Copypast.ru “Virus” Removal (Chrome/Firefox)

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.


This page aims to help you remove Copypast.ru “Virus”. These Copypast.ru “Virus” removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

In the article below we will be describing a very annoying program in detail. It is called Copypast.ru and may cause the full modification of your browser’s appearance and behavior. Among the consequences of its actions we can name sudden redirecting to different online locations; the constant generation of pop-up and other various ads, no matter whether you are using Chrome, Firefox, Explorer, or any other popular browser, as well as unauthorized substitution of your favorite homepage and search engine with new ones. All the other details of this browser hijacker are available in the following paragraphs.

When it comes to hijackers, it is very important to mention that these products are only capable of infecting your browsers and have nothing to do with viruses. Their activities are simply marketing-driven and all the alterations that they may induce can be explained by the fact that their creators have been paid to promote a certain website, search engine, product, homepage or service. Such programs are legitimate and could be regarded as ad-generating ones like Adware.

Copypast.ru Browser Redirect

Copypast.ru Browser Redirect

What distinguishes Copypast.ru from a version of malware?

Typical viruses, like the ones based on Trojans or Ransomware, will perform some very dangerous activity, once installed on your PC. Some of them could encrypt files, others may destroy them or format all your disks. Some viruses harass you into paying ransom, while others could drain your bank accounts. Some target data, others – your identity. You cannot expect anything like that from Copypast.ru. What it could sometimes do is check your latest online search requests and adjust the generation of ads to your recent interests and searches. This could at first appear to be intrusive, however, such research could sometimes prove to be useful to you. In this way you will automatically get the best offers that interest you. Still, some users perceive such a review as shady and are afraid that some pop-ups might actually lead to contaminated web pages. That’s one of the reasons why browser hijackers have the reputation of potentially unwanted programs.

Potential ways of catching Copypast.ru (and other hijackers)

Browser hijacker could be found almost everywhere on the Internet. They might be parts of torrents or they might be incorporated into different websites. They might get distributed via spam or fake ads. The most common source, though, are (typically free) program bundles on the web. As you may expect, a bundle is many different programs bundled and spread together. Inside one there may be games, apps, Adware-based programs, hijackers and many other types of software. Please remember that downloading a bundle is not the actual cause for an infection. Installing it improperly is. The simplest way to avoid getting affected by a browser hijacker from within a bundle is by implementing the installation of any newly downloaded program in a certain way. When the installation wizard comes up, you will see the available installation options. From the ones that you see, look for the Advanced (sometimes Custom) one. Use only that one to complete the process. That is how you will get to choose what parts of the bundle to install and what to neglect. Make sure that you try to avoid all other installation features. They may have various names – Brief, Typical, Default, Automatic, Quick. They are not good for your system, as by using them you have no choice of what to leave behind and what to incorporate into your system.

Some more advice on prevention

Apart from the aforementioned way of installing any piece of software that you want to try or use, following these steps might greatly minimize the risks of getting an ad-generating program:

  • Avoid all the other potential sources of hijackers.
  • Make sure your operating system functions well and is up-to-date.
  • Check whether you have a good anti-virus program. If not, purchase one. Some of them could warn you about possible sources of ad-producing programs.
  • Maybe turning on your pop-up blocker will be a good idea. Just bear in mind that it will only stop the webpage-hosted advertisements.
  • Check whether your Firewall is functional. If not, update it/ enable it. In some cases it may block some of the infection causes.
  • Mind the places that you visit online. Develop healthy browsing habits.

In case the infection has already occurred, we recommend following the steps of our Removal Guide below to locate and remove all Copypast.ru-related files.

SUMMARY:

Name Copypast.ru
Type  Browser Hijacker
Danger Level Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms Full modification of your browser settings. After that you may face a changed homepage and search engine; intense generation of pop-ups and other ads, as well as redirections to various web locations.
Distribution Method Many possibilities including bundles; spam; shady websites; contagious ads; torrents; shareware.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

 

Copypast.ru “Virus” Removal


Step1

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

Step2

WARNING!
To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Reveal All Hidden Files and Folders.

  • Do not skip this  – Copypast.ru may have hidden some of its files.

Hold together the Start Key and R. Type appwiz.cpl –> OK.

appwiz

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:

msconfig_opt

Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

Step3

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.

DNS

Step4

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

browser-hijacker-taskbar-properties

Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Copypast.ru from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Copypast.ru from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove.
chrome-logo-transparent-backgroundRemove Copypast.ru from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.

  • At this point the threat is gone from Chrome, but complete the entire guide or it may reappear on a system reboot.

Step5

Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are dangerous. Google them or ask us in the comments.

WARNING! READ CAREFULLY BEFORE PROCEEDING!

This is the most important and difficult part. If you delete the wrong file, it may damage your system irreversibly. If you can not do this,
>> Download SpyHunter - a professional parasite scanner and remover.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Right click on each of the problematic processes separately and select Open File LocationEnd the process after you open the folder, then delete the directories you were sent to.

malware-start-taskbar

Step6

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

Remember to leave us a comment if you run into any trouble!

Was this guide helpful?

  • Esther

    I have localhost as a suspicious IP. What do I do?

     
    • HowToRemove.Guide Team

      Hi Esther,
      you can post some of them here or provide us with a screenshot so we can check them.