Removal instructions for browser-hijacking software promoting searchtabs.io
Written by Tomas Meskauskas on (updated)
What kind of website is searchtabs.io?
Searchtabs.io is the address of a fake search engine. During a routine inspection of suspicious sites, our researchers found a deceptive page using a pornographic lure to push an installation setup. This installer contained a browser hijacker promoting the searchtabs.io website.
While software within this classification usually endorses sites by making changes to browser settings, this setup made no alterations to the browser on our testing system. It is noteworthy that this hijacker utilizes a persistence-ensuring mechanism to prevent users from recovering their browsers.
Searchtabs.io promoting browser hijacker overview
After installing the setup promoting searchtabs.io on our test machine, we learned that it affects new browser tabs/windows. Whenever they are opened, a redirect is generated to searchtabs.io with a randomized search query that is different each time.
Fake search engines are classed as such since they typically cannot provide search results and redirect to legitimate Internet search websites (e.g., Bing, Google, Yahoo, etc.). Browser-hijacking software tends to cause redirects to illegitimate search engines when a new browser tab/window is opened or a search query is entered into the URL bar. However, as previously mentioned, the behavior of the searchtabs.io promoting browser hijacker is entirely different.
Furthermore, this piece of software uses a persistence-ensuring technique to complicate its removal. These redirects are generated through a process named "UITheme.exe".
However, merely terminating it does not eliminate the redirects. This browser hijacker uses a tool from the Microsoft Deployment ToolKit called "ServiceUI". The tool ensures that "UITheme.exe" is restarted after it is ended using the Windows Task Manager and following system reboots.
Due to this, there is a certain sequence to removing this hijacker; the steps can be found below.
| Name | searchtabs.io redirect |
| Threat Type | Browser Hijacker, Redirect, Search Hijacker, Toolbar, Unwanted New Tab |
| Detection Names (malicious installer) | Avast (FileRepMalware [Adw]), DrWeb (Trojan.Adject.1), McAfee (Artemis!1C5FE79233C4), Webroot (W32.Adware.Gen), Full List Of Detections (VirusTotal) |
| Detection Names (UITheme.exe) | Bkav Pro (W64.AIDetectMalware), CrowdStrike Falcon (Win/malicious_confidence_70% (D)), Full List Of Detections (VirusTotal) |
| Promoted URL | searchtabs.io |
| Affected Browser Settings | Homepage, new tab URL, default search engine |
| Symptoms | Users are forced to visit the hijacker's website and search the Internet using their search engines. |
| Distribution methods | Deceptive pop-up ads, free software installers (bundling). |
| Damage | Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Browser hijackers in general
We have investigated countless browser hijackers; searches-world.com is an example of a setup similar to the one promoting searchtabs.io, while New key, Cute Goats Tab, Horoscope Harmony, Extreme Sports Wallpapers – are just some of our newest finds.
Typically, browser-hijacking software appears legitimate and harmless. It offers a wide variety of features, ranging from sophisticated tools to amusing widgets. However, these functionalities seldom work as promised, and in most cases – they do not work at all.
It must be stressed that even if a piece of software operates as advertised – that is not a guarantee of either legitimacy or safety.
It must be mentioned that aside from causing redirects, browser hijackers often have the ability to spy on users' browsing activity.
Information of interest may include: browsing and search engine histories, Internet cookies, log-in credentials, personally identifiable details, finance-related data, etc. The collected information can then be monetized via sale to third-parties. Therefore, software within this classification is also considered to be a privacy threat.
How did searchtabs.io promoting browser hijacker install on my computer?
We downloaded an installer of the hijacker promoting searchtabs.io from a webpage using an adult-oriented lure. Browser-hijacking software is commonly pushed through various scam pages and legitimate-looking promotional sites. Users primarily access such webpages via redirects generated by websites utilizing rogue advertising networks, mistyped URLs, spam browser notifications, intrusive ads, or installed adware.
"Bundling" – packing regular program installation setups with unwanted/malicious additions – is also used to proliferate browser hijackers.
Download from untrustworthy sources (e.g., freeware and free file-hosting sites, Peer-to-Peer sharing networks, etc.) and rushed installations (e.g., ignored terms, used "Easy/Quick" settings, etc.) – increase the risk of unintentionally allowing bundled content into the device.
Browser hijackers are spread by intrusive advertisements as well. When clicked on, some of the adverts can execute scripts to perform downloads/installations without user permission.
How to avoid installation of browser hijackers?
It is essential to research software and download it only from official/verified channels. When installing, we recommend reading terms, inspecting available options, using the "Custom" or "Advanced" settings, and opting out of all supplements (e.g., apps, extensions, tools, etc.).
We also advise being careful while browsing since fake and dangerous online content usually appears legitimate and harmless. For example, while intrusive ads may look ordinary/innocuous – they redirect to unreliable and questionable websites (e.g., gambling, scam-promoting, pornography, adult dating, etc.).
If you keep encountering advertisements and/or redirects of this kind, check the device and immediately remove all suspicious applications and browser extensions/plug-ins. If your computer is already infected with searchtabs.io, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate this browser hijacker.
Appearance of searchtabs.io redirects (GIF):
Screenshots of deceptive websites promoting an installer containing this browser hijacker:
Removal steps for this browser hijacker:
Open Windows Task Manager, locate the "ServiceUI.exe" process and terminate it by clicking "End task".
Afterward, locate "UITheme.exe" on Windows Task Manager and end this process by clicking "End task".
Open the "System32" Windows folder (C:\Windows\System32), locate "UITheme.exe" and delete it.
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
Summary:
A browser hijacker is a type of adware infection that modifies Internet browser settings by assigning the homepage and default Internet search engine settings to some other (unwanted) website URL. Commonly, this type of adware infiltrates operating systems through free software downloads. If your download is managed by a download client, ensure that you decline offers to install advertised toolbars or applications that seek to change your homepage and default Internet search engine settings.
Post a comment:
If you have additional information on searchtabs.io browser hijacker or it's removal please share your knowledge in the comments section below.
Frequently Asked Questions (FAQ)
What is the purpose of forcing users to visit searchtabs.io website?
Redirects to websites like searchtabs.io are generated because cyber criminals (i.e., developers of browser hijackers and fake search engines) profit through them.
Is visiting searchtabs.io a threat to my privacy?
To a certain extent, yes. Sites like searchtabs.io tend to collect information about their visitors. This data can then be shared with and/or sold to third-parties.
How did a browser hijacker infiltrate my computer?
The most widely used distribution methods include: deceptive promotional webpages, online scams, bundled installers, freeware and free file-hosting websites, Peer-to-Peer sharing networks, spam browser notifications, and intrusive adverts.
Will Combo Cleaner help me remove browser hijackers?
Combo Cleaner will scan your computer and eliminate detected browser-hijacking apps. Keep in mind that manual removal (performed without security tools) might be ineffective. In cases where multiple browser hijackers are present, after one is removed – the others may simply reinstall it. What is more, removal-related settings might be inaccessible with browser-hijacking software installed. Hence, it is essential to eliminate browser hijackers thoroughly and all at once.
Outstanding!
▼ Show Discussion