Gruponti.he.com is a browser hijacker that forcibly redirects your web traffic through unwanted search engines and advertising networks. This invasive software modifies your browser settings without permission, replacing your homepage and default search provider with pages designed to generate ad revenue. While not as destructive as ransomware or banking trojans, browser hijackers like Gruponti.he.com degrade your browsing experience, expose you to potentially malicious advertising, and collect your search queries and browsing habits for monetization.
Users typically notice Gruponti.he.com when their browser suddenly opens to an unfamiliar search page, or when every search query gets routed through suspicious redirect chains before reaching legitimate results. The hijacker often arrives bundled with free software downloads, hiding its installation in "recommended" setup options that users click through without reading. Once installed, it proves surprisingly stubborn to remove through normal means—simply changing your browser settings back usually doesn't work because the hijacker reinstalls itself.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Classification | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Affected Platforms | Windows (all versions), sometimes macOS; targets Chrome, Firefox, Edge, Internet Explorer |
| Common Aliases | Gruponti redirect, he.com hijacker, Grupontihe search virus |
| Distribution Method | Software bundling (freeware installers), fake update prompts, malicious advertising |
| Primary Payload | Browser extension or helper application that enforces search redirection |
| Persistence Mechanisms | Browser extension policies, scheduled tasks, startup registry entries, browser preference locks |
| Data Collection | Search queries, visited URLs, browser type/version, IP address, sometimes form data |
| Monetization Method | Pay-per-click advertising revenue, affiliate commissions from redirected searches |
| Network Behavior | DNS queries to gruponti.he.com and associated advertising networks; HTTPS connections to tracking servers |
| Typical Symptoms | Changed homepage/new tab page, unexpected search redirects, increased advertisements, slower browsing |
| Removal Difficulty | Moderate—requires removal of both browser components and system-level persistence mechanisms |
| Reinfection Risk | High if original infection vector (bundled software source) remains accessible |
How It Spreads
Gruponti.he.com spreads primarily through software bundling, a deceptive distribution practice where the hijacker piggybacks on legitimate-looking free software installers. When you download a free PDF converter, video player, or system utility from a third-party download site, the installer often includes "recommended" additional software in pre-checked boxes or misleading "Custom" installation screens. Users who click through the installation with default settings unknowingly authorize the hijacker's installation alongside the software they actually wanted.
The second major distribution vector involves fake browser update notifications. You might visit a compromised website or one hosting malicious advertising, and a convincing popup appears claiming your Flash Player, Chrome, or Java is out of date. Clicking "Update Now" downloads an installer that contains Gruponti.he.com instead of—or in addition to—any legitimate update. These fake update screens often mimic the visual style of real software update dialogs to lower your defenses.
Other common infection pathways include:
- Malicious email attachments — Executable files or macro-laden documents that drop the hijacker as a secondary payload
- Compromised websites — Drive-by downloads from hacked WordPress sites or forums with injected exploit code
- Peer-to-peer file sharing — Torrents and cracked software packages bundled with PUPs and hijackers
- Search engine poisoning — Fake download pages ranking high for popular software searches, offering hijacker-laden installers
- Browser extension stores — While less common for established hijackers, some variants initially appear as legitimate-seeming extensions with innocuous permissions that later update to malicious versions
- Social engineering on social media — Sponsored posts or compromised accounts promoting "PC optimization tools" or "speed boosters" that install hijackers
What It Does On Your Machine
Once installed, Gruponti.he.com immediately modifies your browser configuration files to insert itself as the default search engine and homepage. It typically deploys as both a browser extension (with names that sound legitimate like "Search Manager" or "Web Assistant") and a companion executable file that runs in the background. The executable monitors your browser processes and reapplies the hijacked settings whenever you try to change them back, creating a frustrating cat-and-mouse game for users who attempt manual removal.
Every search you perform gets intercepted and routed through the gruponti.he.com domain, which then redirects through one or more intermediate advertising networks before eventually showing you search results—often from a legitimate search engine like Bing or Google, but with injected advertising. This redirect chain serves two purposes: it generates pay-per-click revenue for the hijacker's operators with each search you perform, and it obscures the true destination from casual observation. The additional hops also allow the hijacker to inject tracking cookies and collect detailed analytics about your browsing patterns.
The hijacker typically creates several persistence mechanisms to survive removal attempts. On Windows systems, it often adds scheduled tasks that reinstall browser modifications every few hours, registers itself as a Browser Helper Object (older versions), and may install a Windows service or modify the Hosts file to prevent access to security software websites. The browser extension itself may install with administrative enforcement policies that prevent removal through the normal browser interface, requiring registry edits to disable.
Beyond the obvious redirection behavior, Gruponti.he.com degrades system performance and creates security vulnerabilities. The constant background monitoring consumes CPU cycles and memory. More concerning, the hijacker's data collection extends beyond search terms—many variants log all visited URLs and some capture form data from web pages, creating privacy risks if you enter sensitive information while infected. The advertising networks it connects you to have inconsistent security standards, potentially exposing you to malicious advertisements (malvertising) that could deliver more serious malware.
Manual Removal — Step by Step
Disconnect and Document
Unplug your network cable or disable WiFi before proceeding. Take photos with your phone of what the hijacked browser currently shows (homepage URL, search results page) for reference. Open Task Manager (Ctrl+Shift+Esc) and screenshot any suspicious processes with names like "GrouponHelper," "gh_service," or similar before terminating them via right-click > End Task.
Boot to Safe Mode with Networking
Restart your computer and repeatedly press F8 during boot (or Shift+Restart on Windows 10/11, then Troubleshoot > Advanced Options > Startup Settings > Restart > press 5 for Safe Mode with Networking). Safe Mode prevents the hijacker's background services from starting automatically, making removal significantly easier. Once in Safe Mode, reconnect your network—you'll need internet access to download security tools.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11). Sort by Install Date and look for unfamiliar entries installed around the time the hijacking started. Uninstall anything with "Gruponti," "Groupon Helper," "Search Manager," "Web Companion," or other suspicious names. Also remove any free utilities you recently installed—even if they seem legitimate, they likely bundled the hijacker. Right-click and select Uninstall for each suspicious entry.
Remove Browser Extensions
Open each browser you use and navigate to its extensions/add-ons manager (chrome://extensions/ in Chrome, about:addons in Firefox, edge://extensions/ in Edge). Remove any extensions you don't recognize or didn't deliberately install, paying special attention to anything installed on the same date the hijacking started. If an extension shows "Managed by your organization" or won't allow removal, you'll need to edit registry policies in the next steps.
Delete Registry Persistence Entries
Press Windows+R, type "regedit" and press Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and delete any entries pointing to suspicious executables in AppData folders. Check HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ (and similar paths for Firefox/Edge) for forced extension installations and delete those keys. Search the entire registry (Ctrl+F) for "gruponti" and delete any found entries. Always export a backup before deleting registry keys.
Remove Scheduled Tasks
Press Windows+R, type "taskschd.msc" and press Enter to open Task Scheduler. Click on Task Scheduler Library and review the list of scheduled tasks. Delete any with suspicious names (especially those running executables from AppData\Local or AppData\Roaming folders). Look at the "Author" column—legitimate Windows tasks typically show "Microsoft Corporation" while hijacker tasks often show your username or "Administrator." Right-click suspicious tasks and select Delete.
Delete Hijacker Files and Folders
Open File Explorer and navigate to C:\Users\[YourUsername]\AppData\Local\ and C:\Users\[YourUsername]\AppData\Roaming\. Look for folders with names like "GrouponHelper," "SearchManager," or random GUID-style names (long strings of letters and numbers). Delete these entire folders. If Windows says files are in use, restart back to Safe Mode and try again. Also check C:\Program Files\ and C:\Program Files (x86)\ for any hijacker-related folders.
Reset Browser Settings
Open each affected browser and reset it to defaults. In Chrome: Settings > Advanced > Reset and clean up > Restore settings to their original defaults. In Firefox: Help > More Troubleshooting Information > Refresh Firefox. In Edge: Settings > Reset settings > Restore settings to their default values. This removes any lingering hijacker configurations. You'll need to re-enter your preferences and may need to re-login to websites afterward.
Run Malwarebytes and Secondary Scanner
Download Malwarebytes Free from malwarebytes.com and run a full Threat Scan. Let it complete (usually 20-40 minutes) and quarantine everything it finds. Restart, then download and run a second-opinion scanner like AdwCleaner (also from Malwarebytes) or HitmanPro. Browser hijackers often install multiple components, and one scanner might miss pieces that another catches. Remove anything these tools identify.
Verify and Change Passwords
Restart normally (not Safe Mode) and test your browsers. Your homepage and search engine should now be back to defaults or whatever you set. If gruponti.he.com is truly gone, change passwords for important accounts—especially banking, email, and social media. Use a different device if possible for the most sensitive accounts, since some hijacker variants capture form data. Monitor your accounts closely for the next few weeks for any suspicious activity.
Prevention
- Download software only from official sources. Skip third-party download sites like Download.com, Softonic, or FileHippo. Go directly to the developer's website. For open-source software, use the official project page or reputable repositories like GitHub releases.
- Always choose Custom/Advanced installation. Never click through installers with "Recommended" or "Express" settings. Custom installation shows you exactly what else is being installed, allowing you to uncheck bundled PUPs and hijackers. Read every screen—deceptive installers sometimes place decline buttons in unexpected locations.
- Keep legitimate software updated through official channels. Enable automatic updates for Windows, your browsers, and critical software like Java. When you see an update prompt, close it and manually check for updates through the application's own update mechanism rather than clicking popup notifications.
- Use browser extensions to block malicious content. Install uBlock Origin (not just "uBlock") on all browsers to block malvertising and malicious scripts. Enable Chrome's Enhanced Safe Browsing or Firefox's Enhanced Tracking Protection. These significantly reduce exposure to hijacker distribution networks.
- Maintain real-time antivirus protection. Windows Defender (built into Windows 10/11) provides solid baseline protection against known PUPs if kept updated. For additional protection, consider Malwarebytes Premium for its anti-exploit and real-time browser protection features that catch hijackers at installation time.
- Review installed programs monthly. Set a recurring calendar reminder to check Control Panel > Programs and Features for unfamiliar software. Browser hijackers often install additional PUPs over time through update mechanisms, so what's clean today may not stay clean.
- Create a standard user account for daily use. Don't use an administrator account for web browsing and email. Most hijackers need administrative privileges to install their persistence mechanisms. A standard user account forces them to show a UAC prompt, giving you a chance to block installation.
- Be skeptical of free software and "deals." That free registry cleaner, driver updater, or video converter is probably monetizing through bundled PUPs. If software seems too good to be free, it's likely packaging hijackers or other unwanted programs to generate revenue from your installation.
Bring It In
Browser hijackers like Gruponti.he.com are frustrating to remove thoroughly because they scatter components across multiple system locations and employ multiple persistence mechanisms. While the steps above work for many users, a single missed registry entry or scheduled task can resurrect the hijacker after reboot. If you've tried manual removal and the redirects keep coming back, or if you're simply not comfortable editing the registry and deleting system files, we're here to help.
Computer Repair Roswell has removed thousands of browser hijackers from Georgia residents' computers. We'll eliminate Gruponti.he.com completely, verify no other malware hitchhiked in with it, optimize your browser performance, and set up protection against reinfection—usually all in the same day. Located at 1322 Hembree Road in Roswell, we're open six days a week and can often accommodate same-day appointments. Call us at (770) 954-1932 to describe what's happening, or just bring your machine in during business hours. Most hijacker removals are completed in 1-2 hours at a flat rate with our 90-day guarantee, giving you peace of mind and a clean, fast-browsing computer.