JarHomediGlive is a browser hijacker that redirects your web searches and homepage to unwanted search engines, often through intermediary redirect chains designed to generate advertising revenue. First documented in the mid-2010s, this hijacker typically targets Windows systems through bundled software installations, modifying browser settings across Chrome, Firefox, Edge, and Internet Explorer without explicit user consent. While not classified as a virus in the traditional sense, JarHomediGlive exhibits malicious behavior by persisting after removal attempts and collecting browsing data for third-party advertisers.
Users infected with JarHomediGlive typically notice their default search engine changed to unfamiliar domains, new toolbars appearing in their browsers, and frequent redirects when attempting to search or navigate to common websites. The hijacker may also inject additional advertisements into web pages, slow down browser performance, and expose the system to further potentially unwanted programs (PUPs) through malicious advertising networks.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Browser Hijacker / PUP (Potentially Unwanted Program) |
| Common Aliases | Jar Home Diglive, JarHomeDig, HomediGlive redirect |
| Affected Platforms | Windows 7, 8, 8.1, 10, 11 (all editions); primarily affects desktop browsers |
| First Documented | Circa 2014-2015 |
| Primary Distribution | Software bundling, freeware installers, fake update prompts |
| Persistence Mechanisms | Browser extension installation, shortcut target modification, registry Run keys, scheduled tasks (variant-dependent) |
| Primary Capabilities | Search redirection, homepage hijacking, new tab page replacement, browsing data collection, advertisement injection |
| Typical Artifacts | Modified browser shortcuts with appended parameters, unknown extensions in browser, altered preferences files, registry entries in HKCU\Software keys |
| Network Behavior | Connects to advertising networks and redirect domains; transmits search queries and potentially browsing history to remote servers |
| Data at Risk | Browsing history, search queries, IP address, system configuration details; potentially credentials if combined with secondary payloads |
| Removal Difficulty | Moderate — requires browser cleanup, registry edits, and shortcut repairs; often reinstalls if components are missed |
| Associated Threats | Often bundled with other PUPs, adware, and potentially unwanted toolbars from the same distribution network |
How It Spreads
JarHomediGlive rarely arrives alone or through direct user installation. The hijacker almost exclusively spreads through deceptive software bundling practices, where legitimate-appearing freeware or shareware programs include the hijacker as an "optional offer" during installation. These offers are frequently pre-checked by default or presented in confusing language that obscures their true nature. Users who rush through installation wizards using "Express" or "Recommended" settings inadvertently authorize the hijacker's installation alongside the desired software.
Secondary distribution vectors include fake browser update notifications on compromised websites, malicious advertisements (malvertising) that trigger drive-by downloads, and torrented software packages that have been repackaged with bundled PUPs. In some cases, users searching for free versions of commercial software encounter download portals that wrap the desired application in an installer framework specifically designed to deliver JarHomediGlive and related hijackers.
Common infection vectors include:
- Bundled freeware installers — Download managers, PDF converters, media players, and system utilities from third-party download sites
- Fake update prompts — Deceptive notifications claiming Flash Player, Java, or browser updates are required
- Malicious advertising — Banner ads and pop-ups on questionable websites that initiate downloads when clicked
- Torrented software — Cracked applications and pirated content repackaged with hijacker components
- Email attachments — Less common for this specific hijacker, but some variants arrive via phishing emails disguised as legitimate software installers
- Compromised browser extensions — Extensions that initially appear legitimate but update to include hijacker functionality
What It Does On Your Machine
Once installed, JarHomediGlive immediately begins modifying browser configurations to redirect traffic through its preferred search engines and advertising partners. The hijacker typically changes your browser's homepage, default search engine, and new tab page to domains that generate revenue through search advertising. These redirect chains often pass through multiple intermediary domains before landing on a final search portal, creating opportunities for tracking pixels and cookies to monitor your activity across different properties.
The modification process extends beyond simple browser settings. JarHomediGlive frequently alters browser shortcuts by appending command-line parameters that force the browser to load specific URLs on startup. Even if you manually reset your homepage in browser settings, launching the browser from a compromised shortcut will override those settings. More sophisticated variants install browser extensions or add-ons that enforce the hijacker's preferred settings, making manual removal attempts appear initially successful while the hijacker reinstates itself upon browser restart.
Performance degradation is a common side effect. The constant redirects and advertisement injections consume network bandwidth and processing resources, making pages load more slowly than normal. You may notice additional toolbars occupying screen space, unexpected pop-ups appearing on websites that don't normally display them, and search results that prioritize sponsored links over relevant content. Some users report their browser becoming unstable, with frequent crashes or freezing, particularly when multiple tabs are open.
Beyond the obvious annoyances, JarHomediGlive poses privacy risks. The hijacker typically collects information about your browsing habits, including search queries, visited URLs, time spent on pages, and click patterns. This data is transmitted to remote servers controlled by the hijacker's operators or sold to advertising networks. While JarHomediGlive itself is not known for stealing passwords or credit card numbers directly, the redirect chains it creates can expose you to more dangerous threats. Landing pages in the redirect sequence may host exploit kits, phishing forms, or additional malware downloads designed to capitalize on users who've already demonstrated vulnerability by becoming infected.
Manual Removal — Step by Step
Disconnect from the Network
Unplug your ethernet cable or disable Wi-Fi to prevent the hijacker from communicating with remote servers, downloading additional components, or transmitting your browsing data. This also stops any active advertisement networks from injecting new content while you work on removal.
Boot into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or Shift+F8 on newer systems). Select "Safe Mode with Networking" from the menu. This prevents most hijacker processes from auto-starting while still allowing you to download security tools if needed. On Windows 10/11, you can also access this through Settings → Update & Security → Recovery → Advanced Startup.
Uninstall Suspicious Programs
Open Control Panel → Programs and Features (or Settings → Apps on Windows 10/11). Sort by installation date and look for programs installed around the time the hijacking started. Remove anything unfamiliar, especially items with generic names, random characters, or developer names you don't recognize. Common bundled names include various "Manager" utilities, optimization tools, and browser add-ons.
Remove Browser Extensions and Reset Settings
Open each affected browser and navigate to the extensions/add-ons page (chrome://extensions/ for Chrome, about:addons for Firefox, edge://extensions/ for Edge). Remove any extensions you didn't intentionally install. Then reset browser settings: In Chrome, go to Settings → Reset settings → Restore settings to their original defaults. In Firefox, type about:support in the address bar and click "Refresh Firefox." This removes hijacker modifications while preserving bookmarks and passwords.
Fix Browser Shortcuts
Right-click each browser shortcut on your desktop, taskbar, and Start menu. Select Properties and examine the "Target" field. If you see anything after the .exe path (especially URLs or --homepage parameters), delete everything after the closing quote around the executable path. Click Apply. Repeat for all browser shortcuts — the hijacker often modifies multiple locations.
Clean Registry Entries
Press Windows+R, type "regedit" and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and look for entries referencing JarHomediGlive or suspicious executables. Delete them. Also check HKEY_CURRENT_USER\Software for a "JarHomediGlive" key and delete it if present. Be cautious — only delete entries you can positively identify as hijacker-related, as incorrect registry changes can destabilize Windows.
Delete Hijacker Files
Open File Explorer and enable viewing hidden files (View → Options → Change folder and search options → View tab → Show hidden files). Navigate to C:\Users\[YourUsername]\AppData\Local\ and C:\Users\[YourUsername]\AppData\Roaming\. Look for folders with random GUID names or containing "jar" "home" or "diglive" in the name. Delete these folders. Also check C:\ProgramData\ for similar directories.
Check Scheduled Tasks
Press Windows+R, type "taskschd.msc" and press Enter to open Task Scheduler. Review the Task Scheduler Library for tasks that reference the hijacker or run executables from the folders you just deleted. Right-click and delete any suspicious tasks. Some hijacker variants create tasks that periodically reinstall components or modify browser settings.
Run Malwarebytes or Similar Scanner
Download and install Malwarebytes Free (reconnect to internet if necessary, or download on a clean machine and transfer via USB). Run a full system scan to catch any components you might have missed and detect any additional PUPs that were bundled with JarHomediGlive. Follow the prompts to quarantine and remove all detected threats.
Reboot and Verify
Restart your computer normally (not in Safe Mode) and immediately check your browser behavior. Open each browser and confirm your homepage, search engine, and new tab page are set to your preferences. Perform a few searches and page loads to ensure no redirects occur. If the hijacker returns, you likely missed a persistence mechanism — consider bringing the machine to professionals for thorough remediation.
Prevention
- Download software only from official sources. Avoid third-party download portals and always obtain programs directly from the developer's website. These sites often wrap legitimate software in installers that bundle PUPs and hijackers.
- Always choose Custom or Advanced installation. Never click through installers using Express or Recommended settings. Custom installation reveals bundled offers and allows you to deselect unwanted components before they're installed.
- Read installation screens carefully. Watch for pre-checked boxes offering to "enhance your browsing experience," install toolbars, or change your homepage. Uncheck everything that isn't the core software you intended to install.
- Keep browsers and security software updated. Modern browsers include increasingly sophisticated protections against hijackers and malicious extensions. Enable automatic updates and don't postpone them when prompted.
- Use a reputable ad-blocker. Browser extensions like uBlock Origin can prevent many malicious advertisements and fake update prompts from displaying in the first place, eliminating a common infection vector.
- Be skeptical of update prompts. Legitimate software updates almost never come from random websites. If prompted to update Flash, Java, or your browser, close the notification and update manually through official channels.
- Review browser extensions regularly. At least monthly, check what extensions are installed in your browsers. Remove anything you don't actively use or don't remember installing.
- Maintain offline backups of important data. While hijackers typically don't destroy data, having clean backups means you can restore or reimage your system without fear of losing critical files if an infection proves difficult to remove.
Bring It In
If you've tried the manual removal steps and JarHomediGlive keeps returning, or if you're simply not comfortable editing the registry and modifying system files, bring your computer to Computer Repair Roswell. We're located right here in Roswell, Georgia, and we handle browser hijacker infections like this every week. Our technicians will thoroughly clean your system, verify that all persistence mechanisms are eliminated, and check for any additional threats that may have bundled in with the hijacker. Most hijacker removals are completed same-day, often while you wait.
We're open Monday through Saturday and offer free diagnostics — we'll tell you exactly what's on your machine before you commit to any service. Call us at (770) 856-1617 to describe your symptoms and we can often give you an estimated timeline and cost over the phone. For systems that are heavily infected or running slowly even after hijacker removal, we also offer comprehensive tune-up services that include cleaning out other accumulated junk software, optimizing startup programs, and ensuring your security software is properly configured. Don't let a browser hijacker compromise your privacy or frustrate your daily computing — let our experienced team get your system back to normal.