Hosenewspapersdepths.com is a browser hijacker and potentially unwanted program (PUP) that forces your web browser to redirect through its domain, typically delivering intrusive advertisements, fake system alerts, and links to questionable websites. Users often discover this threat when their homepage or new-tab page suddenly changes without permission, or when searches get rerouted through unfamiliar domains before reaching legitimate results. While not as destructive as ransomware or data-stealing trojans, browser hijackers like this one compromise your browsing privacy, slow down your system, and expose you to further malware through malicious ad networks.
The hijacker typically arrives bundled with free software downloads—especially media converters, PDF tools, or download managers from third-party hosting sites. Once installed, it modifies browser settings across Chrome, Firefox, Edge, and other browsers, often installing browser extensions or helper objects that resist simple removal attempts. Beyond the annoyance factor, these redirects can log your search queries, track browsing habits, and in some cases funnel you toward tech-support scams or fake security warnings designed to extract payment information.
Threat Profile
| Threat Type | Browser Hijacker, Potentially Unwanted Program (PUP), Adware |
| Family | Generic browser-redirect malware; shares characteristics with search-hijacker families |
| Common Aliases | PUP.Optional.Hosenewspapersdepths, Adware.Hosenewspapersdepths, BrowserModifier:Win32/Hosenewspapersdepths |
| Affected Platforms | Windows 7/8/10/11, macOS (cross-browser targeting) |
| Targeted Browsers | Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera |
| Distribution Method | Software bundling, deceptive installers, fake updates, malicious advertisements |
| Persistence Mechanisms | Browser extension/add-on installation, registry modifications, scheduled tasks (Windows), browser policy enforcement |
| Primary Capabilities | Homepage/search engine replacement, new-tab hijacking, query redirection, ad injection, browsing data collection |
| Typical Artifacts | Modified browser shortcuts (appended URLs), registry keys under Software\Policies, AppData folders with random names, browser extensions with generic names |
| Network Behavior | HTTP/HTTPS redirects through multiple intermediary domains, connections to ad-serving infrastructure, tracking pixel callbacks |
| Data at Risk | Browsing history, search queries, clicked links, potentially saved passwords if keylogging component present (uncommon but possible) |
| Removal Difficulty | Moderate—requires browser reset and manual cleanup of multiple components; reinfection common if bundled installer remains |
How It Spreads
Hosenewspapersdepths.com spreads primarily through software bundling, a deceptive practice where free applications include additional "offers" during installation. Users downloading video converters, PDF creators, or system utilities from third-party download sites frequently encounter installers that pre-check boxes to install browser extensions or change browser settings. The installation wizard often buries these options in "Custom" or "Advanced" setup screens that most people skip, using the default "Express" installation that accepts everything automatically.
Malicious advertising campaigns also distribute this hijacker. Fake "Your Flash Player is out of date" warnings or "Critical security update required" messages on sketchy streaming sites and torrent portals serve installers disguised as legitimate updates. Some users report the hijacker appearing after clicking email attachments claiming to be shipping notifications or invoice documents—these typically launch installer scripts rather than actual documents. In workplace environments, we've seen this spread when one employee downloads an infected toolbar or browser extension, and the underlying installer includes components that propagate through shared network drives if users have overly permissive folder access.
Common distribution vectors include:
- Bundled freeware/shareware from sites like Softonic, Download.com (older versions), or torrent bundles that repackage legitimate software with PUP installers
- Fake browser update prompts on compromised or low-quality websites, especially illegal streaming and file-sharing sites
- Malicious browser extensions promoted through black-hat SEO or social media spam claiming to offer coupons, video downloaders, or gaming cheats
- Email phishing campaigns with attachments labeled as receipts, invoices, or package-tracking notifications
- Compromised legitimate software downloaded from unofficial mirrors rather than developer websites
- Drive-by downloads from exploit kit landing pages targeting unpatched browser or Flash vulnerabilities (less common now but still occurring)
What It Does On Your Machine
Once installed, Hosenewspapersdepths.com immediately modifies your browser configuration to force all web traffic through its redirect infrastructure. Your homepage changes to hosenewspapersdepths.com or a related domain, your default search engine switches to an unfamiliar provider (often a white-label version of Yahoo or Bing with injected ads), and your new-tab page gets replaced with a custom landing page full of sponsored links. Each time you perform a search, your query gets routed through several redirect servers—sometimes four or five hops—before eventually showing you search results that look legitimate but include extra sponsored listings at the top.
The hijacker typically installs a browser extension with a generic name like "Helper," "Safe Browsing," or "Web Companion" that resists normal removal. In Chrome, it may enforce its settings through enterprise policies, which override your manual preference changes. When you try to change your homepage back to Google or a blank page, the hijacker simply reverts it the next time you restart the browser. This persistence mechanism often includes a scheduled task on Windows or a LaunchAgent on macOS that monitors browser settings and reinstalls the extension if you manage to delete it.
Beyond redirects, the hijacker tracks your browsing activity. Every site you visit, every search term you type, and every link you click gets logged and transmitted back to the operator's servers. This data feeds into advertising profiles used for targeted ad campaigns, but it's also sometimes sold to third-party data brokers. You'll notice intrusive pop-up ads appearing on sites that normally don't show them, banner ads replacing legitimate content, and text on web pages getting converted into hyperlinks that lead to advertising landing pages.
The performance impact ranges from subtle to severe depending on how many advertising scripts get injected. Users commonly report browsers running slower, taking longer to load pages, and consuming excessive memory. In some cases, the redirect chain times out entirely, leaving you staring at loading screens or connection-error pages. The hijacker may also display fake security warnings claiming your system is infected or your software is out of date—these are social-engineering attempts to trick you into calling fake tech-support numbers or downloading additional malware disguised as security tools.
C:\Users\[Username]\AppData\Local\Temp\{random-GUID}\installer.exe
C:\Users\[Username]\AppData\Roaming\BrowserHelper\config.json
; Registry modifications:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BrowserHelperService
HKCU\Software\Policies\Google\Chrome\HomepageLocation = "http://hosenewspapersdepths.com"
HKCU\Software\Policies\Mozilla\Firefox\Homepage\URL
; Scheduled task (Windows):
Task Scheduler Library → BrowserUpdate (runs helper executable hourly)
; Browser extension folders:
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions\[random-extension-ID]
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or turn off Wi-Fi before you begin. Browser hijackers often re-download components from remote servers during the removal process. Working offline prevents the malware from pulling fresh copies of itself while you're trying to delete it.
Boot Into Safe Mode with Networking
Restart your computer and press F8 during boot (or hold Shift while clicking Restart in Windows 10/11, then navigate to Troubleshoot → Advanced Options → Startup Settings → Restart → press 4 or F4). Safe Mode loads only essential drivers and prevents most malware from launching automatically. You'll need Networking enabled for Step 8 when you download a scanner.
Uninstall Suspicious Programs
Open Settings → Apps (or Control Panel → Programs and Features on older Windows). Sort by install date and look for anything installed around the time the redirects started. Uninstall programs you don't recognize, especially those with generic names like "Web Helper," "Browser Assistant," or anything containing "Hosenewspapers." Also remove any free PDF converters, download managers, or video tools you recently installed from third-party sites.
Check and Reset Browser Shortcuts
Right-click your browser's desktop or taskbar shortcut and choose Properties. In the Target field, verify it ends with the normal executable path (like chrome.exe") with nothing appended after the closing quote. Hijackers sometimes add URLs to the target line so the browser opens their site on every launch. If you see an extra URL, delete everything after .exe" and click Apply.
Remove Malicious Browser Extensions
Open each installed browser and navigate to the extensions page (chrome://extensions in Chrome, about:addons in Firefox, edge://extensions in Edge). Remove any extensions you didn't intentionally install. Pay special attention to extensions installed recently or those requiring excessive permissions like "Read and change all your data on all websites." Some hijackers install extensions with "Managed by your organization" labels—you'll need to edit registry or policy settings to remove these (covered in Step 6).
Delete Policy and Registry Entries
Press Windows+R, type regedit, and press Enter. Navigate to HKEY_CURRENT_USER\Software\Policies\Google\Chrome and delete the entire Chrome key if present. Do the same for Mozilla\Firefox. Also check HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and delete any entries referencing unfamiliar programs or paths containing random GUIDs or "BrowserHelper" type names. Be careful in the registry—only delete entries you're confident are malicious.
Remove Scheduled Tasks and Startup Items
Press Ctrl+Shift+Esc to open Task Manager, then click the Startup tab. Disable anything suspicious. Next, search for "Task Scheduler" in the Start menu. In the Task Scheduler Library, look for tasks with generic names or those running executables from AppData\Local or Temp folders. Right-click and delete these tasks. This stops the hijacker from reinstalling itself on a schedule.
Scan with Reputable Anti-Malware Tools
Reconnect to the internet (you're still in Safe Mode). Download and run Malwarebytes Free (malwarebytes.com) and perform a full Threat Scan. Also run a scan with your existing antivirus if you have one. Let both tools quarantine everything they find. Even if you've manually removed the visible components, these scanners often catch leftover registry entries, tracking cookies, and related PUPs you might have missed.
Reset Browser Settings to Default
In Chrome, go to Settings → Reset settings → Restore settings to their original defaults. In Firefox, type about:support in the address bar and click Refresh Firefox. In Edge, Settings → Reset settings → Restore settings to their default values. This clears any lingering search-engine changes, homepage hijacks, or injected scripts the previous steps didn't catch. You'll lose your saved settings but your bookmarks and passwords should remain.
Reboot and Verify Cleanup
Restart your computer normally (exit Safe Mode). Open your browser and verify your homepage and search engine are back to your preferred choices. Perform a test search and confirm you're not getting redirected through hosenewspapersdepths.com or similar domains. Check Task Manager (Ctrl+Shift+Esc) and look at running processes—verify nothing suspicious is consuming resources. If redirects persist, you may need professional help to catch a rootkit component or a more sophisticated variant.
Prevention
- Download software only from official sources. Go directly to the developer's website rather than third-party download portals. Avoid sites like Softonic, Download.com clones, and torrent bundles that repackage software with added installers.
- Always choose Custom or Advanced installation. Never click through an installer using Express or Recommended settings. Read every screen and uncheck any offers to install additional software, change your homepage, or add browser toolbars.
- Keep your system and browsers updated. Enable automatic updates for Windows, macOS, and all browsers. Many hijackers exploit known vulnerabilities in outdated software to bypass user prompts during installation.
- Use a reputable ad blocker. Browser extensions like uBlock Origin block malicious ad networks that serve fake update prompts and drive-by download attempts. This cuts off one major infection vector before you even encounter it.
- Install and maintain real-time antivirus protection. Windows Defender is adequate for most users if kept updated, but third-party solutions like Bitdefender or Kaspersky offer additional behavioral detection. Ensure real-time protection is always enabled.
- Be skeptical of browser extension requests. Only install extensions from official browser stores (Chrome Web Store, Firefox Add-ons), and carefully review the permissions they request. If a simple coupon finder wants to "read and change all your data," that's a red flag.
- Watch for social engineering. If a website claims your Flash Player, browser, or video codec is out of date, close the tab. Navigate directly to the official software vendor if you think an update might actually be needed.
- Create separate user accounts. Run as a Standard User rather than Administrator for daily tasks. Many PUPs require admin rights to modify system-level browser policies—a standard account blocks these changes and forces a permission prompt where you can decline.
Bring It In
If you've followed these steps and you're still seeing hosenewspapersdepths.com redirects, or if the process seems overwhelming, bring your computer to our Roswell shop. Browser hijackers like this one sometimes install rootkit components or modify system files in ways that require specialized tools and experience to fully remove. We've dealt with hundreds of these infections and can typically clean a hijacked system in under an hour while you wait. We'll also check for any secondary infections that piggybacked on the initial installer—PUPs rarely travel alone.
Our shop is located right here in Roswell, Georgia, and we handle both PC and Mac systems. Call us at the number on this site or stop by during business hours. We offer free diagnostics—you'll know what's wrong and what it'll cost before we do any work. And remember, all our malware removal work comes with that 90-day warranty. We'd rather see you once and fix it completely than have you dealing with the same redirects next month.