Griolam.tor.com is a browser hijacker that forcibly redirects users to unwanted websites through manipulation of browser settings and search results. This potentially unwanted program (PUP) primarily targets Windows systems and integrates deeply into popular browsers including Chrome, Firefox, and Edge. Once installed, it modifies your homepage, default search engine, and new tab settings to route traffic through its own redirect infrastructure, often leading to advertising networks, fake tech support pages, or further malware distribution sites.
Users typically encounter this hijacker after installing bundled software from file-sharing sites or clicking through deceptive advertisements that promise system optimization or media players. The hijacker operates by creating persistent browser extensions and modifying system-level settings that prevent simple removal through standard browser controls. While not technically a virus in the traditional sense, its intrusive behavior, difficulty of removal, and potential to expose users to more serious threats make it a significant security concern.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Browser Hijacker / Redirect Malware |
| Aliases | Griolam redirect, Griolam.tor.com hijacker, Griolam browser virus |
| Platform | Windows (primarily XP through 11); affects Chrome, Firefox, Edge, Internet Explorer |
| Discovered | Variants in this family active since approximately 2016-2017 |
| Distribution | Software bundling, fake updates, malicious advertisements, compromised download portals |
| Persistence | Browser extensions, scheduled tasks, Run registry keys, proxy settings manipulation |
| Primary Capabilities | Search redirection, homepage hijacking, advertising injection, browser tracking, settings lockout |
| Data Collection | Browsing history, search queries, clicked links, system information (typical for adware family) |
| Network Behavior | Communicates with redirect servers on .tor.com domains and various advertising networks |
| Common Artifacts | Browser extensions with randomized names, modified Preferences files, proxy PAC files |
| Payload Delivery | May download additional PUPs or adware through redirect chains |
| Removal Difficulty | Moderate — requires browser cleanup and registry editing; tends to restore itself if incompletely removed |
How It Spreads
Griolam.tor.com spreads primarily through deceptive software distribution practices. The most common vector is software bundling, where legitimate-appearing applications from third-party download sites include the hijacker as an additional component. Users who rush through installation wizards using the "Express" or "Recommended" options inadvertently authorize the installation of the hijacker alongside the intended program. Free media converters, PDF tools, download managers, and system optimization utilities are frequently used as carrier applications.
Malicious advertising campaigns represent another significant distribution channel. These advertisements appear on legitimate websites through compromised ad networks or on questionable file-sharing platforms. The ads may claim your Flash Player is outdated, your computer is infected, or you've won a prize — all designed to trick you into downloading an executable that contains the hijacker. Some variants also spread through browser extension marketplaces disguised as productivity tools, weather add-ons, or shopping assistants.
The hijacker may also arrive as a secondary payload from other infections. A user who has already compromised their system with one PUP often finds additional unwanted programs installing themselves without explicit consent, as many of these programs operate within affiliate networks that profit from distributing one another.
- Bundled software installers from free download websites and torrent platforms
- Fake software update notifications for Flash Player, Java, or media codecs
- Malicious browser extensions promoted through deceptive Chrome Web Store or Firefox Add-ons listings
- Compromised advertising networks pushing drive-by downloads on legitimate sites
- Phishing emails with attachments claiming to be invoices, shipping notices, or document viewers
- Secondary infections delivered by existing adware or trojans already present on the system
What It Does On Your Machine
Once Griolam.tor.com establishes itself on your system, it immediately modifies your browser configuration to control your web traffic. The hijacker changes your default search engine to redirect through its own servers, replaces your homepage with an unfamiliar page, and sets your new tab behavior to load pages you didn't choose. These modifications happen across all installed browsers, and when you attempt to change them back through normal browser settings, the hijacker typically restores its preferred configuration within minutes or after a browser restart.
The redirect mechanism operates by intercepting your search queries and legitimate navigation attempts. When you type a URL or search term, the hijacker routes your request through a series of redirect servers before ultimately delivering you to advertising pages, affiliate shopping sites, or potentially dangerous domains hosting additional malware. This redirect chain allows the hijacker's operators to collect data about your browsing habits, generate advertising revenue through forced impressions and clicks, and expose you to affiliate commissions when you make purchases through hijacked links.
Beyond the visible browser changes, the hijacker installs persistence mechanisms throughout your system to survive removal attempts. It creates scheduled tasks that reinstall browser components, adds registry entries that restore settings on startup, and may install a system service that monitors browser configurations for changes. Some variants also modify Windows proxy settings or hosts file entries to ensure traffic continues flowing through their infrastructure even if you manage to remove the browser components.
The data collection aspect represents a significant privacy concern. The hijacker tracks every website you visit, every search term you enter, and potentially captures more sensitive information like login pages you access or shopping behavior. While the operators claim to collect only "anonymous" data, the aggregated information often includes identifiable details that could be sold to data brokers or used for targeted phishing campaigns. Additionally, the constant communication with remote servers and the processing overhead of redirect chains can noticeably slow your browsing speed and overall system performance.
Manual Removal — Step by Step
Disconnect Network and Reboot to Safe Mode
Disconnect your computer from the internet by unplugging the Ethernet cable or disabling Wi-Fi. This prevents the hijacker from downloading additional components or restoring itself from remote servers. Then restart your computer and press F8 (or Shift+F8 on newer systems) repeatedly during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking" to start Windows with minimal drivers loaded, which prevents most malware from executing its protection routines.
Uninstall Suspicious Programs
Open Control Panel and navigate to "Programs and Features" (or "Add/Remove Programs" on older systems). Sort the list by installation date and carefully review programs installed around the time your browser issues began. Look for unfamiliar names, publisher names that seem generic or suspicious, and programs you don't remember installing. Uninstall anything related to browser helpers, optimization tools, or extensions you don't recognize. Common names include variations of system optimizers, browser assistants, or media tools with suspicious publishers.
Remove Malicious Browser Extensions
Open each browser you use and navigate to the extensions management page (chrome://extensions/ in Chrome, about:addons in Firefox, edge://extensions/ in Edge). Enable "Developer mode" if needed to see all extensions. Remove any extensions you don't recognize or didn't intentionally install, paying special attention to those with generic names or excessive permissions. The hijacker often installs extensions with randomized names or disguised as legitimate tools. After removing extensions, check each browser's settings to restore your preferred homepage, search engine, and startup behavior.
Clean Browser Data and Reset Settings
In each browser's settings menu, clear all browsing data including cookies, cached files, and site data from the beginning of time. Then use the browser's reset function (usually found under Advanced Settings) to restore default settings. This removes lingering configuration changes the hijacker may have made to preferences files that aren't visible in the standard settings interface. After reset, you'll need to re-configure your preferences and re-login to websites, but this ensures a clean browser state.
Remove Registry Persistence Keys
Press Windows+R, type "regedit" and press Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names or paths pointing to random folders in AppData. Delete any entries you don't recognize, but be cautious — only remove items you're confident are malicious. Also check HKEY_CURRENT_USER\Software for folders with names matching the hijacker or randomly-generated GUIDs that were created recently.
Delete Scheduled Tasks
Open Task Scheduler by typing "taskschd.msc" in the Run dialog. Review the Task Scheduler Library for any tasks with suspicious names, especially those created recently or that run frequently. Look for tasks that execute programs from AppData folders or have generic names like "BrowserUpdate" or "SystemMaintenance" that weren't created by legitimate software. Right-click and delete any suspicious tasks. Check the Actions tab of each task to see exactly what program it's launching before deciding whether to remove it.
Delete Hijacker Files and Folders
Open File Explorer and navigate to C:\Users\[YourUsername]\AppData\Local and C:\Users\[YourUsername]\AppData\Roaming. Look for folders with random GUID-style names (long strings of letters and numbers) or folders matching names you found in the registry or scheduled tasks. Delete these folders completely. Also check C:\Program Files and C:\Program Files (x86) for folders related to the programs you uninstalled in step 2. You may need to show hidden files and folders (View tab > Options > View > Show hidden files) to see the AppData folders.
Check and Reset Proxy Settings
Press Windows+R, type "inetcpl.cpl" and press Enter to open Internet Properties. Go to the Connections tab and click "LAN settings." Ensure the "Use a proxy server" option is unchecked unless you intentionally use a proxy. If there's a checkmark or an automatic configuration script URL you don't recognize, remove it. Also check the "Automatically detect settings" option. Some hijackers modify proxy settings to route all traffic through their servers even after other components are removed.
Run Malwarebytes or Similar Scanner
Download and install Malwarebytes Free (from malwarebytes.com) or another reputable anti-malware tool. Run a full system scan to catch any components or related infections you may have missed during manual removal. These tools maintain updated databases of hijacker signatures and can detect variants and associated PUPs that aren't obvious through manual inspection. Quarantine or remove anything the scan identifies, then run a second scan to verify your system is clean.
Reboot and Verify Removal
Restart your computer normally (not in Safe Mode) and reconnect to the internet. Open each browser and verify that your homepage, search engine, and new tab settings remain as you configured them. Perform several searches and navigate to different websites to confirm you're not being redirected. Check Task Manager (Ctrl+Shift+Esc) for any suspicious processes. If the hijacker returns or you continue experiencing redirects, you likely missed a persistence mechanism and should consider professional removal to ensure the infection is completely eliminated.
Prevention
- Download software only from official sources. Avoid third-party download sites like Softonic, Download.com, or CNET Downloads, which often bundle PUPs with legitimate software. When possible, download programs directly from the developer's official website. Verify the URL carefully before downloading to avoid imposter sites.
- Always use Custom or Advanced installation options. Never click through an installer using "Express" or "Quick Install" settings. Custom installation reveals bundled offers and optional components, giving you the opportunity to decline additional software. Read each installation screen carefully and uncheck any pre-selected offers for browser toolbars, extensions, or optimization utilities.
- Keep your system and software updated. Enable automatic updates for Windows, your browsers, and all installed applications. Many hijackers exploit outdated software vulnerabilities to install themselves. Current software includes security patches that block known exploitation techniques. This includes Java, Adobe products, and any browser plugins you use.
- Install and maintain reputable security software. Use a combination of traditional antivirus and anti-malware protection. Windows Defender provides baseline protection, but adding Malwarebytes or a similar anti-malware tool provides an additional detection layer specifically focused on PUPs and hijackers. Keep these tools updated and run periodic scans even if you don't suspect infection.
- Use an ad blocker extension. Browser-based ad blockers like uBlock Origin prevent many malicious advertisements from loading, cutting off a major hijacker distribution vector. These extensions also improve browsing speed and reduce distractions. Configure them to run even on trusted sites, as legitimate sites can unknowingly serve malicious ads through compromised ad networks.
- Be skeptical of browser extensions. Only install extensions from official stores (Chrome Web Store, Firefox Add-ons) and carefully review their permissions before installing. Look for extensions with many positive reviews and frequent updates. Avoid extensions that request excessive permissions like "read and change all your data on all websites" unless absolutely necessary for the extension's stated function.
- Create a non-administrator account for daily use. Run your computer with a standard user account rather than an administrator account for everyday tasks. Many hijackers require administrator privileges to install their persistence mechanisms. When a program requests elevation, you'll see a prompt, giving you a moment to consider whether the action is legitimate.
- Learn to recognize fake alerts and urgent warnings. Legitimate software doesn't suddenly appear with warnings that your system is infected or that you need to call a tech support number immediately. Close any browser windows displaying these messages without clicking anything within them. Real security alerts come from your installed security software, not from random websites.
Bring It In
Browser hijackers like Griolam.tor.com can be stubborn, and incomplete removal often leads to reinfection within hours or days. If you've attempted manual removal and the hijacker keeps returning, or if you're simply not comfortable editing the registry and hunting through system folders, Computer Repair Roswell can help. Our technicians deal with these infections daily and have the tools and experience to thoroughly eliminate hijackers and any related infections they may have brought along.
We're located right here in Roswell, Georgia, and we work on both PCs and Macs. Bring your computer to our shop at 1655 Old Alabama Road, or give us a call at (770) 679-9877 to discuss your situation. We'll diagnose the extent of the infection, remove it completely, verify your system is clean, and help you understand how to avoid similar problems in the future. Most hijacker removals are completed the same day, getting you back to safe, fast browsing without the constant redirects and privacy concerns.