Grewquartersupporting.com is a browser hijacker and potentially unwanted program (PUP) that redirects your web traffic through a deceptive search engine and modifies browser settings without proper consent. This threat typically arrives bundled with free software downloads and immediately takes control of your homepage, default search engine, and new tab page. While not as destructive as ransomware or banking trojans, browser hijackers like Grewquartersupporting.com create persistent annoyances, expose you to malicious advertising networks, and collect your browsing data for monetization purposes.
The primary concern with this hijacker is not just the frustration of altered browser settings—it's the potential exposure to further threats. Grewquartersupporting.com routes your searches through redirect chains that can lead to phishing sites, fraudulent tech support scams, and pages hosting drive-by download exploits. Additionally, the extension or helper objects it installs to maintain persistence make legitimate removal attempts surprisingly difficult for average users.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Browser Hijacker, Potentially Unwanted Program (PUP) |
| Family | Generic browser redirect malware |
| Aliases | Grewquartersupporting redirect, Grewquartersupporting.com hijacker |
| Affected Platforms | Windows 7/8/10/11, macOS (Chrome, Firefox, Edge, Safari) |
| First Documented | Circulating since approximately 2022 |
| Distribution Method | Software bundling, fake updates, malicious browser extensions |
| Persistence Mechanism | Browser extension installation, registry modifications (Windows), Launch Agents (macOS), scheduled tasks |
| Primary Capabilities | Homepage hijacking, search redirection, ad injection, tracking cookie deployment, browser setting lockdown |
| Data Collection | Search queries, browsing history, clicked links, geolocation, device identifiers |
| Network Behavior | Connects to advertising networks and redirect domains; search queries routed through grewquartersupporting.com before secondary redirects |
| Typical Indicators | Browser homepage forced to grewquartersupporting.com; settings revert after manual changes; unknown extensions present |
| Removal Difficulty | Moderate—requires removal of extension, registry/plist cleanup, and browser reset |
How It Spreads
Grewquartersupporting.com rarely arrives alone. The most common infection vector is software bundling, where the hijacker piggybacks on seemingly legitimate free software installers downloaded from third-party sites. Many users rush through installation wizards using "Express" or "Quick Install" options without noticing the pre-checked boxes that authorize additional programs. The hijacker's installer is deliberately worded to make it appear as a helpful browser enhancement or security tool.
Fake software updates represent another major distribution channel. You might encounter pop-ups claiming your Flash Player, browser, or video codec is out of date—clicking the update button actually downloads the hijacker bundle. These deceptive prompts often appear on questionable streaming sites, torrent pages, and adult content platforms. The fake update prompts are designed to mimic legitimate software vendor notifications, complete with corporate logos and official-sounding language.
Common distribution methods include:
- Bundled freeware and shareware from download portals like Softonic, Download.com, or Brothersoft
- Fake Flash Player or browser updates delivered through malicious advertising on compromised websites
- Malicious browser extensions advertised through social media or search ads with names suggesting productivity or security benefits
- Email attachments disguised as document readers or file converters
- Torrent bundles where cracked software packages include the hijacker as a "bonus" component
- Compromised websites that use exploit kits to push the installer through browser vulnerabilities (less common for this specific threat)
What It Does On Your Machine
Once installed, Grewquartersupporting.com immediately modifies your browser configuration to ensure all web searches and homepage loads route through its controlled infrastructure. On Windows systems, it typically deploys both a browser extension and a helper application installed to your AppData folder. The helper application runs as a background process that monitors your browser settings—if you manually change your homepage back to Google or another preferred search engine, the helper process detects this within seconds and reverts the change. This watchdog behavior is what makes these infections so frustrating for users attempting DIY removal.
The hijacker's primary monetization model relies on search redirect revenue. When you conduct a web search, your query travels to grewquartersupporting.com first, which logs your search terms and browsing patterns before redirecting you through one or more intermediate domains. You might eventually land on Bing, Yahoo, or a white-label search engine, but by then the hijacker operators have earned referral fees from the redirect chain. Along the way, tracking cookies are planted in your browser to build an advertising profile based on your interests.
Beyond search hijacking, many variants inject advertisements directly into legitimate websites you visit. You'll notice extra banner ads appearing on sites that normally don't display them, or text within articles suddenly becoming hyperlinked to sponsored content. Pop-unders (advertisement windows that hide behind your browser) are also common. While browsing shopping sites, you might see overlay coupons or deal notifications that appear to come from the retailer but actually originate from the hijacker's ad network.
The data collection aspect deserves particular attention. Grewquartersupporting.com and similar hijackers vacuum up your complete browsing history, search queries, websites visited, links clicked, time spent on pages, and sometimes even form data you enter (though full form harvesting is less common with this particular family). This data gets aggregated and sold to advertising networks, with some variants also checking for installed software and system specifications to build a more valuable data profile. While this typically isn't as dangerous as banking trojan credential theft, it still represents a significant privacy violation.
├── service.exe (watchdog process, 1.2-2.5 MB)
├── uninstall.exe
└── config.dat
C:\Users\[Username]\AppData\Roaming\Mozilla\Firefox\Profiles\[profile]\extensions\
└── {extension-id}@grewquartersupporting.com
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"BrowserAssistant" = "C:\Users\...\AppData\Local\{GUID}\service.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{CLSID-varies}
HKLM\Software\Policies\Google\Chrome\ExtensionInstallForcelist
[extension-ID] (forces reinstall of extension)
Task Scheduler: "Browser Update Service" (recreates files if deleted)
Manual Removal — Step by Step
Disconnect and Document
Disconnect your computer from the internet—unplug the ethernet cable or disable Wi-Fi. This prevents the hijacker from receiving commands, downloading additional components, or exfiltrating data during removal. Take note of what symptoms you're experiencing (changed homepage, specific pop-ups, unusual extensions) as this helps verify complete removal later.
Boot Into Safe Mode with Networking
Restart your computer into Safe Mode to prevent the hijacker's watchdog process from running. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart and select "Safe Mode with Networking" (option 5). On Mac, restart and immediately hold Shift until the login screen appears. Safe Mode loads only essential system components, making malware removal significantly easier.
Uninstall Suspicious Programs
Open Control Panel (Windows) or Applications folder (Mac) and look for programs installed around the time your browser problems started. Common names include "Browser Assistant," "Search Manager," "Web Companion," or anything with "Support" in the title. Uninstall any suspicious programs, but be aware this often doesn't remove everything—the uninstaller may leave behind the actual malicious components deliberately.
Remove Browser Extensions
Open each installed browser and remove unknown extensions. In Chrome: menu > Extensions > Manage Extensions, then remove anything unfamiliar. Firefox: menu > Add-ons and Themes > Extensions. Edge: menu > Extensions > Manage Extensions. Look for extensions installed recently that you don't recognize, especially those with generic names or suspicious publisher information. Some extensions will have a "managed by your organization" notice—these are particularly problematic and require registry cleanup (next steps).
Clean Registry and Autostart Locations (Windows)
Press Win+R, type "regedit" and press Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and delete any entries pointing to the AppData\Local folder with GUID-style folder names. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Policies for Google, Microsoft\Edge, or Mozilla keys containing extension force-install directives—delete these entire policy keys. Then open Task Scheduler (search for it in Start menu) and delete any tasks with names like "Browser Update Service" or suspicious names containing random characters.
Delete the Installation Folder
Navigate to C:\Users\[YourUsername]\AppData\Local\ and look for folders with names that are just GUIDs (like {3E5F9A1C-7B2D-4A8E-9C1F-5D3A7B9E2C4F}) or random character strings. Check the creation date—if it matches when your problems started, delete the entire folder. You may need to use Task Manager (Ctrl+Shift+Esc) to end any running processes from that folder first. On Mac, check ~/Library/Application Support/ for suspicious folders with similar characteristics.
Reset Browser Settings
After removing extensions and cleaning startup locations, reset each browser to defaults. Chrome: Settings > Reset settings > Restore settings to their original defaults. Firefox: Help > More troubleshooting information > Refresh Firefox. Edge: Settings > Reset settings > Restore settings to their default values. This clears the hijacker's homepage and search engine settings that were locked in place. You'll need to sign back into your accounts afterward.
Run Malwarebytes and a Secondary Scanner
Download and install Malwarebytes Free (from malwarebytes.com directly—avoid third-party download sites). Run a full Threat Scan, which typically takes 30-60 minutes. Quarantine all detected items. Then run a second opinion scan with either HitmanPro, AdwCleaner (also from Malwarebytes), or Windows Defender Offline Scan. Browser hijackers often drop multiple components, and using two different scanners catches remnants the first one missed.
Change Passwords After Verification
Once you've confirmed removal and rebooted successfully, change passwords for important accounts—especially email, banking, and social media. While Grewquartersupporting.com isn't primarily a credential stealer, some variants do capture form data, and you don't know if a secondary payload was delivered. Use a different device to change passwords if you're not confident the system is clean, or wait until we verify it at the shop.
Reboot and Verify Complete Removal
Restart your computer normally (not Safe Mode) and reconnect to the internet. Open your browser and verify that your homepage is set correctly and remains that way after closing and reopening. Conduct several web searches and confirm they go directly to your chosen search engine without redirects. Check Task Manager (Ctrl+Shift+Esc) for any suspicious processes. If everything appears normal for 24 hours, you've likely achieved complete removal.
Prevention
- Download software only from official sources. Avoid third-party download portals like Softonic, Download.com, or CNET Downloads. Go directly to the software publisher's website. When you need free software, verify you're on the legitimate site by checking the URL carefully—typosquatting is common.
- Always choose "Custom" or "Advanced" installation. Never click through installer wizards using Express/Quick Install options. Custom installation reveals the bundled components you can deselect. Read every screen carefully and uncheck any boxes authorizing additional software, browser toolbars, or changed homepage settings.
- Keep your browser and operating system updated. Enable automatic updates for Windows/macOS and all browsers. Most browser hijackers don't exploit zero-day vulnerabilities, but they do take advantage of users running outdated software with known security holes. Updated browsers also have better defenses against malicious extensions.
- Install an ad blocker and script blocker. Extensions like uBlock Origin (not just uBlock) filter out malicious advertising networks that serve fake update prompts. Script blockers like NoScript or uMatrix give you granular control over what code runs in your browser, though they require a learning curve for daily use.
- Be skeptical of all update prompts. If you see a notification that Flash Player, your browser, or a codec needs updating, don't click the prompt. Close it, then manually navigate to the software vendor's official website to check for updates. Flash is actually discontinued and no longer needs updates—any Flash update prompt is malicious.
- Review installed extensions monthly. Make a habit of checking your browser extensions once a month. Remove anything you don't actively use or don't remember installing. Malicious extensions sometimes install themselves during routine browsing of compromised sites through social engineering tricks.
- Run periodic scans with Malwarebytes Free. Schedule a monthly scan with a reputable anti-malware tool even if you don't suspect an infection. The free version of Malwarebytes is excellent at catching PUPs and browser hijackers that traditional antivirus might miss or classify as low-priority.
- Educate other users on your system. If you share the computer with family members or employees, make sure they understand not to install software without your knowledge. Kids and less tech-savvy users are common infection vectors for PUPs and hijackers. Consider using separate user accounts with standard (non-admin) privileges for daily use.
Bring It In
Browser hijackers like Grewquartersupporting.com are designed to be frustrating for average users to remove completely. Even if you follow every manual removal step correctly, remnants can persist in obscure registry keys, browser policies, or hidden scheduled tasks that reinfect your browser hours or days later. That cycle of temporary removal and sudden reappearance wastes your time and creates the false impression that the infection is unbeatable. It isn't—it just requires the right tools and experience to eliminate permanently.
Computer Repair Roswell has removed hundreds of browser hijackers from Roswell-area computers over the past decade. We use a combination of professional-grade removal tools, manual cleanup procedures, and verification testing to ensure complete eradication. Most browser hijacker removals are completed same-day, often within 2-3 hours. Call us at (770) 679-9844 to describe your symptoms, or bring your computer to our Roswell shop at 1394 Canton Road. We'll give you an honest assessment of whether you need professional removal or if you can handle it yourself with phone guidance. Either way, we'll make sure you leave with a clean, properly functioning machine and the knowledge to avoid reinfection.