net hijack is used to boost advertising revenue, as in the use of Black Hat SEO, to inflate a site’s page ranking in search results.

Gnk.cipath.net is technically not a virus, but it does exhibit many malicious traits, such as Rootkit capabilities to stick to the operating system, browser hijacking, and in general just interfering with the user experience. The industry generally refers to it as a “PUP”, or potentially unwanted program.

It is an ad-supported cross web browser plug-in for Internet Explorer (BHO) and Firefox/Chrome (plug-in), distributed through various monetization platforms during installation. Users may see additional banners, search suggestions, pop-ups, pop-unders, interstitial and in-text link advertisements. The browser extension includes various features that will modify the default or custom settings of the browser including the home page and search settings. In some cases will modify Internet Explorer’s load time threshold, place a locked file within Firefox, to prevent competing software form changing its setting, as well as disable the browser’s Content Security in order to allow for cross site scripting of the plug-in.

Gnk.cipath.net homepage may have got into your computer after you installed a freeware software (video recording\streaming, download-managers or PDF creators) that had bundled into their installation this browser hijacker. For example, when you install Vplay, you will also agree to change your browser homepage and default search engine to http://Gnk.cipath.net/. However when you uninstall Vplay from your computer, your web browser’s default settings will not be restored. This means that you’ll have to manually remove Gnk.cipath.net homepage from your favorite web browser.

 How to remove Gnk.cipath.net virus form Internet Explorer/Firefox

To remove the virus, go to Control Panel, Add\Remove Programs list and uninstall it from here. It is recommended to uninstall all programs installed on the same date as problems have appeared. Some versions of this virus install software that blocks browser settings from changing. To identify them, scanning with reputable antispyware tool may be useful. Then you can uninstall the extensions and reset settings in your browsers。

Solution One- Get Rid of Rsearch.ShopAtHome.com Manually

Step One: Remove Rsearch.ShopAtHome.com from browsers.
If you are a skilled computer user, you can try to manually remove Rsearch.ShopAtHome.com Redirect Virus by killing the process of it and things like that. You can follow the steps below to start:

Google Chrome:
a. Navigate to Tools and then Extensions in Chrome browser.

b.In the pop up window, search for the extensions of the virus and remove them.

c. Apply OK.
Mozilla Firefox:
a. Go to Tools >Add-ons.
b.In the Add-on Manager window, and remove all the extensions related to Adsupplyads.com.
c. Apply OK.

Internet Explorer:
a. Go to Tools> Manage Add-ons. In the latest version, you can simply click on Settings button.
b. In Manage Add-ons window, choose Toolbars and Extensions option.

c. Search for and remove all the extensions of the redirect virus.
d. Apply Ok.
Step Two: Completely remove Rsearch.ShopAtHome.com’s leftover files and registry files.
a. Open Windows Task Manager to kill the process of browser redirect virus.

b. Open Registry Editor by clicking Start button and Run, typing “regedit” in the search box and enter.

c. In the opened Registry Editor window, find out and delete all registry entries related to the virus.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[RANDOM CHARACTERS].exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion

d. Delete all files related to the virus.
%AllUsersProfile%\random.exe
%AppData%\Roaming\Microsoft\Windows\Templates\random.exe
%Temp%\random.exe

Conclusion

In order to effectively guard against any virus or malware and to prevent them from invading your PC system, be observant in the operation of your computer. Scan the system frequently, especially if any abnormal phenomena occur. For example, the browser homepage has been changed to some weird websites, or irrespective of what is entered into the search or address bars, appropriate search results do not occur, or many strange pop-ups automatically show on the screen without good reason. Search for any unwanted programs or malware, then uninstall them without hesitation. A most important point is to never blindly agree to attachments to software installations. In most cases these attachments are either PUPs or a virus. Once successfully installed into a computer, it will take advantage of the opportunity to create system chaos.