Tohotweb Virus


Tohotweb

This article aims to help users remove Tohotweb Virus from Chrome, Firefox, Internet Explorer and uninstall it from their system. It redirects to tohotweb.com – a domain specifically targeted by browser hijackers lately. “Supprimer tohotweb” is something we’ve been seeing a lot in our inbox, signifying the majority of infections are targeted at France.

tohotweb virus

 

The virus is commonly accompanied by a message that the program has a problem starting c:usersXXX (User Name)appdatalocal extensionlogoxbinextensionlogo.dll

If your computer has been infected by Tohotweb Virus then you are probably seeing a lot of advertisements (Ads) that fill your screen every time you try to use your internet browser. This behavior is typical for a type of malicious programs referred as Adware and that’s what Tohotweb Virus really is. The main goal of Adware applications is to generate revenue for whoever created them, but they are also commonly used to distribute viruses and bloatware among infected computers. Whatever the case with Tohotweb Virus may be you need to be aware of two very important facts:

  1. Tohotweb Virus is a malicious application and does not have your best interests at heart
  2. The sooner you get rid of it the lower the risk of it installing another Adware or other virus on your machine

Don’t click on the Ads and definitely don’t download or install anything prompted by Tohotweb Virus

The Ads created by Tohotweb Virus are not really dangerous by themselves – in fact they are mostly bait. They are there to lure and deceive you into giving authority to the virus in order to modify your computer. Further remember that reputable online communities and shop do not ordinarily use the services of shady advertising products like tohotweb.com. If you click on those Ads there is no telling where you will be taken to. Virus infected sites, phishing scams are just to name the few. So stay away from the Ads until we remove supprimer tohotweb from your computer.

Supprimer tohotweb

Sites promoted by the Ads are not the only danger you face while dealing with supprimer tohotweb. It might try a more direct approach – to make you download and install an executable it offers you. This is usually done through the clever use of Ads, who are made to appear just like system messages. You may suddenly start seeing warnings that programs on your computers have expired (like Flash/Java) and need un update, or that there is a missing plug-in that needs to be downloaded or that maybe you require a certain video codec/player in order to see movie online – all of this is the work of Tohotweb Virus. The virus seeks to push you into downloading and installing the supposedly required items, which are, of course, viruses.

Another tricks in the same book involves reports by “free online scanners” that have detected problems with the registry, with the memory, registries, HDD health or similar. You are then required to download the application so it can fix the issue. There is no such thing as an online scanner that scans your computer WITHOUT asking for permission first. Remember this fact, as this scam can be seen in a lot of places around the internet.

Hopefully this knowledge will help you keep your computer safe from tohotweb.com and now it’s time to begin the removal process.

SUMMARY:

Name Tohotweb
Type Browser Hijacker
Detection Tool

Remove Tohotweb Virus

You are dealing with a malware infection that can restore itself unless you remove its core files. We are sending you to another page with a removal guide that gets regularly updated. It covers in-depth instructions on how to:
1. Locate and scan malicious processes in your task manager.
2. Identify in your Control panel any programs installed with the malware, and how to remove them. Search Marquis is a high-profile hijacker that gets installed with a lot of malware.
3. How to clean up and reset your browser to its original settings without the malware returning.
You can find the removal guide here.


About the author

Violet George

Violet is an active writer with a passion for all things cyber security. She enjoys helping victims of computer virus infections remove them and successfully deal with the aftermath of the attacks. But most importantly, Violet makes it her priority to spend time educating people on privacy issues and maintaining the safety of their computers. It is her firm belief that by spreading this information, she can empower web users to effectively protect their personal data and their devices from hackers and cybercriminals.

29 Comments

  • Sorry but what am i supposed to when on below stage?

    HKEY_CURRENT_USER—-Software—–Random numbers
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

    Is “unknown” manufacturer could be “default”?

    • You go in regedit and then in these directories, search for the registry key that contains the virus and then delete it. But be very careful to not delete the wrong thing or you may end up having to restore/reinstall your system.

  • Sorry but after following all the steps… it still shows on the homepage.. so i just found a solution… might b temporary but worked for me. It only infects ur browser shortcut so replace it with original or u will b fooled by operating ur browser from a fake icon.
    (1) go to the installed directory of browser and create a desktop shortcut of that original application.
    (2) delete the previous icon from desktop and from taskbar or whereever u use ro open it from.
    (3) now open the new shortcut and u will c no tohotweb.

  • I have done everything as you wrote it . Found everything and I was able to delete the virus! Thanks :
    😀 😀

    • Are you comfortable sharing these IPs? Maybe they are dangerous, maybe not. Legitimate software and websites can also be there. The only way for me to know is if you post them here. But make sure NOT to post your own IP.

  • HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run there is no random string….

  • Thank you for your instructions. I’ve followed your steps, but when I start up Chrome it still navigates directly to tohotweb.com/?oem=sunadcav3&uid=S45N7172Z1ZSEA016186_LITEONITLCS-256M6S&tm=1448324993 I’m not sure what else I can do to stop this.

    • Download the scanner from our advertisements. See if it tracks Tohotweb’s files. If you can, delete them on your own from there, if not, say something here and I’ll try to help you another way.

  • Windows key +R and copy paste notepad%windr%/system32/Drivers/etc/hosts
    And after that it gives me :
    No apps are installed to open this type of link(notepadc)
    -> look for an app in the store
    -> ms-windows-store:Assoc?protocol=notepadc
    This app can’t be activated by the Built-in Administrator

    What am i gonna do now to fix it ?

    • Hello Quang,

      try to repeat this step, maybe you missed something. If not, then try to proceed with the next steps. Also you can try installing the professional software listed in the article, the search function is free and it can pinpoint all infected files you have. Let us know how that goes so we can try and assist you.

  • Here’s what you need to do: Open Start Menu and copy-past the following path in the search bar – notepad %windir%/system32/Drivers/etc/hosts . After you do that, right-click on the first result and then select Run As Administrator. This will enable you to change the file and save it wherever you want.

  • Hello. We’d like you to send us a screenshot of what you see in order to get a better idea about what your current situation is.

  • Hello, Mohammad. You must delete all of those from your Hosts file and save the changes afterwards since those IP’s are certainly coming from the unwanted software. You can tell us in the comments if this was enough to fix the issue or if you need further support.

  • Hi,

    I originally tried following along with your YouTube video, but was not clear on what to do after opening “regedit”. Your written guide however was easier to follow, and I believe I have successfully removed this bugger of a virus after putting up with it for over four years! I also downloaded SpyHunter, as per your recommendation, to prevent the virus from coming back.

    I would like to expand on step 6 for others attempting to follow this guide. After pressing Ctrl + F in regedit, I had to search for “tohotweb” several times before I could locate and remove all of the virus’s files. I am not sure why all files containing the virus’s name would not appear in one list after a single search so that you can delete them all simultaneously? But I continued searching, and deleting, until no more results appeared in the registry.

    Thank you for taking the time to publish this guide, and good luck to everyone who is attempting to follow it. So far, so good! : )

    -Ty

Leave a Comment