Home Malware Programs Browser Hijackers Searchswitch.com

Searchswitch.com

Posted: November 22, 2011

Searchswitch.com Screenshot 1Although SearchSwitch.com has no direct links to other types of fake search engine sites, SearchSwitch.com uses a scam that's as old as the day is long – by pretending to offer online search functionality and then performing a bait and switch that displays advertisements and other types of useless sites. SpywareRemove.com malware researchers encourage you to avoid any contact with SearchSwitch.com, since SearchSwitch.com may expose your browser to drive-by-download attacks, phishing attacks or sites that sell fake security software. Typical for its type of scam, SearchSwitch.com has also been connected to the proliferation of Trojans that engage in web browser redirect attacks. If your browser redirects to SearchSwitch.com or shows other signs of being hijacked, you should consider your PC to be infected and launch a counteroffensive with reliable anti-malware software.

A Few Reasons Why You Want to Switch SearchSwitch.com Off

Like other fake search sites (such as Qsearch.com, Greatsearchsystem.com, Licosearch.com or Searchwesearch.com), SearchSwitch.com claims to provide real search results but really provides self-serving links to affiliate sites. Results from SearchSwitch.com pay revenue to SearchSwitch.com's web masters in return for their traffic, and you should never consider SearchSwitch.com's links to be safe or even relevant to your search terms.

SpywareRemove.com malware researchers caution that a primary threat from SearchSwitch.com is the possibility of exposure to drive-by-download Java or Flash exploits. These attacks can install rogue security programs, Trojans, browser hijackers and other forms of PC threats without your consent and may not leave visible signs of their activities.

Through SearchSwitch.com, you may also be exposed to phishing attacks that try to steal private information (usually by posing as another website or by pretending to offer rewards in return for a sign-up process). Phishing sites can often be detected due to their URLs not matching the websites that they're posing as, and will frequently operate in the form of a survey, contest or prize give-away.

SearchSwitch.com's Poisonous Web Browser Synergy and How to Cure It

SearchSwitch.com might pretend to offer a search engine as well as news tidbits, but its reason for infamy is its propagation of browser hijackers. Browser hijacks will show themselves primarily by redirecting you to SearchSwitch.com and equally-harmful sites, although other types of side effects, such as pop-ups and issues with your browser's settings, may also appear. You should never try to remove a browser hijacker that redirects to SearchSwitch.com by deleting your browser or changing to a new browser, since baseline Windows components will remain infected.

Because browser redirects to SearchSwitch.com can occur in Chrome, Firefox, Internet Explorer and other types of major browsers, SpywareRemove.com malware researchers recommend that you fix SearchSwitch.com redirect attacks by using an anti-malware application prior to opening a browser. Safe Mode may also be required to insure that you can run the anti-malware program of your choice without interference by any SearchSwitch.com-related infection.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:Documents and SettingsAll UsersApplication DataSearchswitchsearchswitch111.exe File name: C:Documents and SettingsAll UsersApplication DataSearchswitchsearchswitch111.exe
File type: Executable File
Mime Type: unknown/exe
C:Program FilesSearchswitchuninstall.exe File name: C:Program FilesSearchswitchuninstall.exe
File type: Executable File
Mime Type: unknown/exe
C:WINDOWSTempRES4121.tmpupgrade.exe File name: C:WINDOWSTempRES4121.tmpupgrade.exe
File type: Executable File
Mime Type: unknown/exe
C:Program FilesSearchswitchsearchswitch.exe File name: C:Program FilesSearchswitchsearchswitch.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SEARCHSWITCH_SERVICEHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallsearchswitchHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSearchswitch ServiceHKEY_LOCAL_MACHINESOFTWARESearchswitch
Loading...