Doktox.com Browser Hijacker – Malware Removal Guide (Easy Steps)

The following tutorial will show you how to completely remove Doktox.com from your browser.

By Andy Mulholland - Malware Researcher 6 Min Read

Our team classifies Doktox.com as a malicious browser hijacker virus because of its ability to replace the browser's primary search engine, such as Google, and redirect all queries to its own website instead.

We discovered that this threat can be difficult to remove for the average user because it uses persistence techniques, necessitating additional steps to remove it from the browser, and simply resetting browser settings will not work.

Not to mention, Doktox.com is linked to malicious browser extensions, which serve as its primary gateway into the browser. As a result of the browser hijacker infection, you may notice unwanted extensions appear.

If all of your search queries lead to Doktox.com rather than your preferred search engine, you've been infected with a malicious browser hijacker.

Browser hijackers in general

Browser hijackers are exactly what the name implies. They use malicious code to take over the infected computer's web browser, changing the default home page, look, and search engine to forcefully promote their undesirable website without the user's consent.

They were very popular from the early 2000s to the early 2010s, and while their relevance has somewhat faded, there are still many malware campaigns that use browser hijackers to infect users.

They insert unwanted advertisements and affiliate links into the browser by redirecting the user's searches to their malfunctioning search engine, where they control the results and display advertisement links instead of legitimate search results.

This type of threat can be dangerous because, in addition to generating poor search results, the virus can track and monitor the infected computer's browser activity.

Threat behavior

We examined the aforementioned browser hijacker in a malware testing environment, and Doktox.com behaved like any other malware.

When a user searches in the top search box, they will be redirected to Findflarex.com (a gateway domain), after which the browser lands on Doktox.com.

According to our observations, Doktox.com does not modify browser settings because the default search engine and home tab remain unchanged; however, it does use undesirable extensions to redirect the browser.

Doktox.com currently uses the malicious extensions EasySearch and QuickFind to force the hijacker onto the browser.

As time passes, this threat will switch to a different extension to maintain its evasiveness, as previous extensions may be flagged and reported to Google Chrome or Edge.

Furthermore, it is not just any ordinary browser extension; it was installed with policies that prevent it from being uninstalled normally.

They set the browser's “managed by organization” policy, which makes Doktox.com the entity in charge of the browser.

As a result, any attempts to remove the root extension will fail and the extension will be reinstalled, even if the user uses the browser extensions folder.

There are also time triggers and checks in place to initiate an action to reinstall Doktox.com and any unwanted extensions back into the browser if they are discovered to have been deleted by the user.

We identified this threat as an updated version of browser hijackers Boyu.com.tr and Potterfun.com because they perform the same functions and use browser extensions.

According to our findings, to completely remove the browser hijacker virus, you must delete the unwanted registry keys created by the malware, as well as the tasks that will be executed once the malware detects that it has been deleted.

Only then can the extension be completely removed from the browser without reinstalling it.

Doktox.com Front Page
Doktox.com homepage showing default WordPress installation

Aside from that, we discovered that Doktox.com's main page is disguised as a starter WordPress website.

Users may encounter redirections and search results on the aforementioned site, but if you visit it directly, it will display a blog page full of articles, implying that it hides itself.

The search engine functionality can be accessed via search syntax on the URL: https://doktox[.]com/q/?q=enter-any-query-here.

Distribution network

The malicious browser hijacker, like other malware, installs itself on computers and browsers by promoting itself through fake download buttons in torrenting networks and untrustworthy software platforms.

These are very common, and many people fall for them because they only appear after clicking the download button on a fraudulent website.

File hosting platforms are also the leading cause of browser hijacker infections because they contain numerous advertisements, forcing users to scroll through hundreds before beginning to download.

Boyu.com.tr malware payload
Doktox.com malware payload

The image above shows a fraudulent download page from a dangerous torrenting site that includes the Doktox.com browser hijacker, extension, and other malicious payload.

More details about Doktox.com

We are seeing a high volume of payloads containing Doktox.com, and, unfortunately, it may be infecting a large number of computer users at the time of writing.

Both the browser hijacker and the malicious extension were most likely created by the same entity, as they work together to prevent removal from the user's computer.

If you are having difficulty removing the Doktox.com browser hijacker, we have provided step-by-step instructions below to help you do so.

Doktox.com removal instructions

You have come to the right place if you need help getting rid of Doktox.com from your computer.

This part onwards will show you how to do that. Please make sure you follow the steps exactly to get rid of the malware threat.

We considered the technical skills of the people who use the internet, so we made sure the steps are simple enough that even those who aren't tech-savvy could follow them.

Before you continue, make sure you have a backup of your data saved somewhere. If you don't, your files may be destroyed or lost as you follow the procedures below. These situations are uncommon, but we recommend taking precautions just in case.

Remove Doktox.com Instantly

Poor protection often leads to malware infection. Let Bitdefender, the world’s leading antivirus, handle Doktox.com with ease. It's time to stop worrying about malware.

Start Protecting Your Device Today

We've teamed up with Bitdefender to offer Hackerdose visitors an exclusive 50% discount on their products. Now is the time to start taking your computer security seriously with the best antivirus on the planet.

For the Overviews

To remove the Doktox.com hijacker virus from your browser, you only need to follow a simple four-step procedure:

Step 1: Delete the malicious extension
Step 2: Remove browser malware with AdwCleaner
Step 3: Uninstall unwanted software
Step 4: Run additional malware scans

Step 1: Delete the malicious extension

Extensions can be the leading cause of Doktox.com causing issues with the browser. However, it may be difficult to remove them if certain browser policies are set to make it persist. It might disable the delete button which makes it hard to do so.

For this reason, we will first need to delete the policies it has set on the browser before attempting to remove unwanted extensions.

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge

How to remove Google Chrome browser policies:

Note: If using the Chrome Policy Remover did not work, you can use this manual method to get rid of the pesky policy.

1. To do this, we will use Chrome Policy Remover. Download the Windows version by clicking here.

ChromePolicy Step1

2. Proceed to download delete_chrome_policies.bat by clicking Download anyway.

ChromePolicy Step2

3. Once the bat file has finished downloading, run it as administrator to begin removing unwanted policies set by the malware.

ChromePolicy Step3

4. If the Microsoft Defender SmartScreen prevented it from running, click Run anyway. This tool has been recommended enough times in the Google Chrome community therefore we can vouch that it is safe to run. (VirusTotal results of the Policy Remover.)

ChromePolicy Step4

5. The command prompt will open up, it will close Chrome and delete certain malicious policies. Once the policies are removed, you can now close the command prompt and begin removing the extension.

ChromePolicy Step5
Delete the Google Chrome enterprise policy manually (Alternative)

1. Open the Windows start menu and type Registry Editor.

2. Right-click the first result and select Run as Administrator.

3. In the Registry Editor, go to the following keys and delete each folder one by one:

HKEY_CURRENT_USER\Software\Google\Chrome
HKEY_CURRENT_USER\Software\Policies\Google\Chrome
HKEY_LOCAL_MACHINE\Software\Google\Chrome
HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome
HKEY_LOCAL_MACHINE\Software\Policies\Google\Update
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Enrollment

4. We are not done yet, head over to the following registry key:

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientState{430FD4D0-B729-4F61-AA34-91526481799D}

5. Find and delete the value named CloudManagementEnrollmentToken.

6. Lastly, open the File Explorer program and paste the following to the address bar:
%ProgramFiles(x86)%\Google\Policies

7. Select and delete the Policies folder if there is one present.

Following that, close and reopen Google Chrome and the enterprise policy should have been removed.

How to delete unwanted extensions from Chrome:

1. Open Google Chrome and click the three horizontal dots on the upper-right corner of the screen.

ChromeExtension Step1

2. From the dropdown menu, select Extensions and click Manage Extensions.

ChromeExtension Step2

3. You should now be able to click the Remove button. Continue to do so in order to remove the unwanted extension from the browser. (For this example, we will be using Google Docs Offline.)

ChromeExtension Step3

How to remove Mozilla Firefox browser policies:

1. Open the browser and type about:policies in the address bar.

FirefoxPolicy Step1

2. Take note of the active policy names as shown on the screen.

FirefoxPolicy Step2

3. Press Windows Key + R to open the Run command.

FirefoxPolicy Step3

4. Type regedit and hit enter to open the Registry Editor.

FirefoxPolicy Step4

5. Go to the following directory: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox

FirefoxPolicy Step5

6. Delete the policies that matched the ones shown on the browser policy page earlier. With this, we can proceed with deleting the unwanted extension.

FirefoxPolicy Step6

How to remove unwanted extensions from Firefox:

1. Open the Firefox browser and click the extension icon on the upper-right corner of the screen.

FirefoxExtension Step1

2. Click on the cog icon near the unwanted extension you want to install. From the dropdown menu, select Remove Extension. (We will be using a sample extension to demonstrate.)

FirefoxExtension Step2

How to delete browser policies set in Microsoft Edge:

1. Open Command Prompt as administrator.

EdgePolicy Step1

2. Type in the following code and enter each line separately.

taskkill /im msedge.exe /f
reg delete "HKCU\Software\Policies\Microsoft\Edge" /f
reg delete "HKLM\Software\Policies\Microsoft\Edge" /f

3. Once finished, close Command Prompt and we can begin removing the unwanted extension/s from the browser.

EdgePolicy Step3

How to remove unwanted extensions from Microsoft Edge:

1. Open Microsoft Edge and click the Extensions icon on the top bar of the browser.

EdgeExtension Step1

2. Click on Manage Extensions.

EdgeExtension Step2

3. Find the unwanted extension and click Remove.

EdgeExtension Step3

Step 2: Remove browser malware with AdwCleaner

AdwCleaner is a utility tool that is primarily used for cleaning adware and potentially unwanted applications (PUP) from the computer.

This program is also primarily used to find and remove malware that is targeted at the web browser.

Here's how to install and use AdwCleaner:

1. To start, download the latest version of AdwCleaner.

AdwCleaner Step1

2. Once AdwCleaner has finished downloading (adwcleaner.exe), run the executable file.

AdwCleaner Step2

3. If the User Account Control window pops up, click Yes to proceed with running the program.

AdwCleaner Step3

4. Once the program has launched, agree to the End User License Agreement by clicking the I Agree button.

AdwCleaner Step4

5. Click on the Scan Now button to begin scanning your computer for browser threats such as adware, PUPs, and more.

AdwCleaner Step5

6. Wait for AdwCleaner to finish scanning the files on the system. This may take a while depending on how large the files on your device are, as well as your system's hardware capabilities.

AdwCleaner Step6

7. Once the scan is complete, proceed to take action by following the on-screen instructions. Otherwise, if the scan shows a clean result, click Run Basic Repair to reset Winsock and other settings before finishing the process.

AdwCleaner Step7

Step 3: Uninstall unwanted software

Another possible source of the Doktox.com browser hijacker is malicious software.

Such malware might be able to change browser settings in order to support the aforementioned browser threat. As a result, you should check your computer for unknown programs that you did not install.

While the latest version of Windows allows you to accomplish this through the Add & Remove Programs section, it is still far simpler to use the Programs and Features page in the Control Panel.

The publisher name, the installation date, and the version number will all be displayed in a single grid screen, making it simpler to locate the malware. Here's how to do so:

1. Click on the Windows key to open the Start menu.

Uninstall Step1

2. Type Control Panel in the provided search bar and select the first item from the search results.

Uninstall Step 2

3. Click on Programs and inside, select Programs and Features.

Uninstall Step3

4. You will be presented with a list of programs currently installed on your computer.

Uninstall Step4

5. Find programs you do not recognize and right-click the item then select Uninstall/Change from the dropdown menu.

Uninstall Step5

We'll need to use a powerful uninstaller to do the dirty work for us if the software is stubborn and won't go away with normal approaches.

Fortunately, there are tools for this; Revo Uninstaller is a good uninstaller program made to tackle and remove uninstallable programs.

Revouninstaller icon Uninstall malicious program/s using Revo Uninstaller

1. To start, download Revo Uninstaller by clicking here. Avoid downloading from third-party sources as they may contain additional bloatware upon installation.

Revo Step1

2. On the download page, opt for the free version of Revo Uninstaller as it has all the features we need. Click on Free Download to begin downloading the setup file.

Revo Step2

3. The revosetup.exe file would have started downloading. Click on it to start installing the software.

Revo Step3

4. Revo Uninstaller setup would now begin and follow the typical setup procedure such as selecting your setup language, accepting the license agreement, and selecting the installation location. Once setup is ready click Install.

Revo Step4

5. After the setup is finished, check the Launch Revo Uninstaller option to open the program upon closing the installer.

Revo Step5

6. Once Revo Uninstaller has opened, it will show you the list of applications currently installed on the computer. Find the unwanted program/s, right-click it, and select Uninstall from the drop-down menu. (We will be using PC App Store to demonstrate.)

Revo Step6

7. A confirmation message stating if you are sure you want to uninstall the said program, click Continue.

Revo Step7

8. Follow the uninstallation instructions and this time, Revo Uninstaller would have forced the program to continue with the uninstallation compared to the previous attempt via Control Panel.

Revo Step8

9. You will be notified that the software has been uninstalled, Revo Uninstaller will now conduct a preliminary examination and get rid of additional files and registries related to the unwanted program.

Revo Step9

10. On the selection of Scanning modes, select Advanced to make sure everything is scanned without leaving a single directory unnoticed.

Revo Step10

11. Wait for the scan to finish as Revo Uninstaller is checking for residual files and registries related to the suspicious program.

Revo Step11

12. Revo Uninstaller may have found leftover Registry items, click Select All and proceed to delete them by clicking the Delete button next to it. After that, click Next.

Revo Step12

13. It may have also found some leftover files and folders, simply do the same by clicking Select All and deleting them. Now click Finish and the uninstallation of the program is done.

Revo Step13

Step 4: Run additional malware scans

Antivirus engines may not detect new threats in the early stages of infection due to the malware not yet being recognized by the security software. It might be discovered in the end, but it may be too late for the infected machines.

However, new malware threats may contain strings and signatures from previous malware in a database of existing security products. As a result, other antivirus software may identify it while others do not.

Since some antivirus software may not be able to detect it, we'll need more than one piece of security software to help us locate and remove the harmful threat.

Here's the good news: The programs mentioned below are completely free, which means you do not need to spend a dime to solve your malware problem. You can always use them anytime you feel your system is infected.

Please run the software individually. You can do so in any particular order.

  • Removal Tool
  • Emergency Kit
  • ESET Scanner
  • Malwarebytes
About the software

1. To start, download the Kaspersky Virus Removal Tool.

KVRT Step1

2. Once the download of the executable file (KVRT.exe) is complete. The program doesn't need to be installed on the computer, so you may begin running it straight away.

KVRT Step2

3. After reading the KSN Statement, Privacy Policy, and End User License Agreement, check the box indicating your agreement to the terms and conditions. To continue, click Accept.

KVRT Step3

4. Please wait for the system initialization process to finish, as the program will first check if your system is compatible.

KVRT Step4

5. Before we start scanning, we will have to set the scope of the scan. Click the Change parameters option to do so.

KVRT Step5

6. Check all the boxes to allow the computer to search through all of the disks and directories for malware. After that, click OK to return to the main screen.

KVRT Step6

7. We can now begin the scan; simply click the Start scan button, and the Virus Removal Tool will begin.

KVRT Step7

8. Await the scan's completion with patience. If there are any risks within the computer system, a notification will be displayed.

KVRT Step8

9. To completely remove the risks that the program has identified, click Delete from the drop-down menu of each discovered object.

KVRT Step9

10. Click Continue to remove the identified malware threats from your computer.

KVRT Step10
About the software

1. Download the Emsisoft Emergency Kit portable software.

Emsisoft Step1

2. You can launch the executable program (EmsisoftEmergencyKit.exe) directly from your downloads folder after downloading it.

Emsisoft Step2

3. Click Yes to let the program start on the computer when the User Account Control window appears.

Emsisoft Step3

4. Choose your program's destination folder and accept the license and maintenance terms. Next, click Install to continue.

Emsisoft Step4

5. Click Malware Scan on the homepage of the Emergency Kit application to start the scanning process. The amount of time it takes for the program to scan your computer will depend on how many files you have and the hardware capabilities of your system.

Emsisoft Step5

6. Emsisoft Emergency Scanner will display a list of the files that the program has detected when the scan is complete. To get rid of threats from your computer, click on Quarantine selected.

Emsisoft Step6

7. To complete the malware removal procedure, Emsisoft Emergency Scanner may also ask you to restart your computer. Simply click Reboot your system to finish the process.

Emsisoft Step7
About the software

1. Download the most recent version of ESET Online Scanner.

ESET Step1

2. After pressing the download button, the file (Esetonlinescanner.exe) should have been downloaded to your computer. It does not require any installations so you can simply run the aforementioned file.

ESET Step2

3. Before using ESET Online Scanner, it must be initialized. Choose your preferred language and click Get started. Continue as directed by the screen until the homepage appears.

ESET Step3

4. Click Computer scan from the homepage, then select Full scan from the three options available.

ESET Step4

5. Give ESET Online Scanner the permission to detect and remove potentially unwanted apps by ticking the Enable option. After that, click Start scan to begin the scanning process.

ESET Step5

6. Await the completion of the malware scan for your machine by the ESET Online Scanner. ESET Online Scanner would have automatically removed the threats it found after the scan. To complete the malware cleanup process, click Proceed.

ESET Step6
About the software

Note: We will only use the free version of Malwarebytes because it includes all of the capabilities we require.

1. Download the latest version of Malwarebytes Anti-malware.

Malwarebytes Step1

2. Malwarebytes will start downloading (MBSetup.exe) the installation file. Run the executable after the download is complete.

Malwarebytes Step2

3. To allow the program to execute, simply click Yes in the User Account Control window that may appear.

Malwarebytes Step3

4. The Malwarebytes setup wizard will now open; select Install to continue.

Malwarebytes Step4

5. You will be prompted by Malwarebytes to install the Browser Guard extension. Depending on whether you want it on your browser or not, you can choose to download it (the extension is completely free).

Malwarebytes Step5

6. Please wait as the Malwarebytes Setup installs itself. Follow the on-screen instructions until you have successfully installed Malwarebytes.

Malwarebytes Step6

7. Start by launching Malwarebytes Anti-malware for the first time after it has been installed. If you're installing Malwarebytes for the first time, you'll get a 14-day free trial of the premium version.

Malwarebytes Step7

8. After the program takes you to the main dashboard, click the Scanner box in the middle to start scanning the computer.

Malwarebytes Step8

9. You won't click Scan just yet when you get to the Scanner page. Rather, select Advanced scans as shown below.

Malwarebytes Step9

10. In the Custom scan section, click Configure scan. We will be able to alter the way the software scans the computer as a result.

Malwarebytes Step10

11. To detect hidden malware, click the box next to Scan for rootkits on the Configure Custom Scan screen. Additionally, to enable Malwarebytes to scan every drive on your computer, check the boxes next to each one.

Malwarebytes Step11

12. Once the Custom Scan options have been adjusted, click the Start Custom Scan button to get started.

Malwarebytes Step12

13. A side window displaying the computer scan's progress will appear. Please wait until Malwarebytes has completed its malware scan of the entire system.

Malwarebytes Step13

14. Following the completion of the scan, a list of threats found will appear. Check the boxes near all the malicious files and get rid of them from the computer by clicking the Quarantine button.

Malwarebytes Step14

If prompted, please restart your computer since Malwarebytes may require it.

Since the programs mentioned above are all portable, you can always run them straight from your downloads folder whenever you feel the presence of malware in your computer.

We recommend that you organize them all into a single folder for future use.

Optional: Reset the browser settings to default

When it comes to browser-targeted malware, it will alter the browser settings for the threat to persist. Therefore simply changing the search engine back to default may not work in many cases.

If the malware still persists, we should reset the web browser to its default settings from when it was first installed. This will get rid of all the configurations the malicious threat has set.

Note: Resetting the browser will get rid of all the data except for saved bookmarks and passwords.

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge

1. Open the Chrome browser and click the three horizontal dots at the upper-right corner of the screen.

Chrome Step1

2. On the dropdown menu, scroll down to the bottom and click Settings.

Chrome Step2

3. In the left sidebar, scroll down and find Reset settings.

Chrome Step3

4. Click on Reset settings to their original defaults.

Chrome Step4

5. A confirmation window will appear, click Reset settings to proceed.

Chrome Step5

1. Launch the Firefox browser and click the hamburger menu on the upper-right corner of the screen.

Firefox Step1

2. From the dropdown menu, scroll down and click on Help.

Firefox Step2

3. Inside the Firefox help menu, click More troubleshooting information.

Firefox Step3

4. Under Give Firefox a tune up, select Refresh Firefox… to reset the browser.

Firefox Step4

5. A confirmation window will appear, proceed by clicking Refresh Firefox.

Firefox Step5

1. Run Microsoft Edge and click on the three horizontal dots on the upper-right side of the screen.

Edge Step1

2. From the dropdown menu, select Settings.

Edge Step2

3. Open the hamburger menu, scroll down, and select Reset settings.

Edge Step3

4. Inside Reset settings, click on Restore settings to their default values.

Edge Step4

5. A confirmation window will appear, click Reset to proceed.

Edge Step5

After the web browser has finished resetting, download the important extensions you previously used, and pin the tabs you once had. Set it the way it was previously configured before the malware infection.

Browser protection tips

As the saying goes:The biggest vulnerability is the person behind the screen

So, here are some tips and what you need to know in order to keep your device safe and malware-free in the long run.

Keep every software installed up to date

Make sure that all of the programs in your computer is up-to-date with the latest version released by the developer. The reason behind this is that these updates frequently tackle bugs and issues that malware actors often exploit.

The same goes for your computer's operating system, make sure Windows is up-to-date with the latest software update to prevent malware from exploiting a hidden vulnerability.

Avoid downloading files from unknown sources

One of the biggest sources of malware infection in a computer system is third-party installations. This happens when a user downloads a certain program from sources that are not the official download links. Some of the common types of sources where malware is present are torrent files, cracked software, and games.

Be careful with opening email attachments

Malware often disguises itself as resumes and quotations and threat actors often send thousands of these infected emails to company employees around the world in order to infiltrate their network.

Always check where your emails are coming from as there may be a chance that the project attachment you received via email did not actually come from a co-worker.

Do not visit unreputable websites

Avoid visiting websites that contain unfiltered advertisements such as illegal streaming websites, cracked software platforms, and links sent out to you by somebody you do not trust.

These sites are often linked to redirect chains that load once you click on an ad element on the page. Following this chain often leads to drive-by malware and phishing pages that an average user may eventually fail to notice.

Leave a comment