Home Malware Programs Browser Hijackers U-Search.net

U-Search.net

Posted: September 18, 2012

U-Search.net is a search engine site that claims to give you access to search results 'without limits', even though its actual capabilities have resulted in its being blacklisted for association with spammers. There are close ties between U-Search.net and browser-hijacking PC threats that redirect your searches to U-Search.net even when you're trying to use unrelated websites. Persistent redirects to U-Search.net or settings changes that force you to visit U-Search.net should be considered symptomatic of the existence of any quantity of malicious software, sometimes including rootkits and extremely invasive Trojans. Even though browsing U-Search.net is just a small risk to your computer, the malware that are associated with U-Search.net may pose a greater danger than U-Search.net, itself, and should be removed with specialized anti-malware software whenever appropriate.

Why You Might Want to Hesitate Before You Search with U-Search.net

U-Search.net hasn't been noted for extensive association with browser-based attack content or malware distribution, even though its search functions are, at best, questionable. Like so many other minor search engine websites, U-Search.net appears to be specialized in providing links that return revenue to its web masters in return for any traffic rather than links that are sorted according to meaningful content or safety. Accordingly, malware analysts are forced to note that some, if not all PC security companies have included an entry for U-Search.net in their spammer domain databases.

While, as far as its web masters are concerned, the above strategy is a relatively safe (if inefficient) way of garnering revenue, recent issues involving U-Search.net have also taken the risk of involving browser hijackers for promoting U-Search.net. These PC threats are often installed by related Trojans or rootkits, and manifests in signs such as:

  • Experiencing your default search engine, new tab page or homepage being set to U-Search.net.
  • When you try to use other sites, such as other search engines, you're being redirected to U-Search.net.
  • An overall slowdown in your browser's performance.
  • Failure to correct any of the above issues via changes to your browser settings that should be remedying them (such as changing your homepage to something other than U-Search.net, only to have your change reversed or simply ignored in the browser's performance).

Getting Your Searches Back on Track and Off of the U-Search.net Railroad

Some browser hijackers may also include spyware-based functions that can monitor or steal confidential information, and for this reason, SpywareRemove.com malware research team recommends that you react quickly to any overt evidence of U-Search.net redirects and similar browser attacks. Because PC threats associated with redirects to U-Search.net may function in all browsers and modify components of Windows, anti-malware software should be used to delete all traits of a U-Search.net-associated infection safely.

U-Search.net redirects and related attacks can be a result of exposure to malicious sites that engage in drive-by-downloads or promote malware fraudulently. Common scams that SpywareRemove.com malware experts have noted include fake updates for movie players, codec packages and download links for popular movies.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AllUsersProfile%\{RANDOM CHARACTERS}\ File name: %AllUsersProfile%\{RANDOM CHARACTERS}\
%AllUsersProfile%\{RANDOM CHARACTERS}.lnk File name: %AllUsersProfile%\{RANDOM CHARACTERS}.lnk
File type: Shortcut
Mime Type: unknown/lnk

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current\Winlogon\"Shell" = "{RANDOM CHARACTERS}.exe"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\{RANDOM CHARACTERS}HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
Loading...