Home Malware Programs Potentially Unwanted Programs (PUPs) Webssearches.com

Webssearches.com

Posted: November 22, 2013

Webssearches.com Screenshot 1Webssearches.com is a search site that has a history of being involved in browser search-based hijacks that redirect you to Webssearches.com automatically. Webssearches.com browser hijackers often are bundled with Airzip, a product promoted by the same company in charge of maintaining Webssearches.com, and both of these programs are considered PUPs (Potentially Unwanted Programs). Although malware experts don't rate Webssearches.com as a threatening website, they do warn that letting any third party programs control which sites your browser loads is a potentially significant security issue. Using anti-malware products to verify the total removal of a Webssearches.com hijacker always is laudable – even if you installed Webssearches.com on purpose.

Webssearches.com's Unusual Marketing: File Compression as a Means of Promoting Web Searches

Webssearches.com is a domain strongly affiliated with Airzip, a file compression and decompression utility that offers itself as a free alternative to Winzip. Although Airzip's functions are legitimate, malware researchers warn that the side effects of its installations aren't exactly lighter than air, with heavy footprints left on the Chrome Web browser. The unnecessary modifications to Chrome made during the installation of Airzip may provide redirects to Webssearches.com. Although Webssearches.com does provide some instructions for reversing these browser changes, past reports have indicated that these instructions are incomplete and don't necessarily allow for the total removal of these Webssearches.com hijackings.

When your browser is set to redirect to Webssearches.com, the worst that can happen is that you may be forced to use a search engine with questionable accuracy for its results. However, Webssearches.com isn't classified as a threatening website, and malware experts haven't found any intentionally hostile links mixed in with Webssearches.com's search results. Webssearches.com may not be commendable as a good search engine, but brief contact with Webssearches.com doesn't endanger your PC.

Searching for the Best Way Away from Webssearches.com

Because Webssearches.com hijacks usually are a result of installing Airzip (either on purpose or by mistake), you always should check for the presence of that software in the face of unusual browser behavior promoting Webssearches.com. Removing Airzip shouldn't be unnecessary for removing the related browser hijacker from your PC, although malware experts would suggest considering it. Most Potentially Unwanted Programs include questionable benefits in contrast to their drawbacks – and it should be a matter of moments of browsing the Web to find functional equivalents to Airzip that aren't associated with browser hijacking campaigns.

Regardless of how Webssearches.com is been installed, deleting Webssearches.com hijackers by using suitable anti-malware products always is the best thing to do for your browser and, by extension, your online safety. At this time, only Chrome has been confirmed as a target for these Airzip-bundled hijacks, but malware researchers have seen nearly identical browser hijackers affect all other brands of browsers, and your ongoing vigilance towards likely infection vectors is paramount.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AppData%\SupTab File name: %AppData%\SupTab
%AppData%\SupTab\SupTab.dll File name: %AppData%\SupTab\SupTab.dll
File type: Dynamic link library
Mime Type: unknown/dll
%AppData%\webssearches File name: %AppData%\webssearches
%AppData%\webssearches\92.json File name: %AppData%\webssearches\92.json
Mime Type: unknown/json
%AppData%\webssearches\images File name: %AppData%\webssearches\images
%AppData%\webssearches\images\bg1.png File name: %AppData%\webssearches\images\bg1.png
Mime Type: unknown/png
%AppData%\webssearches\images\button1.png File name: %AppData%\webssearches\images\button1.png
Mime Type: unknown/png
%AppData%\webssearches\images\checked.png File name: %AppData%\webssearches\images\checked.png
Mime Type: unknown/png
%AppData%\webssearches\images\close.png File name: %AppData%\webssearches\images\close.png
Mime Type: unknown/png
%AppData%\webssearches\images\min.png File name: %AppData%\webssearches\images\min.png
Mime Type: unknown/png
%AppData%\webssearches\images\Thumbs.db File name: %AppData%\webssearches\images\Thumbs.db
Mime Type: unknown/db
%AppData%\webssearches\images\unchecked.png File name: %AppData%\webssearches\images\unchecked.png
Mime Type: unknown/png
%AppData%\webssearches\uninstallDlg.xml File name: %AppData%\webssearches\uninstallDlg.xml
Mime Type: unknown/xml
%AppData%\webssearches\UninstallManager.exe File name: %AppData%\webssearches\UninstallManager.exe
File type: Executable File
Mime Type: unknown/exe
%CommonAppData%\IePluginService File name: %CommonAppData%\IePluginService
%CommonAppData%\IePluginService\PluginService.exe File name: %CommonAppData%\IePluginService\PluginService.exe
File type: Executable File
Mime Type: unknown/exe
%CommonAppData%\IePluginService\update File name: %CommonAppData%\IePluginService\update
%CommonAppData%\WPM File name: %CommonAppData%\WPM
%CommonAppData%\WPM\update File name: %CommonAppData%\WPM\update
%CommonAppData%\WPM\update\conf File name: %CommonAppData%\WPM\update\conf
%CommonAppData%\WPM\wprotectmanager.exe File name: %CommonAppData%\WPM\wprotectmanager.exe
File type: Executable File
Mime Type: unknown/exe
C:\Program Files\Mozilla Firefox\searchplugins\webssearches.xml File name: C:\Program Files\Mozilla Firefox\searchplugins\webssearches.xml
Mime Type: unknown/xml
C:\Program Files\SupTab File name: C:\Program Files\SupTab
C:\Program Files\SupTab\DpInterface32.dll File name: C:\Program Files\SupTab\DpInterface32.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\DpInterface64.dll File name: C:\Program Files\SupTab\DpInterface64.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\DpInterfacef32.dll File name: C:\Program Files\SupTab\DpInterfacef32.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\ient.json File name: C:\Program Files\SupTab\ient.json
Mime Type: unknown/json
C:\Program Files\SupTab\install.data File name: C:\Program Files\SupTab\install.data
Mime Type: unknown/data
C:\Program Files\SupTab\RSHP.exe File name: C:\Program Files\SupTab\RSHP.exe
File type: Executable File
Mime Type: unknown/exe
C:\Program Files\SupTab\SearchProtect32.dll File name: C:\Program Files\SupTab\SearchProtect32.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\SearchProtect64.dll File name: C:\Program Files\SupTab\SearchProtect64.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\SpAPPSv32.dll File name: C:\Program Files\SupTab\SpAPPSv32.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\SpAPPSv64.dll File name: C:\Program Files\SupTab\SpAPPSv64.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\SupTab.dll File name: C:\Program Files\SupTab\SupTab.dll
File type: Dynamic link library
Mime Type: unknown/dll
C:\Program Files\SupTab\uninstall.exe File name: C:\Program Files\SupTab\uninstall.exe
File type: Executable File
Mime Type: unknown/exe
C:\Program Files\SupTab\web File name: C:\Program Files\SupTab\web
C:\Program Files\SupTab\web\img File name: C:\Program Files\SupTab\web\img
C:\Program Files\SupTab\web\img\default_logo.png File name: C:\Program Files\SupTab\web\img\default_logo.png
Mime Type: unknown/png
C:\Program Files\SupTab\web\img\icon128.png File name: C:\Program Files\SupTab\web\img\icon128.png
Mime Type: unknown/png
C:\Program Files\SupTab\web\img\icon16.png File name: C:\Program Files\SupTab\web\img\icon16.png
Mime Type: unknown/png
C:\Program Files\SupTab\web\img\weather File name: C:\Program Files\SupTab\web\img\weather
C:\Program Files\SupTab\web\indexIE.html File name: C:\Program Files\SupTab\web\indexIE.html
Mime Type: unknown/html
C:\Program Files\SupTab\web\indexIE8.html File name: C:\Program Files\SupTab\web\indexIE8.html
Mime Type: unknown/html
C:\Program Files\SupTab\web\js File name: C:\Program Files\SupTab\web\js
C:\Program Files\SupTab\web\js\background.js File name: C:\Program Files\SupTab\web\js\background.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\js\ga.js File name: C:\Program Files\SupTab\web\js\ga.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\js\jquery-base.js File name: C:\Program Files\SupTab\web\js\jquery-base.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\js\jquery.autocomplete.js File name: C:\Program Files\SupTab\web\js\jquery.autocomplete.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\js\js.js File name: C:\Program Files\SupTab\web\js\js.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\js\xagainit.js File name: C:\Program Files\SupTab\web\js\xagainit.js
File type: JavaScript file
Mime Type: unknown/js
C:\Program Files\SupTab\web\style.css File name: C:\Program Files\SupTab\web\style.css
Mime Type: unknown/css
C:\Program Files\SupTab\web\ver.txt File name: C:\Program Files\SupTab\web\ver.txt
Mime Type: unknown/txt
C:\Program Files\SupTab\web\_locales File name: C:\Program Files\SupTab\web\_locales
C:\Program Files\SupTab\web\_locales\en-US File name: C:\Program Files\SupTab\web\_locales\en-US
C:\Program Files\SupTab\web\_locales\en-US\messages.json File name: C:\Program Files\SupTab\web\_locales\en-US\messages.json
Mime Type: unknown/json
C:\Program Files\SupTab\web\_locales\es-419 File name: C:\Program Files\SupTab\web\_locales\es-419
C:\Program Files\SupTab\web\_locales\es-419\messages.json File name: C:\Program Files\SupTab\web\_locales\es-419\messages.json
Mime Type: unknown/json

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = "1"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WPM

15 Comments

  • ingrid lino says:

    esse pograma infectou meu computador com vírus, não entra em site nenhum... quero que remova imediatamente.

  • Even Tobiasson says:

    Hi! The Webssearches.com has Control over my PC, they Lock my PC so i cant klick on enny thing. Should I download this?

  • rebeca says:

    por favor necesito desactivar y quitar webssearches

  • Ragnar Maars says:

    I don need the program WebSearches

  • Daniel says:

    Los que distribuyen Websearches.com tendrian que ir a la carcel menudo trabajo que me ha costado el desinfectar ese insoportable navegador que no para de abrir ventanas simultaneamente haciendote la la navegacion imposible y encima viene con maxima publicidad basura! Gracias a Dios soy un experto en la materia y lo he podido desinfectar,aconsejo Spy hunter 4 y luego desactivar el navegador que ha sido infectado porque sino, no se acabaria de ir el malware del navegador y tendriamos que formatear el disco duro y eso seria una putada,instalamos otro navegador cualquiera y asi nos ahorramos la faena de perder todos los datos,quien tenga esta infeccion que se dirija a mi correo y muy amablemente le explicaré el proceso a la perfeccion para desinfectar es MALWARE totalmente ILEGAL.

  • Daniel says:

    Rebeca te puedo ayudar a desinfectarlo,dejame una via de contacto y te comento,besos!

  • mourad says:

    How can i delete this webssearches

  • Fernando Aguilar says:

    daniel ¿puedes echarme una mano para eliminar webssearches? tengo w 8.1 y chrome

  • claudia says:

    it's the worst nightmare ever this page please help me how to get rid of it

  • maria says:

    I am a woman very nervous. I don´t want this in my PC. Please remove it quickly. I don´t like this publicity all the moments.
    My computer is infected because this program. No more, please.Thanks

  • Anabela Roupeta says:

    Boa noite, preciso de tirar este programa horrível do meu computador. Por favor ajudem-me.

  • IQstorm says:

    If your on mozilla or chrome just search for site blocker, you just need to add it to your browser and then write the adress of the website(Webssearches.com) and it will block it 4 ever

  • vasco says:

    Não quero mais este programa, remove-lo imediatamente.

  • Jose Almeida says:

    Quero remover esta merda que apareceu no meu PC,

  • sandra says:

    necesito ayuda para quitar esto de mi ordenador, Daniel pones que te escribamos al correo pero no figura ayudaaa

Loading...