Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Friday, November 15, 2013

How to Remove Aartemis Portal Site (

Tell your friends:
Aartemis Portal Site is a brower hijacker that hijacks your homepage, changes default search engine provider and tracks your web searches. It's operated by Koyoter Technology, the same company that created Qvo6, Qone8 and Do-Search browser hijackers. This browser hijacker appends the command line argument[time stamp]&from=tugs&uid=[hardware ID] to web browser shortcuts which cause web page to open when you launch your web browser. It usually gets onto your computer through software downloads, even from reputable and well known websites or potentially unwanted installers like Firseria or DomaIQ. If there's an option not to install it, please select it, but unfortunately there are plenty of reports of Aartemis being loaded without permission.

Aartemis Portal Site

To remove Aartemis Portal Site from your computer you will have to uninstall associated applications through Control Panel. Then remove web browser extensions called Extended Protection, New Tab and Lightning NewTab. And finally, you will have to reset web browsers' preferences and settings and of course remove additional arguments from shortcuts. All the removal steps are well explained and illustrated below. Hopefully, this removal guide will help you remove the annoying and pesky browser hijackers. If you need help or maybe you you have something to add about it, please leave a comment below. Last but not least, scan your computer with anti-malware software. Aartemis Portal Site comes bundled with spyware, adware and malicious web browser extensions. Who knows what other potentialy dangerous or even malicious applications were installed with this browser hijacker. Better safe than sorry!

Written by Michael Kaur,

Aartemis Portal Site removal instructions:

1. First of all, download recommended anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this browser hijacker. Hopefully you won't have to do that.

2. Uninstall Aartemis Portal Site related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.

If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".

Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.

3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove:
  • Wsys Control
  • Extended Protection
  • eSave Security Control
  • Desk 365
As I said earlier, this application is never listed as Aartemis Portal Site in the currently installed programs list. So, either look for applications mentioned here or try to remember what software you installed recently. It's probably the culprit.

Simply select the application and click Remove. If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.

Remove Aartemis Portal Site from Google Chrome:

1. Click on Customize and control Google Chrome icon. Select Settings.

2. Click Set pages under the On startup.

Remove by clicking the "X" mark as shown in the image below.

3. Click Show Home button under Appearance. Then click Change.

Select Use the New Tab page and click OK to save changes.

4. Click Manage search engines button under Search.

Select Google or any other search engine you like from the list and make it your default search engine provider.

Select Aartemis from the list and remove it by clicking the "X" mark as shown in the image below.

5. Right-click the Google Chrome shortcut you are using to open your web browser and select Properties.

6. Select Shortcut tab and remove "" from the Target field and click OK to save changes. Basically, there should be only the path to Chrome executable file.

Remove Aartemis Portal Site from Mozilla Firefox:

1. Open Mozilla Firefox. In the URL address bar, type about:config and hit Enter.

Click I'll be careful, I promise! to continue.

In the search filter at the top, type: aartemis

Now, you should see all the preferences that were changed by Aartemis. Right-click on the preference and select Reset to restore default value. Reset all found preferences!

4. Right-click the Mozilla Firefox shortcut you are using to open your web browser and select Properties.

5. Select Shortcut tab and remove "" from the Target field and click OK to save changes. Basically, there should be only the path to Firefox executable file.

Remove Aartemis Portal in Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons.

2. Select Search Providers. First of all, choose Live Search search engine and make it your default web search provider (Set as default).

3. Select Aartemis and click Remove to remove it. Close the window.

4. Right-click the Internet Explorer shortcut you are using to open your web browser and select Properties.

5. Select Shortcut tab and remove "" from the Target field and click OK to save changes. Basically, there should be only the path to Internet Explorer executable file.

6. Finally, go to ToolsInternet Options and restore your home page to default. That's it!


Julie A. said...

Wow - thank you sooooo much!

Anonymous said...

Great and thank you

Anonymous said...

Thank you for posting this! Easy and quick solution to my problem. Would have driven myself crazy today (perhaps all week!) trying to figure this out if it wasn't for your post.

Anonymous said...

Thank you very much! I had no idea where to remove from my new computer. Norton Internet Security did not remove it even though Malware is enabled. Thank again!

nurples said...

Everything seems to work, but it still brings up when I open Internet Explorer.

I have made sure that the malicious software is gone and the shortcut does not have ammended on the end.

It still brings it up every time though.

Anonymous said...

And...I think I love you now. THANKS!!

Anonymous said...

many thanks from Milan - you solve a huge problem - avast did non remove - tks again

Anonymous said...

Thank you soooo much!!!

Great Help and I have got rid of it.

Great Instructions as well,much appreciated.

Anonymous said...

Thanks so much, much appreciated with the help on this.

Anonymous said...

Thanks sooo much.

Kyle Harris said...

Thank You so VERY MUCH! I have been using everything I could find to get rid of this #$%! bug, but your information was easy to follow and gave me a wonderful education in the process!!!

Chew said...

Dear Mr Michael Kaur,

Thank you very much for your sharing of a solution to cure AARTEMIS (computer virus)


Anonymous said...

Thank you very much for giving a noble solution to remove AARTEMIS.
Once again thanks a lot...

Anonymous said...

Thank you very much.

Anonymous said...

OK!!!!!! Thank You very much!!!!!!!!!!!!!

Anonymous said...

Hi. I went through all these steps and aartemis still shows up when I open my browsers. I ran malwarebytes again and went to do these browser steps again but the changes that I made the first time were still there. If aartemis has been removed from add-ons and properties, etc., why is it still showing up when I open my browsers? However, "•Wsys Control•Extended Protection•eSave Security Control•Desk 365" were not in my add/remove programs. Could they be called something else? I got the virus in November of 2013. Also, under Internet Options in IE11, under 'startup', 'start with homepage' is greyed out so I can't select it or the other option either. How does this happen and where can I remove the command that is doing that? Thank you.

Admin said...

It could be called WPM17.8.0.3159 or something like, sort programs by installation date. One of the recently installed programs is probably the culprit.