CornerSunshine is a browser hijacker and potentially unwanted program (PUP) that infiltrates Windows systems to manipulate browser settings and redirect web traffic. Once installed, it forcibly changes your default search engine, homepage, and new tab page to promote affiliated advertising networks and generate revenue through forced clicks and redirects. While not as destructive as ransomware or banking trojans, CornerSunshine creates persistent annoyance, privacy risks, and performance degradation that justify immediate removal.
This hijacker typically arrives bundled with free software downloads or through deceptive advertising that mimics legitimate update prompts. Users often discover the infection when their browser suddenly starts displaying unfamiliar search pages, injecting unwanted ads into search results, or redirecting searches through multiple intermediary domains before delivering results. Beyond the irritation factor, CornerSunshine collects browsing data including search queries, visited URLs, and click patterns—information that gets monetized through affiliate networks or sold to third-party advertisers.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Classification | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Affected Platforms | Windows 7, 8, 8.1, 10, 11 (primarily targets Chrome, Edge, Firefox) |
| Common Aliases | Corner Sunshine, CornerSunshine Search, CornerSunshineBrowser |
| Threat Family | Search hijacker family with adware characteristics |
| Primary Distribution | Software bundling, deceptive installers, fake update prompts |
| Persistence Mechanisms | Browser extension/add-on, scheduled tasks, registry modifications, Group Policy overrides |
| Primary Capabilities | Search redirection, homepage modification, new tab hijacking, ad injection, tracking cookie deployment, browser setting lockdown |
| Data Collection | Search queries, browsing history, clicked links, geolocation data, system information |
| Network Behavior | Redirects through multiple intermediary domains, connects to advertising networks, downloads additional PUP components |
| Typical Filesystem Artifacts | Browser extension folders in user profile, executable components in %LOCALAPPDATA% or %APPDATA%, supporting DLL files |
| Removal Difficulty | Moderate—uses multiple persistence methods that resist simple uninstallation |
| Reinfection Risk | High if bundled software sources remain or if Group Policy modifications aren't reversed |
How It Spreads
CornerSunshine rarely arrives alone or announces itself honestly. The most common infection vector is software bundling, where the hijacker hides inside the installation wizard of seemingly legitimate free programs. Users downloading video converters, PDF tools, download managers, or system optimization utilities from third-party download sites frequently encounter this tactic. The bundle installer presents CornerSunshine as an optional component, but uses dark pattern design—pre-checked boxes, confusing language like "recommended settings," or burying the opt-out option in an "Advanced" or "Custom" installation mode that most users skip.
Deceptive advertising represents the second major distribution channel. Users encounter convincing fake alerts claiming their Flash Player, Java, or browser needs an urgent update. Clicking these prompts downloads an installer that contains CornerSunshine alongside (or instead of) any legitimate software. These fake update pages often mimic the visual design of real Microsoft, Adobe, or Google update notifications, complete with official-looking logos and urgent language about security vulnerabilities.
Less commonly, CornerSunshine spreads through malicious browser extensions promoted via social engineering campaigns or through drive-by download attacks on compromised websites. Once one infection vector succeeds, the hijacker may download additional PUPs or open the door for more aggressive malware families.
- Bundled software installers from third-party download portals (CNET Download, Softonic, etc.)
- Fake update prompts for Flash Player, browser updates, video codecs, or Java
- Deceptive browser extension ads on questionable websites or in social media posts
- Torrent bundles and cracked software packages that include PUPs as "bonus" components
- Email attachments disguised as software installers or document viewers (less common for this family)
- Malvertising campaigns on legitimate websites that redirect to PUP landing pages
What It Does On Your Machine
Immediately after installation, CornerSunshine targets your web browsers with surgical precision. It modifies browser shortcuts to append command-line parameters that force your homepage and search engine to specific URLs. Even if you manually change these settings back through your browser preferences, the hijacker's shortcut modifications override your choices every time you launch the browser. This creates the frustrating loop where settings revert seconds after you fix them.
The hijacker typically installs a browser extension or add-on with names that sound helpful—something like "Search Enhancer" or "Quick Search Tool." This extension enforces the unwanted search provider and may inject additional advertisements directly into legitimate web pages you visit. When you search using your address bar or visit major shopping sites, CornerSunshine intercepts these actions, routes your traffic through affiliate tracking links, and collects data about your browsing patterns. The redirects usually pass through several domains before delivering search results, with each intermediary logging information and potentially serving additional ads.
Beyond browser hijacking, CornerSunshine establishes multiple persistence mechanisms to survive removal attempts. It creates scheduled tasks that periodically check whether its components remain active, re-enabling the hijacker if you disable the extension or restore default browser settings. Some variants modify Windows Group Policy settings to prevent users from changing browser preferences at all, displaying "managed by your organization" messages in Chrome or Edge even on personal computers. Registry modifications ensure the hijacker's executable components launch at startup, consuming system resources even when you're not browsing.
Performance degradation becomes noticeable as the hijacker runs constantly in the background. Your browser loads pages more slowly due to the multiple redirects. CPU and memory usage increases as the hijacker's processes run alongside legitimate applications. You may notice your browser crashing more frequently or freezing when loading search results. The injected advertisements slow page rendering and sometimes trigger security warnings from legitimate antivirus software detecting the ad-injection behavior as suspicious.
Manual Removal — Step by Step
Disconnect Network and Document Current State
Before making changes, disconnect your Ethernet cable or disable WiFi. This prevents the hijacker from downloading additional components during removal and stops data transmission to advertising networks. Take screenshots of your current browser homepage, search engine settings, and any unfamiliar extensions—this documentation helps verify complete removal later and provides evidence if the infection returns.
Boot Into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or Shift+Restart on Windows 10/11, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart > press 5 for Safe Mode with Networking). Safe Mode loads only essential drivers and services, preventing CornerSunshine's startup mechanisms from activating. The "with Networking" option allows you to download removal tools if needed in later steps.
Uninstall Suspicious Programs
Open Settings > Apps (or Control Panel > Programs and Features on older Windows). Sort by install date and look for unfamiliar programs installed around the time your browser problems began. Uninstall anything with "CornerSunshine" in the name, plus any suspicious entries like generic "Search Helper," "Browser Assistant," or programs from unknown publishers. Pay special attention to software you don't remember installing—hijackers often use misleading names that sound system-related.
Remove Browser Extensions and Reset Settings
Open each installed browser and navigate to the extensions/add-ons manager (chrome://extensions for Chrome, about:addons for Firefox, edge://extensions for Edge). Remove any unfamiliar extensions, especially those installed recently or lacking legitimate developer information. Then reset browser settings: in Chrome/Edge go to Settings > Reset settings > Restore settings to their original defaults; in Firefox use Help > More troubleshooting information > Refresh Firefox. This clears hijacked homepages, search engines, and startup pages.
Fix Browser Shortcuts
Right-click your browser shortcuts (on desktop, taskbar, and Start menu), select Properties, and examine the Target field. The correct target should end with the browser executable (chrome.exe, firefox.exe, msedge.exe) with no additional URLs or parameters after it. If you see anything appended after .exe, delete everything after the closing quotation mark around the executable path. Apply the changes and repeat for every browser shortcut on your system.
Delete Hijacker Files and Folders
Open File Explorer and navigate to %LOCALAPPDATA% and %APPDATA% (type these in the address bar). Look for folders named CornerSunshine or containing recently modified files matching the typical artifacts shown earlier. Delete these entire folders. Check C:\Program Files and C:\Program Files (x86) for any CornerSunshine installation directories and delete those as well. Empty your Recycle Bin afterward to permanently remove the files.
Clean Registry and Scheduled Tasks
Press Win+R, type "regedit" and hit Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software and HKEY_LOCAL_MACHINE\SOFTWARE and delete any keys named CornerSunshine. Also check HKCU\Software\Microsoft\Windows\CurrentVersion\Run for startup entries. Then open Task Scheduler (search for it in Start menu), expand Task Scheduler Library, and delete any tasks with "CornerSunshine" or suspicious random GUID names created around the infection date.
Remove Group Policy Restrictions
Press Win+R, type "gpedit.msc" and hit Enter (this works on Pro/Enterprise editions; Home edition users can skip this step). Navigate to User Configuration > Administrative Templates > Google Chrome (or Microsoft Edge). Look for policies that are "Enabled" when they should be "Not Configured," especially those controlling homepage, search engine, or extensions. Set any hijacked policies back to "Not Configured" and close Group Policy Editor.
Run Malwarebytes or Similar Scanner
Reconnect to the internet and download Malwarebytes Free (from malwarebytes.com only—avoid third-party download sites). Install and run a full system scan. Even if you've manually removed obvious components, reputable anti-malware tools catch remaining artifacts, registry entries, or additional PUPs that arrived with CornerSunshine. Quarantine and delete anything the scan identifies, then restart your computer when prompted.
Verify Removal and Change Passwords
Restart normally (not in Safe Mode) and open your browsers. Verify that your homepage, search engine, and new tab pages remain at your preferred settings without reverting. Search for something and confirm you're not being redirected through unfamiliar domains. If CornerSunshine was tracking your browsing for any length of time, change passwords for important accounts—especially banking, email, and shopping sites—using a clean device or immediately after confirming removal. Monitor your system for the next few days to ensure no reinfection occurs.
Prevention
- Download software only from official sources. Avoid third-party download portals like CNET, Softonic, or Download.com that bundle PUPs into installers. Get programs directly from the developer's website or Microsoft Store. When you must use a third-party source, scan downloaded installers with VirusTotal before running them.
- Always choose Custom/Advanced installation. Never click through installer wizards using Express or Recommended settings. Custom installation mode reveals bundled software offers, allowing you to deselect unwanted components. Read each screen carefully—pre-checked boxes and confusing wording intentionally trick rushed users.
- Keep legitimate software updated through official channels. Real updates from Microsoft, Adobe, or browser vendors arrive through their built-in update mechanisms or official websites—never through pop-up ads on random websites. If a website claims you need to update Flash, Java, or your browser, close the tab and check for updates directly through the program or manufacturer's site.
- Use browser-based protection. Enable Chrome's Enhanced Protection, Edge's SmartScreen, or Firefox's Enhanced Tracking Protection. Install a reputable ad-blocker like uBlock Origin to prevent malicious advertisements from loading. These measures block many hijacker distribution methods before they reach your system.
- Maintain real-time antivirus protection. Windows Defender provides decent baseline protection if kept updated, but consider adding Malwarebytes Premium or similar for real-time PUP blocking. Free antivirus often misses browser hijackers because they technically function as "legitimate" software even if unwanted.
- Review installed programs monthly. Set a calendar reminder to check Settings > Apps once a month for unfamiliar programs. Remove anything you don't recognize or no longer use. This catches PUPs early before they establish deep persistence or download more aggressive malware.
- Create restore points before installing software. Windows System Restore isn't perfect, but provides a rollback option if new software brings unwanted hitchhikers. Create a manual restore point before installing anything from an unfamiliar source.
- Educate everyone who uses the computer. If family members or employees share the device, make sure they understand not to click through installers without reading, not to trust update prompts from websites, and to ask before installing new software. Most infections result from rushed decisions, not sophisticated attacks.
Bring It In
Manual removal works if you're comfortable with Registry Editor, Task Scheduler, and Group Policy—but CornerSunshine often hides components that generic instructions miss. Variants evolve, using different folder names, additional persistence mechanisms, or rootkit-like techniques to resist removal. If you've followed these steps and still see hijacked search results, settings reverting, or unfamiliar browser behavior, the infection likely has deeper hooks than home removal can address. Spending hours fighting with this yourself rarely saves money compared to professional service, especially when you factor in your time value and reinfection risk.
We're located at 1122 Houze Way Suite B in Roswell, just off Houze Road near the Roswell Cultural Arts Center. Call (770) 667-9919 to check current wait times—we handle most walk-ins the same day during business hours. Bring the infected computer and we'll run comprehensive diagnostics that check for CornerSunshine remnants plus any additional malware that may have arrived with it. Our flat-rate virus removal service covers everything: complete elimination, privacy cleanup, browser restoration, and those prevention measures customized to how you actually use your computer. You'll leave with a clean system and the knowledge to keep it that way.