Trafcfy is a rogue website that users get redirected to if they have a hijacker installed in the browser or if they’ve unknowingly permitted the site to show notifications. Some users report that the site gets blocked by Avast which results in a warning message that appears every time a redirect to Trafcfy.com is attempted.
It seems that this is another typical case of a hijacker website, similar to Boyu.com.tr or Skyjem, that tries to take over the browser with the goal of accumulating traffic, gathering user data, or promoting other sites. In any case, it’s both an annoyance and a security risk, but the good news is we can provide you with a tested guide on how to remove it.
Trafcfy.com Removal Tutorial
Sites like nl78.trafcfy.com are typically enabled by something installed in the browser, such as a rogue extension. They often leverage the policies feature of Chromium browsers to prevent users from prohibiting their redirects and reversing any other changes they’ve made in the browser. This is why you might see a “Managed by your organization” message in Chrome if the Trafcfy hijacker has gotten in the browser.
If you don’t see this message in Chrome, stopping the redirects and removing the hijacker should be relatively easy. The instructions on how to do it are shown in the second section of this guide. However, if your browser is locked by rogue third-party policy, you’ll first have to unlock it by following the next steps.
Get Rid of Trafcfy Chrome “Managed by…” policies
In case you are unable to make changes to your browser’s settings or remove a particular extension related to Trafcfy because the browser is “Managed by your organization”, you must first remove that policy. We’ll provide you with several effective ways to do this, combining them in a single policy-removal guide:
Use the Start Menu to search for “Edit Group Policy” and open it.
Go to Local Computer Policy > Computer Configuration, right-click Administrative Templates, and select Add/Remove templates. Delete everything in the window that shows up.
Go to your browser, type “*BrowserName*://Policy” (for example Chrome://Policy) and press Enter.
Look for policies with values made of random numbers, copy those values, and save them for later.
Open the browser menu, go to the Extensions Manager, enable Developer Mode, and copy and save the IDs of any extensions you want to remove because you think they are linked to Trafcfy.
Press Winkey + R, type regedit, and press Enter. In the Registry Editor, select Edit > Find > paste the saved Policy value > Find Next.
Delete the folder (key) containing the item that is found, search again, delete the next folder/key, and keep doing that until all relevant results are deleted.
Perform the same thing with other policy values and extension IDs that you saved.
Also, delete the following registry keys if they exist:
Next, search for Folder Options in the Start Menu, open it. go to View, check Show Hidden Files and Folders, and click OK.
Then navigate to C: > Windows > System32 and delete the following two folders from there: GroupPolicy and GroupPolicyUsers.
Winkey + R again, type cmd > Enter.
Type and run the following command: gpupdate /force.
Finally, download Chrome Policy Remover > Right Click > Run as Administrator. If you get a Windows warning > More Info > Run Anyway. Wait for the script to run and close the cmd window.
With all this done, your browser should be clean of any rogue third-party policies, and you can proceed to clean it from unwanted extensions and settings changes.
7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.
Remove nl78.trafcfy.com From the Browser
There are two likely reasons why you are getting the nl78.trafcfy.com redirects. The first is a rogue extension that’s enabling the redirects and the second is a browser permission given to the site. In either case, you must thoroughly clean the settings of your browser to ensure there’s nothing left in it associated with this rogue website.
These are the steps you must perform. They are for Chrome, but even if you are using a different browser, you’ll need to visit and clean the same types of settings:
In Chrome (or another browser), open the browser menu, and go to Settings.
First visit the Extensions page and look for any suspicious, unfamiliar, or unwanted extensions and remove them.
Next, open Privacy and Security> Delete Browsing Data > Advanced. Pick a time period that extends back to a time before you started getting the Trafcfy pop-ups, then check all boxes except the Passwords one, and click Delete Data.
Next, open Site Settings from below, open Notifications and see what sites are listed in the Allow section. Do you see Trafcfy.com in there? If yes, select the three dots next to it and click Remove. Also do the same with any other questionable addresses.
Then check the other types of site permissions and clean them too.
Go to Appearance from the left, check it for Trafcfy.com or other suspicious URLs, and delete anything you don’t trust. Do the same thing in the On Startup Tab.
Go to Search engines, select Google or another trusted site as your default search tool, and then click Manage search engines.
Delete any unfamiliar or suspicious addresses from the list of search tools.
Open File Explorer and navigate to C:\Users\*YOUR_USERNAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions.
Delete any extension folders with names that match the extension IDs you saved earlier.
Finally, delete the Google folder located in C: > Users > *YOURADMIN USER FOLDER* > AppData > Local.
After you’ve done all this, the hijacker should be gone from your PC and you should no longer be bothered by the Trafcfy redirects.
In case you are still getting redirected to nl78.trafcfy.com (or your AV is blocking it and constantly showing you warning notifications), then we recommend using SpyHunter (the anti-malware tool posted on this page) to clean your browser and PC from any hijacker leftovers. SH is designed to hunt down and deal with such annoyances, so you can count on it to take care of Trafcfy.
Note that despite how detailed our guide is, hijackers and rogue sites like this one often change and evolve their methods evading removal, so the manual steps explained here may not always have the same level of effectiveness.
Why Are You Getting Trafcfy Pop-ups?
Users are often confused as to why they suddenly start getting the Trafcfy.com redirects or warnings from their AV about this site. Indeed, hijacker websites like this one will often use very subtle techniques to gain a foothold in the browser. A single misguided click on an “Allow” button when visiting a particular ad-heavy site can result in letting your browser be controlled by a hijacker.
It’s also not uncommon for regular and legitimate extensions to get an update that enables them to trigger automatic redirects to different sites, some of which could be untrusted ones like Trafcfy.
Then there’s also the file bundling method, which lets rogue extensions and search engines be installed in the browser alongside other programs. Victims of this method are most commonly users who download game mods for Roblox and Minecraft, ROMs for game emulators, and pirated programs and games from sites like SteamUnlocked and SteamRIP. Needless to say, being careful with what you download and where you download it from is crucial to keeping your PC and browser clean from Trafcfy and other similar hijackers.
About the author
Brandon Skies
Brandon is a researcher and content creator in the fields of cyber-security and virtual privacy. Years of experience enable him to provide readers with important information and adequate solutions for the latest software and malware problems.
OFFER
Leave a Comment