This page shows how to remove pesquisa.ninja from Mozilla Firefox, Google Chrome and Internet Explorer.
Did you just see pesquisa.ninja in the status bar of your browser and ask yourself where it came from? Or did pesquisa.ninja show up while you searched for something on one of the major search engines, such as the Google.com search engine?
(Sorry for the watermarks. Need to add them to prevent the most blatant attempts of other bloggers using my screenshots without attribution)
In my case, pesquisa.ninjam showed up in the status bar while I was doing a search at Google.
The following are some of the status bar messages you may see in your browser’s status bar:
- Waiting for pesquisa.ninja…
- Transferring data from pesquisa.ninja…
- Looking up pesquisa.ninja…
- Read pesquisa.ninja
- Connected to pesquisa.ninja…
Does this sound like your experience, you probably have some potentially unwanted program installed on your system that makes the pesquisa.ninja domain appear in your web browser. Contacting the owner for the site you were at would be a waste of time. The pesquisa.ninja status bar messages are not coming from them. I’ll try help you to remove the pesquisa.ninja status bar messages in this blog post.
Those that have been following this blog already know this, but here we go: A little while back I dedicated some of my lab systems and deliberately installed some potentially unwanted programs on them. I have been observing the behaviour on these computers to see what kinds of advertisements, if any, that are displayed. I’m also looking on other interesting things such as if the potentially unwanted program updates itself, or if it downloads and installs additional software on the systems. I first noticed pesquisa.ninja in Mozilla Firefox’s status bar on one of these lab computers.
pesquisa.ninja resolves to the 89.30.141.30 address. pesquisa.ninja was registered on 2014-09-22.
According to DomainTools and YouGetSignal’s reverse lookup, the following domains also resolve to the same IP address:
- bogots.com
- dounty.com
- pesquisa.ninja
- pesquisa.gratis
- vancouver.craigslist.ca
- www.safesearch.co
- zwiiky.com
So, how do you remove pesquisa.ninja from your browser? On the machine where pesquisa.ninja showed up in the status bar I had WNet, CashReminder, ActSys and Plain Savings installed. I removed them with FreeFixer and that stopped the browser from loading data from pesquisa.ninja.
Judging from Alexa’s traffic rank, pesquisa.ninja is getting quite a lot of traffic:
The bad news with status bar notifications such as this one is that it can be caused by many variants of potentially unwanted programs, not just the potentially unwanted program that’s installed on my system. This makes it impossible to say exactly what you need to remove to stop the statusbar messages.
Anyway, here’s my suggestion for the pesquisa.ninja removal:
- What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
- You can also check the web browser add-ons. Same thing here, do you see something that you don’t remember installing?
- If that did not help, I’d recommend a scan with FreeFixer to manually track down the potentially unwanted program. FreeFixer is a freeware tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:
An example of FreeFixer’s “More Info” links. Click for full size.
Did you find any potentially unwanted program on your machine? Did that stop pesquisa.ninja? Please post the name of the potentially unwanted program you uninstalled from your machine in the comment below.
Thank you!