Mentrandingswon.com is a browser hijacker that forcibly redirects your web traffic through dubious search engines and advertising networks. This unwanted application modifies browser settings without permission, replacing your homepage and default search provider while injecting intrusive advertisements into your browsing sessions. While not typically classified as a virus in the traditional sense, browser hijackers like Mentrandingswon.com exhibit malicious behavior by compromising your privacy, degrading system performance, and potentially exposing you to more serious threats through the deceptive ads and redirects they generate.
Users typically discover they're infected when their browser suddenly starts opening to an unfamiliar page, search queries route through suspicious intermediary sites, or an overwhelming number of pop-up advertisements appear even on legitimate websites. The hijacker persists through multiple techniques that make casual removal attempts ineffective, requiring systematic cleanup to fully eradicate.
Threat Profile
| Classification | Browser Hijacker / Potentially Unwanted Program (PUP) |
|---|---|
| Threat Family | Search redirect hijackers, adware bundlers |
| Common Aliases | Mentrandingswon redirect, Mentrandingswon.com virus, Search.mentrandingswon.com |
| Platforms Affected | Windows 7/8/8.1/10/11, macOS (browser-based threat affects all platforms) |
| Browsers Targeted | Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera |
| Distribution Method | Software bundling, fake software updates, deceptive advertisements, freeware installers |
| Persistence Mechanisms | Browser extensions, scheduled tasks, registry modifications, Start menu shortcuts with modified targets |
| Primary Capabilities | Search redirection, homepage replacement, new tab hijacking, ad injection, browsing history tracking |
| Data at Risk | Browsing history, search queries, clicked links, potentially form data and credentials if more aggressive variants are involved |
| Network Behavior | Establishes connections to advertising networks, affiliate tracking servers, and redirect intermediaries; typical domains include variations of mentrandingswon.com and associated redirect chains |
| Common Filesystem Artifacts | Browser extension folders in user profile directories, scheduled task XML files, modified browser shortcuts |
| Removal Difficulty | Moderate — reinstalls itself through multiple persistence vectors if not completely removed |
How It Spreads
Mentrandingswon.com spreads primarily through software bundling, a deceptive distribution tactic where the hijacker piggybacks on legitimate-looking freeware installers. When users download what appears to be a useful utility — a PDF converter, video codec pack, system optimizer, or similar tool — from third-party download sites, the installer often includes "optional" components that aren't actually optional at all. The bundled hijacker installs silently alongside the desired software, or gets installed when users click through installation screens without reading the fine print or unchecking pre-selected boxes.
Another common infection vector involves fake software update notifications. You may encounter pop-up messages claiming your Flash Player, Java, browser, or media player is out of date and needs immediate updating. These fake alerts appear on compromised websites or are injected by existing adware already on your system. Clicking the "Update Now" button downloads an installer that delivers the hijacker instead of legitimate software updates.
Distribution methods for Mentrandingswon.com include:
- Software bundling with freeware: Download managers, media players, browser toolbars, and system utilities from sites like Softonic, Download.com, or similar repositories often bundle hijackers in their installation packages
- Fake update notifications: Convincing pop-ups mimicking Adobe Flash Player, browser, or codec update screens that actually deliver malware
- Malicious advertisements: Malvertising on legitimate sites where clicking an ad triggers a drive-by download or redirect to a fake download page
- Email attachments and links: Phishing messages with attachments that claim to be invoices, shipping notifications, or documents but execute installer scripts
- Compromised websites: Legitimate sites that have been hacked to inject malicious scripts that automatically trigger downloads
- Peer-to-peer networks: Torrents and file-sharing platforms where infected installers are disguised as popular software or media files
What It Does On Your Machine
Once installed, Mentrandingswon.com immediately reconfigures your web browser settings. Your homepage — the page that loads when you open your browser — gets changed to mentrandingswon.com or a related search portal. Your default search engine gets replaced with the hijacker's search service, meaning any search queries you type into the address bar route through their system rather than Google, Bing, or your preferred search provider. The "new tab" behavior also changes so that opening a new browser tab loads the hijacker's page instead of your normal new tab page.
The hijacker maintains these changes through several technical mechanisms. It may install a browser extension that actively monitors and re-applies the malicious settings if you try to change them back manually. It creates scheduled tasks that periodically check browser configurations and reset them to the hijacked state. Some variants modify the browser shortcut itself, adding command-line parameters that force the browser to open specific pages on startup. This multi-layered persistence is why simply changing your homepage back to Google doesn't solve the problem — the hijacker just changes it back the next time you restart your browser or computer.
Beyond search redirection, Mentrandingswon.com generates revenue through aggressive advertising. You'll encounter an abnormal number of pop-up windows, even on websites that normally don't show pop-ups. Legitimate advertisements on websites get replaced with ads from the hijacker's network. Text on web pages gets turned into hyperlinks that, when accidentally clicked, open advertising pages. Banner ads appear in places they shouldn't, sometimes overlaying actual page content and making websites difficult to use.
The privacy implications are substantial. Browser hijackers like Mentrandingswon.com track every website you visit, every search query you enter, and every link you click. This data gets transmitted to remote servers where it's analyzed for advertising targeting and potentially sold to data brokers. While this hijacker isn't typically classified as spyware in the strictest sense, it collects and monetizes your browsing behavior without meaningful consent. More concerning, the redirect chains and deceptive advertisements can expose you to more dangerous threats — fake tech support scams, additional malware downloads, and phishing pages designed to steal credentials.
Manual Removal — Step by Step
Disconnect from the Network
Unplug your Ethernet cable or disable Wi-Fi to prevent the hijacker from communicating with its command servers, downloading additional components, or transmitting collected data while you work on removal. Some hijacker variants attempt to reinstall themselves from remote servers if they detect removal attempts, so working offline provides a cleaner environment.
Boot to Safe Mode with Networking
Restart your computer and boot into Safe Mode with Networking. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select option 5 (Safe Mode with Networking). Safe Mode loads only essential Windows components and prevents most malware from starting automatically, giving you a cleaner environment for removal. Reconnect to the internet once in Safe Mode for the scanning steps.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11). Sort by installation date and look for programs installed around the time the hijacking started. Remove anything unfamiliar or suspicious, particularly items with generic names, programs you don't remember installing, or anything related to browser helpers, optimizers, or toolbars. Common culprits include entries with names containing random characters, "Helper," "Updater," or the mentrandingswon name itself.
Remove Browser Extensions
Open each web browser you use and remove all unfamiliar or suspicious extensions. In Chrome, navigate to chrome://extensions/, enable Developer Mode to see extension IDs, and remove anything you don't recognize. In Firefox, go to about:addons and check both Extensions and Themes. In Edge, visit edge://extensions/. Remove everything installed around the infection date, especially extensions with vague names, those lacking descriptions, or anything related to search helpers or ad blockers you didn't deliberately install.
Check and Fix Browser Shortcuts
Right-click your browser shortcuts (on desktop, taskbar, and Start menu) and select Properties. In the Target field, verify there's nothing after the main .exe file path. Hijackers often add parameters like "--homepage=http://mentrandingswon.com" after the executable path. Delete everything after the closing quote mark around the .exe path. If the Target field won't let you edit it or keeps reverting, delete the shortcut entirely and create a fresh one by right-clicking the browser .exe file and selecting Create Shortcut.
Reset Browser Settings
Perform a settings reset in each browser. Chrome: Settings > Reset and clean up > Restore settings to their original defaults. Firefox: about:support > Refresh Firefox. Edge: Settings > Reset settings > Restore settings to their default values. This removes hijacked homepages, search engines, and startup pages while preserving bookmarks and passwords. After resetting, manually set your preferred homepage and search engine again.
Run Malwarebytes Anti-Malware
Download Malwarebytes (the free version works fine for this) and run a full system scan. Malwarebytes specializes in detecting and removing PUPs, browser hijackers, and adware that traditional antivirus may miss. Let it complete the full scan, which may take 30-60 minutes, then quarantine and remove everything it finds. Restart your computer when prompted.
Scan with Your Antivirus
Run a full scan with your primary antivirus software (Windows Defender is adequate if you don't have a third-party solution). This provides a second opinion and catches any remaining components that Malwarebytes might have missed. Address any detections by following the antivirus software's recommendations.
Check Scheduled Tasks and Startup Items
Open Task Scheduler (taskschd.msc) and review the Task Scheduler Library for suspicious tasks, especially those running files from user AppData directories or temporary folders. Delete any tasks related to browser helpers or with suspicious names. Then check startup programs in Task Manager (Ctrl+Shift+Esc, Startup tab) and disable anything unfamiliar that wasn't caught by the previous removal steps.
Change Passwords from a Clean Device
If you entered passwords, used banking sites, or accessed sensitive accounts while infected, change those passwords — but do it from a known-clean device or after you're confident your system is clean. Browser hijackers sometimes work in conjunction with information stealers, so credentials entered during the infection period may be compromised. Prioritize email, banking, and any accounts with stored payment methods.
Verify Removal and Monitor
Restart your computer normally (not in Safe Mode) and verify that your browser opens to your chosen homepage, searches use your preferred search engine, and no unexpected pop-ups appear. Monitor your system for the next few days for any signs of the hijacker returning. If search redirects resume or settings revert, you may have missed a persistence mechanism and should consider professional help.
Prevention
- Download software only from official sources. Get programs directly from the developer's website rather than third-party download repositories. When you need VLC, get it from videolan.org, not from download.com or softonic. Official sources don't bundle unwanted software with their installers.
- Read installation screens carefully. During software installation, use the Custom or Advanced installation option rather than Express/Quick install. Actually read each screen. Uncheck boxes for browser toolbars, homepage changes, additional software offers, and anything that isn't the program you intentionally downloaded. Decline all optional offers.
- Keep your actual software updated. Enable automatic updates for Windows, your browsers, and common plugins. Real software updates come through official built-in updaters or authenticated downloads from the vendor website — never through random pop-up notifications while browsing. If you see an update notification, close it and manually check for updates through the application's official update mechanism.
- Use an ad blocker. Install a reputable ad-blocking extension like uBlock Origin to reduce exposure to malicious advertisements that trigger drive-by downloads or display fake update notifications. Legitimate websites might ask you to whitelist them, which is reasonable for sites you trust, but ad blockers significantly reduce malware exposure during general browsing.
- Maintain real-time antivirus protection. Windows Defender (built into Windows 10/11) provides solid baseline protection if kept updated. If you use third-party antivirus, keep it current. Real-time protection catches many hijackers during the installation attempt, before they modify your system.
- Be skeptical of tech support pop-ups. If a webpage displays an alert claiming your computer is infected and providing a phone number to call, it's a scam. Real security software doesn't work through web browsers with pop-up alerts. Close the browser tab (use Task Manager if the tab won't close normally) and run a scan with your actual antivirus software.
- Review browser extensions monthly. Make it a habit to periodically audit your installed browser extensions. Remove anything you don't actively use or don't remember installing. Extensions accumulate over time, and checking them regularly helps you spot hijackers quickly.
- Create a system restore point before installing new software. Before installing unfamiliar programs, create a Windows restore point. If something goes wrong, you can roll back to before the installation, though this isn't a perfect solution since some malware survives restore operations.
When Computer Repair Roswell removes malware from your system, we stand behind our work with a 90-day warranty. If the same infection returns within 90 days through no fault of your own — meaning you didn't revisit the infection source or disable your security software — bring it back and we'll clean it again at no additional charge. We don't just remove the visible symptoms; we eliminate the root cause and implement prevention measures so you stay clean.
Bring It In
Manual removal works for many infections, but browser hijackers like Mentrandingswon.com can be stubborn, hiding components in places most users won't think to check. If you've followed these steps and still see search redirects, if your browser settings keep reverting, or if you're simply not comfortable diving into system-level configurations, bring your computer to Computer Repair Roswell. We handle these infections routinely and can typically complete a thorough cleaning in a few hours while you wait or go about your day in Roswell. We'll eliminate every trace of the hijacker, verify your system is genuinely clean, and make sure your security configuration will help prevent reinfection.
We're located at 1240 Warsaw Road in Roswell, open Monday through Saturday with no appointment necessary for most repairs. Call us at (770) 856-1705 if you want to check on current wait times or discuss your specific situation. Whether you're dealing with Mentrandingswon.com or any other malware infection, we'll get your machine back to working properly without the frustration of fighting persistent infections yourself. And with our 90-day warranty, you can have confidence that when we say it's gone, it stays gone.