Glooszus.info is a browser hijacker that manipulates your web browser's settings to redirect searches and homepage requests through its own deceptive redirect chain. Unlike traditional malware that encrypts files or steals credentials directly, this threat operates in a gray zone—technically classified as a potentially unwanted program (PUP) that generates revenue through forced advertising and affiliate commissions. Users typically encounter Glooszus.info after installing freeware bundles that hide browser modifications in fine print or pre-checked installation boxes, making it spread through deceptive consent rather than technical exploits.
Once installed, Glooszus.info changes your default search engine, homepage, and new tab page to route traffic through its redirect infrastructure. The immediate symptoms include unexpected redirects during searches, unfamiliar search results pages, and browser settings that revert to Glooszus.info even after you manually change them back. While not a traditional virus, this hijacker degrades your browsing experience, exposes you to potentially malicious advertising networks, and makes your system vulnerable to further infections through the unvetted sites it pushes you toward.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Browser Hijacker / Redirect PUP |
| Also Known As | Glooszus redirect, Search.glooszus.info, Glooszus toolbar |
| Platform | Windows (all versions), macOS; affects Chrome, Firefox, Edge, Safari |
| Distribution Method | Software bundling (installers for media players, PDF converters, download managers), fake update prompts, malicious browser extensions |
| Persistence Mechanism | Browser extension installation, modified browser shortcuts with appended URLs, scheduled tasks (Windows), Launch Agents (macOS), registry modifications for default search provider |
| Primary Capabilities | Search redirection, homepage modification, new tab hijacking, advertising injection, browsing data collection (search queries, visited URLs, click patterns) |
| Typical Artifacts | Browser extensions with random names or legitimate-sounding labels, modified LNK shortcut files with target URLs appended, policy-based search engine locks in browser preferences JSON files |
| Network Behavior | Redirects through multiple domains (glooszus.info → intermediate domains → final ad landing pages), connects to tracking pixels and analytics servers, downloads additional advertising components |
| Data Collection | Search queries, visited websites, clicked links, approximate location (IP-based), browser type and version—used for ad targeting and affiliate tracking |
| Removal Difficulty | Moderate; requires browser reset in most cases due to extension policies and preference locks that resist manual changes |
| Associated Risks | Exposure to scam websites, fake tech support pages, additional PUP downloads, credential phishing through fake login pages in ad redirects |
How It Spreads
Glooszus.info doesn't exploit zero-day vulnerabilities or crack encryption—it simply tricks you into installing it yourself. The most common distribution method involves software bundling, where legitimate-looking freeware installers include the hijacker as an "optional offer" buried in a multi-page installation wizard. These installers use deceptive interface design: the hijacker installation is pre-checked by default, hidden under "Advanced" or "Custom" installation options that most users skip, or presented with misleading button labels where "Decline" is visually de-emphasized while "Accept and Install" uses action-button styling.
We see patterns in the types of software that carry Glooszus.info. Free PDF converters, video codec packs advertised on streaming sites, download managers that promise faster speeds, and screen recording utilities frequently serve as the host applications. The installers themselves often come from third-party download sites rather than official vendor pages—users searching for "free [software name] download" encounter ad-driven search results that lead to repackaged installers on file-sharing platforms.
Beyond bundled installers, Glooszus.info spreads through these distribution vectors:
- Fake browser update notifications — malicious websites display convincing but fraudulent alerts claiming your browser is outdated, with a download button that installs the hijacker instead of legitimate updates
- Malicious browser extensions — extensions advertised as productivity tools, ad blockers, or video downloaders that request excessive permissions during installation and immediately hijack search settings
- Compromised advertising networks — legitimate websites unknowingly serve malicious ads (malvertising) that trigger drive-by downloads or redirect to installer landing pages when clicked
- Torrent bundles and cracked software — pirated applications and key generators routinely include browser hijackers as a monetization method for distributors
- Email attachments from unknown senders — less common for this specific hijacker, but some variants arrive as executable email attachments disguised as invoices or shipping notices
- Social engineering on social media — shared links promising exclusive content, prize giveaways, or shocking videos that lead to installer pages
What It Does On Your Machine
Once Glooszus.info establishes itself on your system, it modifies your browser configuration to intercept search requests and page loads. When you type a query into the address bar or use your browser's search box, the hijacker redirects that request through its own infrastructure rather than your intended search engine. The redirect chain typically looks like this: your query → glooszus.info or search.glooszus.info → one or more intermediate tracking domains → a search results page that may resemble Google or Bing but includes injected ads and affiliate links. This multi-hop process allows the operators to collect data at each stage and monetize your search activity through pay-per-click advertising and affiliate commissions.
The technical implementation varies by browser but follows similar patterns. In Chrome and Edge, the hijacker often installs as an extension with permissions to "Read and change all your data on the websites you visit" and "Manage your apps, extensions, and themes." These broad permissions allow it to override your default search engine settings even when you manually change them back. The extension may also inject JavaScript into pages you visit, adding advertising overlays, replacing legitimate ads with its own affiliate versions, or inserting sponsored links into search results. Firefox implementations typically modify the prefs.js configuration file directly and may lock settings using enterprise policies that prevent user changes through the normal interface.
Beyond search redirection, Glooszus.info often modifies browser shortcuts to append command-line arguments that load the hijacker's homepage on startup. If you check the properties of your Chrome or Firefox desktop shortcut, you might see the target path ending with something like chrome.exe" http://glooszus.info instead of just chrome.exe". This ensures the hijacker's page loads every time you launch the browser, even if you've successfully removed the extension or reset your homepage setting. The modification affects all shortcuts—desktop, taskbar, Start menu—requiring systematic cleanup to fully remove.
Data collection represents a significant privacy concern. Glooszus.info tracks your search queries, visited URLs, clicked links, time spent on pages, and browser characteristics (version, installed extensions, operating system). This data builds an advertising profile used to target you with specific ads and to sell to third-party data brokers. The hijacker's privacy policy—if one exists—typically includes vague language granting permission to share "anonymized" data with partners, but the anonymization often means simply removing your name while keeping your browsing patterns intact and linkable to a unique identifier cookie.
Manual Removal — Step by Step
Disconnect and Document Current State
Before making changes, disconnect from the internet if you're experiencing aggressive pop-ups or repeated redirects. Take screenshots of your current browser homepage, default search engine, and installed extensions—you'll use these to verify successful removal later. Write down which browsers are affected (Chrome, Firefox, Edge, Safari) since you'll need to clean each one individually.
Uninstall Suspicious Programs from Control Panel
Open Settings → Apps (Windows 10/11) or Control Panel → Programs and Features (Windows 7/8), then sort by install date. Look for unfamiliar programs installed around the time the redirects started, particularly anything with "search," "toolbar," "browser helper," or names you don't recognize. Uninstall these programs, but note that Glooszus.info often doesn't appear under its own name—look for recently installed items you didn't deliberately add.
Remove Malicious Browser Extensions
In Chrome/Edge, navigate to chrome://extensions or edge://extensions, enable Developer Mode (top right), and review every installed extension. Remove anything unfamiliar or installed recently that you didn't add yourself. Pay special attention to extensions requesting "read and change all your data" permissions. In Firefox, go to about:addons and check Extensions and Themes. Safari users should check Preferences → Extensions.
Reset Browser Settings to Defaults
For Chrome/Edge: Settings → Reset settings → Restore settings to their original defaults. This removes hijacker-installed search engines and resets your homepage while preserving bookmarks and passwords. For Firefox: Help → More troubleshooting information → Refresh Firefox. Safari users: Preferences → Privacy → Remove All Website Data, then Preferences → Extensions and remove unfamiliar items. After resetting, manually reconfigure your preferred search engine and homepage—don't skip this step or the hijacker's settings may persist.
Fix Modified Browser Shortcuts
Right-click every browser shortcut (desktop, taskbar, Start menu), select Properties, and examine the Target field. It should end with chrome.exe" or firefox.exe" with nothing after the closing quote. If you see a URL appended, delete everything after the .exe" including any spaces. Click OK to save. Repeat for all shortcuts or simply delete them and create fresh ones from the Program Files installation folder.
Check and Remove Registry Policy Locks (Advanced)
Press Windows+R, type regedit, and navigate to HKEY_CURRENT_USER\Software\Policies\Google\Chrome and the equivalent Microsoft\Edge key. Look for DefaultSearchProviderSearchURL, HomepageLocation, or similar entries. If present, delete the entire Chrome or Edge policy key (right-click → Delete). This removes policy-enforced settings that prevent manual browser configuration. If you're uncomfortable with registry editing, skip this step and bring the machine to our shop—incorrect registry changes can cause system instability.
Scan with Reputable Anti-Malware Tools
Download and run Malwarebytes (free version works fine) to catch remnants and related PUPs that manual removal might miss. Run a full system scan, not quick scan, and quarantine everything it finds. Follow up with a scan using AdwCleaner (also by Malwarebytes), which specifically targets browser hijackers and advertising-related threats. Restart your computer after quarantining detected items, then run one final verification scan to confirm clean status.
Clear Browser Cache and Cookies
In Chrome/Edge: Settings → Privacy and security → Clear browsing data → select "All time" for time range, check Cookies and Cached images, then Clear data. Firefox: Preferences → Privacy & Security → Cookies and Site Data → Clear Data. This removes tracking cookies that Glooszus.info left behind and ensures redirect chains don't persist through cached redirect pages. After clearing, close and reopen your browser completely.
Change Passwords for Sensitive Accounts
If you entered passwords or accessed banking sites while the hijacker was active, change credentials for those accounts from a clean device or after confirming removal. Browser hijackers can inject keyloggers or credential-stealing scripts into pages, so treat any passwords entered during the infection period as potentially compromised. Prioritize email, banking, shopping, and social media accounts.
Verify Removal and Monitor for Recurrence
Restart your computer one final time and open your browser. Check that your homepage, search engine, and new tab page are set to your preferences and don't revert. Perform several searches and verify you're not redirected through unfamiliar domains. Monitor for the next 48 hours—if redirects return, the hijacker left a persistence mechanism you missed, or you have a deeper infection requiring professional removal. If symptoms recur, don't keep manually cleaning—the infection likely includes components that reinstall each other.
Prevention
- Always choose Custom/Advanced installation options when installing free software, even from sources you trust. Read every screen carefully and uncheck pre-selected offers for toolbars, browser changes, or "recommended" additional software. The five extra seconds per install saves hours of removal work later.
- Download software only from official vendor websites, never from third-party download aggregators, file-sharing sites, or search result ads. Type the vendor's URL directly into your address bar rather than clicking search results, which are often dominated by ad-driven repackagers. For open-source software, use the project's GitHub releases page or official distribution channels.
- Keep a reputable ad blocker and anti-malware tool running with real-time protection enabled. uBlock Origin (browser extension) blocks malicious ads that lead to hijacker installers, while Windows Defender or a third-party antivirus provides baseline protection against known PUP signatures. Update definitions weekly at minimum.
- Verify browser extension permissions before installing and regularly audit installed extensions. If a "video downloader" requests permission to read data on all websites, question why it needs that access. Remove extensions you installed months ago and no longer use—abandoned extensions sometimes get sold to malicious operators who push updates that convert them into hijackers.
- Disable or limit JavaScript on unfamiliar websites using browser settings or extensions like NoScript. While this breaks functionality on some sites, it prevents drive-by downloads and malicious redirects from executing. Whitelist sites as needed rather than allowing all scripts by default.
- Ignore and close browser-based update prompts that appear as pop-ups on random websites. Legitimate browser updates come through the browser's built-in update mechanism (Chrome's three-dot menu → Help → About, for example), never as website pop-ups with download buttons. Train yourself to recognize the difference between authentic in-browser update notifications and fake pop-up alerts.
- Create a standard user account for daily tasks on Windows and reserve your administrator account for system maintenance. Browser hijackers installed without admin privileges have limited ability to modify system-wide settings or install persistent components in protected directories, making removal significantly easier.
- Review browser settings monthly as part of basic digital hygiene. Check your default search engine, homepage, startup pages, and installed extensions even when nothing seems wrong. Early detection of unauthorized changes allows for easier removal before the hijacker establishes deeper persistence mechanisms.
Bring It In
Browser hijackers like Glooszus.info sit in that frustrating category of infections that are straightforward to remove when you know exactly where to look, but maddeningly persistent when you miss even one component. We've seen customers spend entire weekends following online removal guides, only to have the redirects return an hour after they thought they'd won. The hijacker's use of policy locks, modified shortcuts in multiple locations, and browser-specific persistence mechanisms means thorough removal requires systematic checking of a dozen different configuration points across your system. That's where professional removal saves you time and guarantees results.
At Computer Repair Roswell, we handle browser hijacker removal as same-day service in most cases. Bring your machine to our shop at 1865 Woodstock Rd in Roswell, and we'll run our diagnostic protocol to identify not just Glooszus.info but any related PUPs or malware that came bundled with it. We'll clean your system, verify the removal across all installed browsers, patch the entry points that allowed the infection, and optimize your settings to prevent reinfection. If you're unsure whether you're actually infected or just want to ask questions before committing to service, call us at (770) 667-9487—we're happy to walk you through initial diagnostic steps over the phone and let you know whether DIY removal makes sense or professional service is the better investment for your situation.