Also Known As: Nation Zoom Redirect
Type: Browser Hijacker
Damage level: Moderate
Distribution: High
Damage Level virus removal instructions

The ' virus' is a term used to describe a potentially unwanted application, which modifies Internet browser (Internet Explorer, Google Chrome, and Mozilla Firefox) settings by assigning the default search engine and homepage fields to

This browser hijacker is distributed using a deceptive software marketing method called 'bundling'. Commonly, Internet users install this browser hijacker without their consent when downloading free software. Recent research shows that this browser settings-changing adware is also proliferated using fake downloads (for example, fake browser, Java, or Flash Player updates). This adware is especially rogue since it installs a browser 'helper object' (Wsys Control), which prevents users from changing their browser settings. Furthermore, this adware modifies the shortcut targets of any installed Internet browsers.

To avoid installation of this potentially unwanted application, computer users should download program updates only from developers' websites directly. Furthermore, do not trust pop-up ads, which state that your installed programs (for example, Java, Flash, etc.) are outdated. Internet users should be aware that, today, most free software download websites use dubious 'download clients' to monetize their free services, and thus, reckless freeware downloading can result in installation of various adware. The website adds no real value, and moreover, cyber criminals responsible for creating this browser hijacker can easily redirect Internet users to any malicious site of their choosing, thus infecting computers with high-risk malware. You are advised to eliminate this adware from your Internet browser/s. redirect virus

The browser hijacker is identical to previous adware, which redirects Internet users to,,, and many other dubious Internet search engines. To avoid installation of such potentially unwanted programs (PUPs), be attentive when downloading free software. If your download is managed by a download client, opt-out of installation of any advertised browser extensions by clicking the 'decline' button. When installing the downloaded software, use the 'Custom' or 'Advanced' installation options, rather than 'Quick' or 'Typical' - this step will reveal installation of any bundled adware. If your Internet browsers redirect you to, use the removal instructions provided to eliminate this browser hijacker from your computer. virus removal: uninstall from Control Panel (Wsys control)

Windows 7 users:

Click "Start" ("Windows Logo" in the bottom left corner of your desktop), choose "Control Panel".

Windows XP users:

Click "Start", choose "Settings" and click "Control Panel". Locate and click "Add or Remove Programs".

Windows 8 users:

Right-click in the screen’s bottom-left corner, select Control Panel. In the opened window choose "Uninstall a Program".

In the uninstall programs window: look for "Wsys Control", select this entry and click "Uninstall" or "Remove".

After uninstalling potentially unwanted programs (which cause browser redirects to the website), scan your computer for any remaining unwanted components. To scan your computer, use recommended malware removal software. Remove all entries that this program detects to ensure your PC is clean from any possible spyware and malware infections.

Scan your computer for possible malware infections

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat. homepage and default search engine removal from browsers:

Video showing how to remove potentially unwanted browser add-ons:

Remove virus from Internet Explorer:

Removing from Internet Explorer shortcut target

Fix Internet Explorer shortcut target:

This browser hijacker changes the "Target" field of the Internet Explorer shortcut. To fix this, locate the Internet Explorer shortcut on your Desktop and click the right mouse button over it. In the opened menu choose "Properties". In the opened window locate Target field and eliminate text (hxxp://, which is entered after "C:\Program Files\Internet Explorer\iexplore.exe".

Change homepage:

Removing from Internet Explorer homepage

Click "Tools" (or the gear icon in Internet Explorer 9), select "Internet Options", in the opened window remove and enter your preferred domain, which will open each time you launch Internet Explorer.

Change default search engine:

Removing from Internet Explorer default search engine settings

Click "Tools" (or the gear icon in Internet Explorer 9), select "Manage Add-ons". In the opened window select "Search Providers", set "Google", "Bing" or any other preferred search engine as your default and then remove "Nation Zoom".

If you continue to have problems with redirects to, reset your Internet Explorer settings to default.

Windows XP users: Click "Start", click "Run", in the opened window type "inetcpl.cpl". In the opened window click the "Advanced" tab, then click Reset.

Windows Vista and Windows 7 users: Click the Windows logo, in the start search box type "inetcpl.cpl" and click enter. In the opened window click the "Advanced" tab, then click Reset.

Remove virus from Google Chrome:

Removing from Google Chrome shortcut target

Fix Google Chrome shortcut target:

This browser hijacker changes the "Target" field of the Google Chrome shortcut. To fix this, locate your Google Chrome shortcut on your Desktop and click the right mouse button over it. In the opened menu choose "Properties". In the opened window locate the Target field and eliminate all text (hxxp://, which is entered after "C:\Program Files\Google\Chrome\Application\chrome.exe"

Remove related browser extensions:

Removing related plugins from Google Chrome extension

Click the bars icon (top right of the screen), select "Tools" and click on "Extensions". Locate "Extended Protection" and "Lightning Newtab", select them and click the trash can icon.

Change homepage:

Removing from Google Chrome homepage

Click the wrench (bars) icon, select "Settings". In "On startup" section click "set pages", hover your mouse over and click the x symbol. Now you can add your preferred website as your homepage.

Change default search engine:

Removing from Google Chrome default search engine settings

To change your default search engine in Google Chrome: Click on the "Bars" icon (top right corner), select "Settings", in the "Search" section click "Manage Search Engines...", remove "NationZoom" and add or select your preferred domain.

Remove virus from Mozilla Firefox:

Removing from Mozilla Firefox shortcut target

Fix Mozilla Firefox shortcut target:

This browser hijacker changes the "Target" field of the Mozilla Firefox shortcut. To fix this, locate your Mozilla Firefox shortcut on your Desktop and click the right mouse button over it. In the opened menu choose "Properties". In the opened window locate the Target field and eliminate all text (hxxp://, which is entered after "C:\Program Files\Mozilla Firefox\firefox.exe"

Change homepage:

Removing from Mozilla Firefox homepage

Click "Firefox" (at the top left of the main window), then select "Options", in the opened window remove and enter your preferred domain.

Change default search engine:

In the URL address bar, type about:config and press Enter.
Click "I'll be careful, I promise!".
In the search filter at the top, type: "nationzoom"
Right-click on the found preferences and select "Reset" to restore default values.

Optional method:

If you continue to have problems with redirects to, reset your Mozilla Firefox settings to default.

Open Mozilla Firefox, at the top left corner of the main window click "Firefox", in the opened drop down menu choose Help and then click on Troubleshooting Information, in the opened window click the "Reset Firefox" button.


A browser hijacker is a type of adware that alters user's Internet browser settings by changing one's homepage and default Internet search engine to some unwanted website. Most commonly this type of adware infiltrates user's operating system through free software downloads. While browser redirects might seem as a low risk security infection, computer users should know that the websites to which they are being redirected to commonly contain deceptive online advertisements and the Internet search engine that is presented in such websites might return shady Internet search results. Using such websites for one's daily Internet searches might easily end up in privacy issues, identity theft or malware infections.

A computer that is affected by a browser hijacker is exposed to high risk security infections. To prevent further privacy and security issues it's recommended removing any Internet browser settings altering adware as soon as possible. Here are some examples of free software download clients that are used in Virus distribution:

Free software download managers distributing browser hijackers

To avoid installation of Virus be very attentive when downloading and installing free software. If your download is managed by a download client be sure to opt out of installing advertised toolbars or applications that seek to change your homepage and default Internet search engine:

Declining installation of browser hijackers

Some of the mentioned free software download clients don't allow downloading the chosen free program if user decides to decline installation of it's offered toolbars, in such cases it's recommended to cancel the installation and look for an alternative download source.

Symptoms indicating that your Internet browsers are affected by a browser hijacker:

  • Your homepage and/or default Internet search engine is changed.
  • Appearance of new toolbars.
  • Slow performance of Internet browsers.
  • New Bookmarks or Favorites added.
  • You can't change your homepage or default search engine.
  • You see online ads on your screen that are not served by the website.
  • You get redirected to pages you never intended to visit.

If you are experiencing problems while trying to remove Virus from your Internet browsers, please ask for assistance in our malware removal forum.


#7 Yoly 2013-12-14 16:50

:D :D :D
#6 Juank 2013-12-07 19:21
I tried to delete it by myself and I couldn't even after reading many articles and watching videos showing how to do it. Finally I read your article and was able to remove it... thanks.
#5 Avery 2013-12-03 14:38
Thank you! This worked great!

For others, remember to also right click on the shortcuts pinned to the start bar (e.g. right click chrome, then right click "google chrome" from menu and click properties. Then make the changes to the shortcut as described above.
#4 admin 2013-12-03 01:27
HI D S Craft, have you checked your Internet browser's shortcut target? If you won't remove the added entries in your shortcut targets none of your mentioned programs will be able to eliminate this browser hijacker.
#3 D S Craft 2013-12-02 17:48
Doesn't work. I've run a full scan of newly updated Malwarebytes in the Safe Mode - clean. I've run a full scan of newly updated Spybot in the Safe Mode - clean. I've run a boot time scan with Avast set in the high heuristics mode - clean. The above doesn't work. Nation Zoom doesn't show up in about:config. I've reset my Firefox browser using Help-troubleshooting . It makes no difference. When I open Firefox it goes straight to Nation Zoom. If I hit the homepage icon, then it goes to my designated homepage (Bing search). Of course Nation Zoom doesn't show up in my Programs list or as and add-on in Firefox. ????
#2 Rajiv 2013-12-01 22:44
Great !!! This completely works, thanks. That was becoming a pain !
#1 Chu Donald Obii 2013-11-30 15:50
Just wanted to say THANK YOU for this instructional, it solved my problem.

Have a wonderful weekend.
About the author:

I am passionate about computer security and technology. I have an experience of 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an editor for since 2010.

Follow me on Google+ to stay informed about the latest online security threats.

Our malware removal guides are free. However, if you want to support us you can send us a donation.