Imitrk.13.com is a browser hijacker that forcibly redirects your web searches and homepage to unwanted advertising networks. Once installed, it embeds itself into Chrome, Firefox, Edge, and Safari through malicious extensions or modified browser shortcuts, causing every search query to bounce through multiple redirect chains before landing on sponsored results or potentially dangerous sites. Users typically notice their default search engine has changed without permission, new toolbars appear in their browser, and searches consistently route through unfamiliar domains. This hijacker doesn't encrypt files or steal passwords directly, but it compromises your browsing privacy, exposes you to malvertising, and significantly degrades system performance.
What makes Imitrk.13.com particularly frustrating is its persistence — simply changing your homepage back won't fix the problem. The hijacker modifies browser configurations at multiple levels, including shortcut target paths, extension manifests, and sometimes Windows registry keys that restore the hijack after you think you've removed it. It typically arrives bundled with free software installers, disguised as a "recommended" search enhancement or arriving silently when users rush through installation wizards without reading the fine print.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Family | Generic search redirect family, shares infrastructure with similar .13.com variants |
| Aliases | Imitrk redirect, 13.com hijacker, Imitrk search virus (colloquial) |
| Affected Platforms | Windows 7/8/10/11, macOS 10.12+; all major browsers (Chrome, Firefox, Edge, Safari) |
| Distribution Method | Software bundling, fake updates, malicious browser extensions, deceptive ads |
| Persistence Mechanisms | Browser extension installation, shortcut modification, registry Run keys (Windows), launch agents (macOS), scheduled tasks |
| Primary Capabilities | Search redirection, homepage hijacking, new tab manipulation, ad injection, tracking cookie deployment |
| Data Collection | Search queries, browsing history, clicked links, IP address, browser fingerprint, potentially form autofill data |
| Typical Artifacts | Extension folders in browser profile directories, modified shortcut targets (.lnk files), Run registry entries, tracking cookies from ad networks |
| Network Behavior | HTTP/HTTPS redirects through multiple intermediate domains (tracking URLs), connections to advertising affiliate networks, telemetry beacons to analytics servers |
| System Impact | Moderate CPU usage from ad scripts, increased network traffic, browser slowdown, pop-up advertisements |
| Removal Difficulty | Moderate — requires multi-step process across browser settings, extensions, shortcuts, and system locations |
How It Spreads
Imitrk.13.com rarely arrives alone. The most common infection vector is software bundling, where the hijacker piggybacks on legitimate-looking free applications downloaded from third-party software sites. You might download what appears to be a PDF converter, video codec, or system utility, but the installer includes "optional offers" that are pre-checked by default. Users who click "Next" repeatedly without examining each installation screen inadvertently authorize the hijacker installation. The bundler often uses confusing language — phrases like "Set Imitrk as your enhanced search provider for faster results" buried in dense terms-of-service text.
Another primary vector involves fake browser update notifications. You're browsing a questionable streaming site or file-sharing platform when a popup claims "Your Chrome browser is out of date — Update now for security." The download button actually delivers a malicious installer package that includes the hijacker alongside (or instead of) any legitimate software. These social engineering attacks prey on users' awareness of security updates, exploiting good intentions to compromise the very security they're trying to protect.
The hijacker also spreads through these specific channels:
- Malicious browser extensions — Listings in unofficial extension repositories or compromised extensions in official stores that promise ad-blocking, coupons, or video downloading but deliver the hijack payload instead
- Torrents and cracked software — Pirated application installers where the crack/keygen executable is actually a dropper for multiple PUPs including this hijacker
- Email attachments disguised as documents — JavaScript or macro-enabled files that download and execute the hijacker when opened (less common for this specific threat but possible)
- Compromised advertising networks — Malvertising on legitimate websites that exploits browser vulnerabilities or uses aggressive redirect chains to force installation prompts
- Search engine poisoning — SEO manipulation that places infected download links at the top of search results for popular free software, using domains that mimic legitimate developer sites
- Drive-by downloads — Exploits targeting outdated browser plugins (Flash, Java, Silverlight) on compromised websites, though this vector has declined as these plugins were deprecated
What It Does On Your Machine
Once installed, Imitrk.13.com immediately reconfigures your browser's core settings. It replaces your default search engine with its own redirect service, changes your homepage to a search portal that feeds into its monetization network, and hijacks the new tab page. The hijacker doesn't simply change a preference setting you can click back — it modifies the browser shortcut itself, appending command-line arguments that force the hijacked page to load regardless of your settings. For example, your Chrome shortcut target might change from chrome.exe to chrome.exe --homepage="http://imitrk.13.com/?params", which overrides the normal preference system.
The hijacker generates revenue through search redirect chains that pass through affiliate tracking systems. When you search for anything — "weather tomorrow" or "router login password" — the query first hits an Imitrk server that logs your search terms, IP address, and browser fingerprint. That server then redirects through two or three intermediate tracking URLs (each registering an impression for different advertising networks) before finally landing on a search results page filled with sponsored listings. The hijacker operator earns a commission for every click on those sponsored results, creating a financial incentive to maximize search volume and click-through rates on ads rather than delivering quality results.
Behind the scenes, the hijacker typically installs persistent components that survive simple browser resets. On Windows systems, it commonly creates a randomly-named folder in your user profile directory containing the actual hijacker executable and configuration files. A scheduled task or registry Run key ensures this component restarts every time you log in, ready to re-hijack your browser if you manage to clean it manually. On macOS, similar persistence occurs through launch agents or login items that re-inject the browser modifications.
Privacy implications extend beyond simple search tracking. Browser hijackers in this family typically inject tracking scripts into web pages you visit, monitor which links you click, and build detailed behavioral profiles. This data gets sold to advertising networks or used to refine ad targeting. While the hijacker doesn't typically capture passwords directly (it's not a keylogger), it does track everything you type into search boxes and can harvest autofill data if the malicious extension requests those permissions. Some variants open persistent WebSocket connections to command-and-control servers, allowing the operator to push new ads, update redirect targets, or install additional unwanted software without further user interaction.
Manual Removal — Step by Step
Disconnect Network and Document Symptoms
Before you start removing the hijacker, disconnect from Wi-Fi or unplug your Ethernet cable. This prevents the hijacker from downloading additional components or updating its configuration during removal. Take screenshots of the hijacked homepage, any unfamiliar extensions, and the exact redirect behavior — this documentation helps verify complete removal later. Write down what your homepage and search engine should be so you can confirm they're restored correctly at the end.
Restart in Safe Mode with Networking
On Windows 10/11, click Start, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and press 5 for Safe Mode with Networking. On macOS, restart while holding Shift until you see the login screen. Safe Mode prevents most auto-start programs from running, including many hijacker persistence mechanisms, giving you a cleaner environment to work in. You'll need networking enabled later to download a scanner, but the hijacker's background services typically won't load in this state.
Remove Suspicious Programs via Control Panel
Open Settings > Apps (Windows 11) or Control Panel > Programs and Features (Windows 10) and sort by install date. Look for anything installed around the time the hijacking started — common names include generic terms like "Search Enhancer," "Web Companion," "Browser Assistant," or random names with version numbers. Uninstall anything you don't recognize. On macOS, open Applications folder and drag suspicious apps to Trash, then empty it. Many hijackers don't appear here at all (they install only browser components), but checking eliminates one potential persistence vector.
Remove Malicious Browser Extensions
Open each browser you use and examine installed extensions. In Chrome, go to chrome://extensions; in Firefox, about:addons; in Edge, edge://extensions. Look for extensions you didn't intentionally install, especially those with generic names, vague descriptions, or permissions like "Read and change all your data on websites." Remove anything suspicious — you can always reinstall legitimate extensions later. Some hijackers install extensions that are hidden from the normal list; if you still see hijacked behavior after removing visible extensions, the hijacker might be using enterprise policies or deeper modifications.
Fix Browser Shortcuts and Reset Settings
Right-click each browser shortcut (on desktop, taskbar, Start Menu) and choose Properties. In the Target field, verify it ends with chrome.exe" or firefox.exe" with no additional URLs or parameters after the closing quote. Delete any extra text after the .exe and the quote. Then inside each browser, reset settings to defaults: Chrome has "Restore settings to their original defaults" under Settings > Reset; Firefox has "Refresh Firefox" under Help > More troubleshooting information. This removes hijacked homepage/search settings and disables remaining hidden modifications, though it also clears some customizations you might want.
Remove Scheduled Tasks and Startup Entries
Press Win+R, type taskschd.msc, and examine Task Scheduler Library for suspicious entries — look for tasks with random names, paths pointing to AppData folders, or descriptions mentioning search/browser features. Delete any related to the hijacker. Then press Win+R again, type msconfig, go to the Startup tab (or use Task Manager > Startup on Windows 10/11), and disable any suspicious startup items. On macOS, check System Preferences > Users & Groups > Login Items and remove unfamiliar entries.
Delete Hijacker Files and Registry Entries
Press Win+R, type %LOCALAPPDATA%, and look for folders with random GUID names or names containing "imitrk" or generic terms like "searchassist." Delete suspicious folders entirely. Then press Win+R, type regedit, and search (Ctrl+F) for "imitrk" — carefully delete any matching keys in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or similar autostart locations. Be cautious editing the registry; only delete entries you're confident are related to the hijacker. On macOS, use Finder's Go > Go to Folder and check ~/Library/Application Support/ and ~/Library/LaunchAgents/ for suspicious items.
Run Malwarebytes and a Second-Opinion Scanner
Reconnect to the internet, download Malwarebytes Free from the official site (malwarebytes.com), install it, update definitions, and run a full Threat Scan. This catches remnants you might have missed and any additional PUPs that rode in with the hijacker. After Malwarebytes finishes and you've removed everything it found, run a second scanner like HitmanPro or AdwCleaner for confirmation — different scanners have different detection signatures, and one might catch what the other missed. Quarantine or delete everything flagged.
Clear Browser Data and Verify Settings
In each browser, clear all browsing data (cache, cookies, history, and especially "Hosted app data" or "Site settings") from the beginning of time. This removes tracking cookies and any web-based persistence mechanisms. Then manually verify your homepage is set correctly, your default search engine is what you want (Google, DuckDuckGo, etc.), and the new tab page is normal. Open a private/incognito window and do a test search — it should go directly to your chosen search engine without redirects. If you still see Imitrk.13.com appear anywhere, you missed a component; repeat steps 4-7 more carefully.
Restart Normally and Monitor Behavior
Exit Safe Mode and restart your computer normally. Test all browsers thoroughly over the next few hours — perform searches, open new tabs, check that your homepage loads correctly. Monitor Task Manager (Ctrl+Shift+Esc on Windows) for suspicious processes with random names or high network usage. If the hijacking returns after a normal restart, you missed a persistence mechanism (likely a scheduled task or deeply hidden startup entry); consider bringing the machine to a professional at that point since the hijacker may be using rootkit-like techniques beyond typical manual removal.
Prevention
- Download software only from official sources. Always get applications directly from the developer's website or Microsoft Store / Mac App Store, never from third-party download portals like Softonic, Download.com, or CNET Downloads. These aggregator sites frequently bundle PUPs with legitimate installers. If you must use a third-party source, choose "Custom" or "Advanced" installation and read every screen, unchecking any optional offers.
- Keep browsers and operating systems updated. Enable automatic updates for Windows/macOS and all browsers. Most drive-by download attacks exploit known vulnerabilities that were patched months earlier; staying current eliminates most of these vectors. Check for updates weekly if auto-update is disabled.
- Use a reputable ad blocker and script blocker. Extensions like uBlock Origin (not just "uBlock") block malicious advertising networks and many redirect chains before they load. Consider pairing it with a script blocker like NoScript or uMatrix if you're comfortable with the learning curve — preventing untrusted JavaScript execution stops many silent installation attempts.
- Install a real-time anti-malware tool. Free options like Windows Defender (built into Windows 10/11) provide decent baseline protection. Pair it with the free version of Malwarebytes for anti-exploit and PUP detection that complements traditional antivirus. Update definitions daily and enable real-time protection features.
- Review browser extensions quarterly. Set a calendar reminder to audit your extensions every three months. Remove anything you don't actively use or don't remember installing. Check extension permissions — if a weather extension is asking to "read and change all your data on all websites," that's a red flag requiring deeper investigation.
- Never click "Allow" on browser notification prompts from unfamiliar sites. Many hijackers now use browser push notifications as a persistence mechanism. Only grant notification permission to sites you trust completely (your email provider, maybe). If a random video site or blog asks for notifications, always click Block or the X to dismiss.
- Be skeptical of urgent update warnings. Legitimate browser updates happen silently in the background or prompt you through the browser's own menu system, never through a pop-up webpage. If you see "Update Chrome now!" on a website, close the tab — it's almost certainly fake. Check for real updates by opening the browser menu and going to Help > About.
- Use unique passwords for important accounts. While not directly related to preventing hijacker installation, using a password manager with unique passwords for each site means that if a hijacker does capture form data or credentials, the damage is contained to one account rather than spreading through password reuse across your entire online presence.
Bring It In
If you've worked through the removal steps above and you're still seeing Imitrk.13.com redirects, or if the technical process seems overwhelming, don't waste another day fighting with a compromised machine. Bring your computer to Computer Repair Roswell at 1755 Old Alabama Rd, Roswell, GA 30076. We handle browser hijacker infections daily — these PUPs are among the most common issues we see, which means we've developed efficient removal processes that catch even the sneakiest persistence mechanisms. Most hijacker removals take us 1–2 hours, and we can often handle it same-day if you come in during morning hours. You'll get your computer back clean, fast, and protected with updated security software.
Beyond just removing the immediate infection, we'll audit your system for other potential security problems, verify that Windows Update is working correctly (many PUPs disable it), and give you specific recommendations based on your actual usage patterns. Call (770) 695-6860 to check current availability or just stop by — we're open Monday through Friday 9 AM to 6 PM, and Saturday 10 AM to 4 PM. We're located in the shopping center at Old Alabama and Marietta Highway, right across from the Roswell United Methodist Church. Bring the computer and any passwords we might need to log in; we'll take care of the rest and have you back to safe browsing by the end of the day.