The mcpp.sh.com threat represents a browser hijacker that forcibly redirects users to unwanted websites, manipulates search results, and injects intrusive advertisements into legitimate web pages. Discovered primarily affecting Windows systems, this hijacker typically masquerades as a legitimate browser extension or component while secretly altering browser configurations to generate revenue through forced traffic and sponsored content. While not as destructive as ransomware or banking trojans, mcpp.sh.com can significantly degrade browsing performance, expose users to potentially malicious sites, and create persistent privacy concerns by tracking browsing habits.
Browser hijackers like mcpp.sh.com occupy an uncomfortable middle ground in the threat landscape—technically not classified as viruses in the traditional sense, but undeniably unwanted and often bundled with more serious malware. Users frequently discover they've been infected when their homepage suddenly changes without permission, search queries route through unfamiliar domains, or their browser becomes sluggish with excessive pop-ups and redirects.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Aliases | mcpp.sh redirect, mcpp.sh.com virus, MCPP Hijacker |
| Platform | Windows (7, 8, 8.1, 10, 11); primarily affects Chrome, Firefox, Edge |
| Discovered | Variants circulating since approximately 2019 |
| Distribution Methods | Software bundling, fake updates, deceptive download buttons, compromised extensions |
| Persistence Mechanisms | Browser extension policies, scheduled tasks, registry Run keys, shortcut target modification |
| Primary Capabilities | Homepage/search engine hijacking, redirect manipulation, ad injection, tracking cookie deployment |
| Typical Indicators | Unauthorized homepage changes, mcpp.sh.com in search queries, excessive redirects, new browser extensions |
| Network Behavior | Connections to ad networks and redirect chains; varies by affiliate configuration |
| Data at Risk | Browsing history, search queries, potentially form data and credentials depending on capabilities |
| Removal Difficulty | Moderate—requires multiple cleanup steps across browser and system levels |
| Reinfection Risk | High without addressing the original distribution vector and updating security practices |
How It Spreads
Browser hijackers like mcpp.sh.com rarely arrive through sophisticated exploitation techniques. Instead, they rely on user deception and inattention during software installation. The most common infection vector involves software bundling, where the hijacker piggybacks on legitimate-seeming free applications downloaded from third-party sites. Users who rush through installation wizards using "Express" or "Recommended" options unknowingly agree to install additional components, including the hijacker.
Fake update notifications represent another significant distribution channel. Users encounter convincing browser pop-ups claiming their Flash Player, video codec, or even their browser itself requires an urgent update. Clicking these prompts downloads an installer package that includes the hijacker alongside—or sometimes instead of—any legitimate software. These fake updates often appear on streaming sites, torrent pages, and other high-traffic locations where users expect to encounter technical requirements.
Compromised or intentionally malicious browser extensions pose a third pathway. The mcpp.sh.com hijacker may initially enter as a seemingly useful extension promising enhanced search features, coupon-finding capabilities, or download management. Once installed with the required permissions, the extension implements its hijacking functionality. Distribution methods include:
- Software bundle installers from download portals offering free utilities, media players, or PDF converters
- Fake system update notifications mimicking legitimate Windows or browser update prompts
- Deceptive download buttons on file-sharing sites that lead to sponsored installers rather than the intended file
- Malicious advertisements (malvertising) on compromised legitimate websites that trigger downloads or redirects
- Email attachments or links in phishing campaigns directing users to download compromised software
- Infected USB drives or removable media containing autorun configurations that deploy the hijacker
- Extension marketplaces where the hijacker briefly appears as a legitimate tool before detection and removal
What It Does On Your Machine
Once installed, mcpp.sh.com immediately begins modifying browser configurations to establish control over your web experience. The hijacker alters your homepage, default search engine, and new tab settings to route all searches and navigation through its controlled domains. When you attempt to search using your address bar or search box, queries first pass through mcpp.sh.com servers, which log your search terms and browsing patterns before eventually redirecting to a search results page—typically a customized version of a legitimate search engine like Google or Bing, but interspersed with sponsored results and advertisements.
The infection establishes multiple persistence mechanisms to survive removal attempts. It typically modifies browser shortcuts by appending the hijacker URL to the target path, ensuring the hijacked page loads even after browser settings are manually restored. Scheduled tasks may run periodically to reapply hijacker settings, and registry entries in the Run keys ensure components load at system startup. Some variants install policy-based restrictions that prevent users from changing certain browser settings, displaying error messages when manual removal is attempted.
Beyond simple redirection, mcpp.sh.com variants often inject additional content into web pages you visit. This includes overlaying advertisements on legitimate sites, inserting affiliate links to replace original merchant links, and creating pop-under windows that load advertising content while you browse. The tracking components gather extensive data about your browsing habits, search queries, frequently visited sites, and potentially form data entered on websites. This information feeds into advertising profiles sold to third parties or used to deliver increasingly targeted—and intrusive—advertisements.
%LOCALAPPDATA%\MCPP\mcpp_service.exe
%APPDATA%\MCPPUpdater\
%PROGRAMFILES(X86)%\MCPP Search Enhancer\
# Registry persistence locations
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MCPP Service
HKLM\Software\WOW6432Node\MCPP\
# Browser policy enforcement (Chrome example)
HKLM\Software\Policies\Google\Chrome\HomepageLocation = mcpp.sh.com
# Scheduled task
Task Name: MCPP Update Task
Trigger: At log on, repeat every 3 hours
# Browser shortcut modification example
"C:\Program Files\Google\Chrome\Application\chrome.exe" http://mcpp.sh.com
Performance degradation accompanies the functional changes. Browsers consume noticeably more memory and CPU resources as the hijacker's scripts execute on each page load. Network traffic increases substantially as the hijacker communicates with command-and-control servers, downloads advertising content, and transmits collected browsing data. Users frequently report slower page load times, delayed response to clicks, and occasional browser freezes as conflicting scripts compete for resources.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or disable Wi-Fi through your system tray. This prevents the hijacker from downloading additional components, receiving updated configuration instructions, or transmitting collected data while you work on removal. This precaution also protects against reinfection during the cleanup process.
Boot into Safe Mode with Networking
Restart your computer and repeatedly press F8 during boot (or Shift+F8 on newer systems). Select "Safe Mode with Networking" from the advanced boot options. This loads Windows with minimal drivers and services, preventing most hijacker components from launching automatically while still allowing you to download security tools if needed.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11). Sort by installation date and carefully review recently installed programs. Look for unfamiliar entries containing terms like "Search," "Enhancer," "Updater," or names similar to MCPP. Uninstall anything suspicious. Be thorough—hijackers often install multiple related programs with different names.
Remove Malicious Browser Extensions
Open each installed browser and access its extensions/add-ons manager (typically chrome://extensions for Chrome or about:addons for Firefox). Remove any extensions you didn't intentionally install or that were added around the time the hijacking began. Disable "Developer mode" in Chrome if it's enabled—hijackers sometimes use this to install unpacked extensions that don't appear in normal listings.
Clean Browser Shortcuts and Settings
Right-click each browser shortcut (desktop, taskbar, Start menu) and select Properties. In the Target field, remove anything after the legitimate .exe path—hijackers append URLs here. Reset each browser to default settings through its settings menu (this preserves bookmarks but removes hijacker configurations). Manually verify homepage and search engine settings afterward.
Delete Registry Persistence Entries
Press Windows+R, type "regedit," and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for unfamiliar entries, particularly those referencing files in %LOCALAPPDATA% or %APPDATA% folders. Right-click and delete suspicious entries. Also check HKLM\Software\Policies for browser policy restrictions imposed by the hijacker.
Remove Scheduled Tasks
Open Task Scheduler (search for it in the Start menu). Review the Task Scheduler Library for entries created by the hijacker—look for tasks with generic names running executables from user directories or %TEMP% folders. Right-click and delete any tasks associated with MCPP or scheduled to run browser-related commands you don't recognize.
Delete Hijacker Files and Folders
Open File Explorer and navigate to %LOCALAPPDATA% and %APPDATA% (type these in the address bar). Look for folders named after the hijacker or with suspicious generic names created around the infection date. Delete these entire folders. Empty your Recycle Bin afterward. If you encounter "file in use" errors, note the folder path and return to it after the next step.
Run Malwarebytes and a Secondary Scanner
Reconnect to the internet and download Malwarebytes Free (or use an existing installation). Run a full system scan—not just a quick scan. After Malwarebytes completes its cleanup, run a second scanner like HitmanPro or AdwCleaner for verification. Different tools catch different remnants, and thorough cleaning requires multiple passes with complementary detection engines.
Change Passwords and Verify System Integrity
Because browser hijackers can capture form data, change passwords for critical accounts—starting with email, banking, and any financial sites. Use a different device if possible while your system is still suspect. Reboot normally (not Safe Mode) and verify that browsers open without hijacker interference, no suspicious processes appear in Task Manager, and no unauthorized scheduled tasks have reappeared.
Prevention
- Download software only from official sources. Avoid third-party download sites that bundle additional software with installers. Go directly to the developer's website or use the Microsoft Store for Windows applications. When you must use a third-party site, scrutinize download buttons carefully—the real download is often a small text link rather than a prominent button.
- Always choose Custom/Advanced installation. Never click through installers using Express or Recommended settings. Custom installation reveals bundled offers and optional components, allowing you to uncheck unwanted additions. Read each screen carefully—some installers use intentionally confusing language where "Accept" actually installs unwanted software.
- Maintain updated security software with real-time protection. Windows Defender provides baseline protection, but consider supplementing with Malwarebytes Premium for real-time blocking of PUPs and hijackers. Keep all security software current and configured to scan downloads automatically. Enable browser-based protection features like Chrome's Safe Browsing or Firefox's Tracking Protection.
- Ignore fake update notifications in browsers. Legitimate software updates never arrive through random browser pop-ups. Windows updates through the Settings app, browsers update automatically or via their internal update mechanism, and hardware drivers update through Device Manager or manufacturer utilities. If you see an update prompt on a webpage, close that tab immediately.
- Review installed extensions monthly. Browser extensions request powerful permissions and frequently update their code. Audit your extensions quarterly, removing anything you no longer actively use. Research extensions before installation by checking reviews, developer reputation, and the number of users. Be especially wary of extensions promising enhanced search features or ad-blocking capabilities.
- Create a limited user account for daily use. Run your Windows system with a standard user account rather than an administrator account for everyday browsing and work. Hijackers and other malware have more difficulty establishing system-wide persistence without administrator privileges. Use the administrator account only for legitimate software installation and system maintenance.
- Enable browser sandboxing and security features. Modern browsers include isolation features that contain malicious code. Ensure Chrome's site isolation is enabled (it's default in newer versions), and keep your browser updated to receive the latest security patches. Consider using browser profiles to separate work browsing from personal browsing, limiting exposure if one profile becomes compromised.
- Educate household members and employees. Most infections result from user actions rather than sophisticated attacks. Teach everyone with computer access to recognize fake download buttons, avoid suspicious email attachments, and immediately report anything unusual like unexpected homepage changes. A few minutes of training prevents hours of cleanup work.
Bring It In
Browser hijackers like mcpp.sh.com can feel overwhelming to remove manually, especially when multiple persistence mechanisms reestablish the infection after each cleanup attempt. If you've followed the steps above and still experience redirects, or if you're simply not comfortable editing the registry and system files, professional help resolves the issue quickly and completely. Our technicians at Computer Repair Roswell handle dozens of these infections monthly and have the diagnostic tools to identify every remnant, even those hidden in less obvious locations.
We're located in Roswell, Georgia, just off Highway 9 near the historic district. Bring your infected computer to our shop at your convenience—no appointment necessary for drop-offs, though calling ahead at (770) 637-2435 ensures we have a technician available if you need to wait. Most hijacker removals complete within 2-3 hours, and we'll verify your system is clean, update your security software, and provide specific recommendations to prevent reinfection. We'll also check for any additional threats that may have entered alongside the hijacker, ensuring your computer is comprehensively secured before it leaves our bench.