Jessour.er.com is a browser hijacker that forcibly redirects web traffic through its search engine, altering browser settings without user consent. This potentially unwanted program (PUP) typically arrives bundled with free software downloads and immediately takes control of your homepage, new tab page, and default search provider. While not a virus in the traditional sense, it compromises your browsing experience, exposes you to questionable advertising networks, and can collect your search queries and browsing habits for profit.
Browser hijackers like Jessour.er.com operate in a gray area—they're not designed to destroy files or encrypt data, but they're aggressive enough that most security vendors flag them as threats. The primary danger lies in where your searches get routed and what tracking mechanisms get installed alongside the hijacker itself.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Family | Generic search redirect hijacker family |
| Aliases | Jessour.er.com redirect, Jessour hijacker, PUP.Optional.Jessour |
| Affected Platforms | Windows (7/8/8.1/10/11), macOS; primarily through Chrome, Firefox, Edge, Safari browser extensions |
| Distribution Method | Software bundling, deceptive installers, fake update prompts, malvertising |
| Persistence Mechanism | Browser extension policies, scheduled tasks, modified browser shortcuts, registry entries (Windows) |
| Primary Capabilities | Search redirection, homepage modification, new tab hijacking, search query interception, affiliate link injection, ad display |
| Data Collection | Search queries, browsing history, clicked links, IP address, approximate location, browser fingerprint |
| Network Behavior | Redirects through multiple intermediate domains before landing on search results or ad pages; maintains connection to command servers for configuration updates |
| Common Artifacts | Browser extension with randomized ID, modified browser preferences files, scheduled task entries, altered shortcut target paths |
| Removal Difficulty | Moderate—employs multiple persistence methods and may reinstall itself if all components aren't removed |
| Payload Risk | Low to moderate for direct system damage; moderate for privacy violation and exposure to secondary threats through advertising networks |
How It Spreads
Jessour.er.com rarely if ever appears as a standalone download that users intentionally seek out. Instead, it piggybacks on software that people actually want, hiding in the installation process behind pre-checked boxes, "Express" install options, or deceptive button layouts. The free video converter you downloaded, that PDF tool from a third-party site, or the screen recorder advertised on a streaming site—all common vehicles for this type of hijacker.
The bundling technique relies on inattention during installation. Most users click through setup wizards quickly, accepting default settings without reading what's actually being offered. Jessour.er.com and its installer partners count on this behavior. By the time you notice your browser behaving strangely, the hijacker has already modified multiple settings and established several persistence mechanisms.
We see infections from these common vectors at the shop:
- Bundled freeware and shareware from download sites like Softonic, Download.com (when not paying attention to the installer), CNET downloads, and countless smaller repositories
- Fake software update alerts appearing on sketchy websites, especially fake Flash Player, Chrome, or Java update prompts
- Malicious advertising (malvertising) on legitimate sites that unknowingly serve compromised ad content
- Torrent bundles where a keygen or crack includes the hijacker as a "bonus" installation
- Email attachments disguised as invoices or shipping confirmations that launch installers when opened
- Browser extension stores (less common but possible) through extensions that initially seem useful but contain the hijacking code
What It Does On Your Machine
Once installed, Jessour.er.com immediately sets to work modifying your browser configuration. Your homepage changes to jessour.er.com or a related landing page. Your default search engine switches to use Jessour's search function. Every new tab you open displays their page instead of your chosen startup option. If you try to manually change these settings back through your browser's preferences, they'll often revert within seconds or after a browser restart—that's the persistence mechanisms at work.
The search function itself rarely provides original results. Instead, it acts as a middleman, routing your queries through various advertising networks and affiliate programs before eventually displaying results (often pulled from legitimate search engines like Yahoo or Bing). This middleman position lets the hijacker inject sponsored results, track what you're searching for, and earn revenue from every click on certain links. Some searches may redirect you through multiple domains before landing anywhere useful, creating a confusing and slow browsing experience.
Beyond the obvious browser changes, Jessour.er.com typically installs supporting components designed to prevent easy removal. These might include a browser extension with policy enforcement (making it difficult to remove through normal means), scheduled tasks that check for the hijacker's presence and reinstall components if they're missing, and modified browser shortcut files that include command-line parameters forcing the homepage to load. On Windows systems, you'll often find registry entries that set browser policies or startup items.
The privacy implications deserve attention. Browser hijackers like this one collect substantial data about your online activity: what you search for, which sites you visit, how long you stay on pages, what you click. This information builds a detailed profile that gets sold to advertising networks or used to target you with specific ads. While not as immediately dangerous as ransomware or banking trojans, this persistent surveillance represents a real privacy violation, especially if you're searching for sensitive information related to health, finances, or personal matters.
Manual Removal — Step by Step
Disconnect and document
Disconnect from the internet if you're concerned about continued data collection during the removal process. Take note of which browsers are affected and what specific symptoms you're experiencing (homepage changed, search redirects, new tabs hijacked). This helps verify complete removal later.
Uninstall suspicious programs
Open Control Panel (Windows) or Applications folder (Mac) and look for recently installed programs you don't recognize, especially those installed around the time the browser hijacking started. Uninstall anything suspicious, paying particular attention to programs with names containing "search," "web," "browser," or random characters. Don't skip this step—hijackers often install a "manager" program.
Remove browser extensions
In each affected browser (Chrome, Firefox, Edge, Safari), access the extensions or add-ons manager and remove anything you didn't intentionally install. Look for extensions with vague names, no reviews, or that were added without your knowledge. In Chrome, navigate to chrome://extensions/. In Firefox, go to about:addons. Remove, don't just disable—disabled extensions can be re-enabled by the hijacker's persistence mechanisms.
Reset browser settings
Each browser needs its settings manually corrected. Change your homepage back to your preferred page (or blank). Set your default search engine back to Google, Bing, or your choice. Check your new tab settings. Then check the "On startup" settings to ensure Jessour.er.com isn't listed there. If settings keep reverting, there's still a persistence mechanism active—move to the next steps.
Check and fix browser shortcuts
Right-click on every browser shortcut you use (desktop, taskbar, Start menu) and select Properties. In the Target field, verify it ends with the browser executable (chrome.exe, firefox.exe, etc.) with no additional parameters or URLs after it. If you see anything appended after the .exe, delete that portion. Click Apply and OK. This prevents the hijacker from forcing its homepage on startup.
Remove scheduled tasks and startup items
Press Win+R, type "taskschd.msc" and press Enter to open Task Scheduler. Review the task list for anything related to Jessour, web updaters, or suspicious randomized names. Delete suspicious tasks. Then open Task Manager (Ctrl+Shift+Esc), check the Startup tab, and disable anything related to the hijacker. On Mac, check System Preferences > Users & Groups > Login Items.
Clean the registry (Windows only)
Press Win+R, type "regedit" and press Enter. Navigate to HKEY_CURRENT_USER\Software and look for folders related to Jessour or recently created entries you don't recognize. Delete suspicious entries. Also check HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Policies for hijacker-related entries. Make a backup of your registry before making changes if you're uncomfortable with this step.
Run a reputable anti-malware scanner
Download and run Malwarebytes (free version is fine) or another reputable anti-malware tool. Let it complete a full scan and remove everything it finds. Browser hijackers often install secondary components that manual removal misses. Even if you think you've gotten everything, run the scan—we regularly find additional PUPs and tracking components during this step.
Consider a browser reset
If problems persist after all previous steps, use your browser's built-in reset function. In Chrome, go to Settings > Reset settings > Restore settings to their original defaults. In Firefox, go to Help > More Troubleshooting Information > Refresh Firefox. This removes all extensions, resets settings, but preserves bookmarks and passwords. It's a nuclear option that works when persistence mechanisms are particularly stubborn.
Change passwords and verify removal
If the hijacker was present for more than a few days, change passwords for sensitive accounts, especially if you entered them while the hijacker was active. Restart your computer, reconnect to the internet, and verify that your browser opens with your chosen settings and searches go to your selected search engine without redirects. Test opening several new tabs and conducting searches to confirm the hijacker is completely gone.
Prevention
- Always choose "Custom" or "Advanced" installation when installing any software, especially free programs. Read each screen carefully and uncheck any offers to install additional programs, browser toolbars, or change your browser settings. The few extra seconds spent here prevent hours of cleanup later.
- Download software only from official sources. Get Chrome from google.com/chrome, not from a download aggregator site. Get VLC from videolan.org, not from softonic or download.com. Third-party download sites are notorious for bundling legitimate software with hijackers and PUPs.
- Keep your browser and security software updated. Modern browsers include better defenses against unwanted modifications, but only if you're running current versions. Enable automatic updates for your operating system, browsers, and security software.
- Install a reputable ad blocker. Extensions like uBlock Origin block many of the malicious advertisements that lead to hijacker downloads. They also prevent the fake update prompts and misleading download buttons that trick users into installing unwanted software.
- Be skeptical of update prompts. Legitimate software updates don't arrive as pop-ups while you're browsing random websites. If a site tells you to update Flash, Chrome, Java, or any other software, close the page and check for updates directly through the software itself or the official website.
- Review installed programs and browser extensions regularly. Once a month, check what's installed on your computer and what extensions are in your browsers. Remove anything you don't recognize or no longer use. Many infections persist simply because users don't notice them among legitimate programs.
- Don't ignore your security software's warnings. If Windows Defender, Malwarebytes, or your antivirus flags something during an installation, stop and investigate. Users who override these warnings to install "that one program they really need" often end up on our service bench.
- Create a standard user account for daily use. On Windows, use a standard (non-administrator) account for everyday browsing and work. Many hijackers require administrator privileges to install their persistence mechanisms. This won't stop all infections, but it adds a useful hurdle.
When we remove browser hijackers and other malware at Computer Repair Roswell, the work comes with a 90-day warranty. If the same threat comes back within that window, we'll remove it again at no charge. We don't just clean the infection—we verify removal, check for related threats, and explain what happened so you can avoid reinfection.
Bring It In
If you've worked through the removal steps above and your browser still redirects through Jessour.er.com, or if you'd rather have professionals handle it from the start, bring your machine to our Roswell shop. Browser hijackers often travel with friends—adware, potentially unwanted programs, sometimes more serious threats. We'll scan thoroughly, remove everything we find, verify your browser settings are clean, and check for any damage to system files or security settings. Most hijacker removals take 30-60 minutes at the bench.
Computer Repair Roswell is located on Alpharetta Street in downtown Roswell. We're open Monday through Saturday, and walk-ins are welcome (though calling ahead at 470-202-3167 helps us give you an accurate wait time). We handle both Windows PCs and Macs, and we'll explain exactly what we found and what we removed. No computer jargon, no upselling—just straight talk about what your machine needs to get back to working properly.