Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Thursday, February 6, 2014 Removal Guide

Tell your friends: is a browser hijacker that will install malicious web browser extensions, change your homepage and default search engine. It's distributed via fake software download and update websites and through the use of PUPs (detected as PUP.Optional.InstalleRex and ADWARE/InstallRex.Gen). No matter how closely you look at PUPs, it is a fact of life that you will probably never know just what the creators and publishers of the program intended it to do. In this case, they simply want to infect computers and hijacker their web browsers so that they could later display ads and redirect search results. To remove this browser hijacker and related malware from your computer, please follow the steps in the removal guide below.

As you may already know, and similar browser hijackers come bundled with free downloads. For example, let's say that you want to download a piece of software but you know it's being distributed via an unscrupulous downloading website - but you also know that lots of people use the same software on a daily basis for their own benefit. How then do you determine whether or not it is advisable to download that particular piece of software?

Remember the days when you knew nothing about computers and the people you turned to to tell you what was what – be they teachers, colleagues, a techy friend, or the IT guy at work – would advise you to download a program and then just click "OK, OK, OK" or "Next, Next, Next" until the installation was complete? Oh, the good old days of just installing and clicking – and not reading that tedious End User License Agreement! Those days are gone guys. Well, sad to say but those guys that create software for financial gain – in an unscrupulous, get rich quick kind of way – noticed our lack of paying attention too, and now they are capitalizing on it.

Alright, you've got me there and I'm not going to disagree with you, but trust us you'll thank me for telling you – always, ALWAYS read the End User License Agreement. It's not just Potentially Unwanted Programs you could be installing on your PC but any sort of nasty malware or virus that plans to do you far more harm than an annoying new tool bar or browser redirect. Of course, sometimes scammers use silent installers to distribute browser hijackers and adware. When I was testing this browser hijacker I notices some strange background activity at the same time which wasn't supposed to happen at all. As a results, Chrome had a bunch of unwanted and malicious browser extensions, for instance, Window Expander for Youtube, wuebsave, YoutubeAdBlocker, etc. Some of these were installed enterprise policy which means you can just simply remove them. These extensions are used to display ads, redirect users to misleading websites and hijacker browser settings. So, if you want to get rid of you need to remove all of them.

The thing is, creators of PUPs and browser hijackers know that they're, well, they're not really wanted, so they need to think of cunning ways of sneaking their programs onto your computer and then hoping that you fall in love with them instantly so you're not tempted to immediately uninstall them.

Needles to say, browser hijackers are bundled in with a piece of software that you do want and you're downloading from the Internet. This software doesn't even have to be anything 'dodgy' – although having said that, free music, wallpapers and emoticons are like Kryptonite to hackers, scammers and the publishers of PUPs!

The whole point about the End User License Agreement is that you need to read it. It's true that some PUPs fly under the radar and don't announce their presence at all but many actually do announce it in the EULA – albeit rather subtly! Therefore, when you download something you should always check the Agreement carefully and not just do the classic "OK, OK, OK" move as you could be installing any untold number of nasties on your PC. If you have any questions, please leave a comment below. Good luck and be safe online!

Written by Michael Kaur, removal instructions:

1. First of all, download recommended anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this infection. Hopefully you won't have to do that.

2. Remove related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.

If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".

Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.

3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove the following programs:
  • Search Assistant WebSearch
  • ggrreatsaver
  • SNT
  • WS-Enabler
  • WS-Supporter 1.80
  • YoutubeAdBlocker

If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.

Remove from Google Chrome:

1. Click on Chrome menu button. Go to ToolsExtensions.

2. Click on the trashcan icon to remove the BookmarkTube, Window Expander for Youtube, wuebsave, YoutubeAdBlocker extensions.

3. Then select Settings. Scroll down the page and click Show advanced settings.

4. Find the Reset browser settings section and click Reset browser settings button.

5. In the dialog that appears, click Reset. That's it!

Remove from Mozilla Firefox:

1. Open Mozilla Firefox. Go to ToolsAdd-ons.

2. Select Extensions. Remove greiaotsaver 2.7 and SearchNewTab, Window Expander for Youtube, wuebsave, YoutubeAdBlocker browser extensions. Close Add-ons manger.

3. In the URL address bar, type about:config and hit Enter.

Click I'll be careful, I promise! to continue.

In the search filter at the top, type: webisgreat

Now, you should see all the preferences that were changed by Right-click on the preference and select Reset to restore default value. Reset all found preferences!

Remove from Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons.

2. Select Search Providers. First of all, choose Live Search search engine and make it your default web search provider (Set as default).

3. Select WebSearch and click Remove to remove it. Close the window.