EZSearch

EZSearch is a potentially unwanted program aimed at deceiving the users of the Google Chrome browser. The PUP can get installed on the PC because of your hasty interaction with questionable software bundles, as EZSearch is mainly distributed alongside freeware. The EZSearch program creates a fake shortcut of the Google Chrome browser so that the user is redirected to the Yahoo! search once the fake shortcut is executed. Because of the changes made within the system, EZSearch is categorized as a potentially unwanted program (PUP) and can be removed from the PC by certain antimalware programs.

Upon installation, the EZSearch program creates a fake Google Chrome shortcut and adds its entry in the Extensions section of the browser. The extension on the browser is loaded from the %AppData% directory, which is a hidden folder with your operating system. Moreover, the potentially unwanted program replaces the URL in the Target line of the shortcut with a URL directing the user to search.yahoo.com. As a result, when the victim double clicks on the shortcut, she is provided with a startup page different from the one set on the original shortcut of the browser. The more the search promoted by EZSearch is used, the bigger revenue is generated to the remote attackers behind this potentially unwanted program. Additionally, if you notice that the search.yahoo.com provided by the fake shortcut is also displaying some visual advertisements, do not click on them. It is likely they are associated with the installation of EZSearch and have nothing to do with Yahoo!.

It is also worth checking the Extensions section on the original browser to make sure that no unwanted browser extension is running without your permission. In any case, the PUP should be removed from the computer so that you do not get deceived into accidentally clicking on a malicious link. You cannot be sure that a seemingly harmless advertisement will not lead you to a fraudulent websites, where you may be deceived into downloading more dangerous software.

The EZSearch extension is installed without the user’s interference alongside free software downloaded from file distribution websites or file sharing networks. The extension can be bundled with a variety of free applications, including video and music players, browser toolbars, photo editors, and many other programs. If you have not noticed any malfunction or difference in the performance of the system, remove EZSearch from the computer and scan the system to be sure that no malicious programs are running in the background surreptitiously.

It is strongly advisable to pay close attention to every installation of freeware as the dialox box may display some questions regarding the changes on the browsers or other parts of the system. Do not hurry to agree with the terms of use without checking their content. You should also bear in mind that some optional programs may be installed if you do not check or uncheck specific check boxes. Free malware distributors attempt to spread their products as much as they can, and if you do not use any antimalware program, manual monitoring of the system may have little effect.

We encourage you to remove EZSearch from the computer and take measures to prevent similar incidents in the future. EZSearch is categorized as a PUP, but there are many more harmful programs that records personal information, disables certain process or even delete your files. The sooner a professional antimalware program is implemented, the sooner you can become sure that you will not have to remove the infections manually or worry about their removal.

Below you will found our instructions that will guide you through the manual removal of EZSearch. If you find that these instructions are too complex, rely on a reputable antimalware program that will remove EZSearch for you.

How to remove EZSearch

Windows Vista/7/8/10

1. Delete the fake desktop shortcut created by EzSearch.
2. \Click on the Start button or the search box in the Taskbar (Windows 10) and type in %LOCALAPPDATA%. Press Enter.
3. Follow the path %LOCALAPPDATA%\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbp and delete ikmapcaeknfgfmjlibnhcbchfablckbp.
4. Repeat the same to delete WS from the %Temp%\WS directory.
5. Check the %PROGRAMFILES% directory for the folder EZSearch.
6. Click the Start button and type in regedit. Press Enter.
7. Select the HKEY_LOCAL_MACHINE and delete these registry keys:

• HKLM\SYSTEM\ControlSet001\Services\WindowService
• HKLM\SYSTEM\ControlSet002\Services\WindowService
• HKLM\SYSTEM\CurrentControlSet\Services\WindowService

8. In a 64-bit operating system, delete the following keys:

• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch

Windows XP

1. Delete the fake desktop shortcut created by EzSearch.
2. Click on the Start box.
3. Click on Run and type in %USERPROFILE% and press Enter.
4. Follow the path %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbp and delete ikmapcaeknfgfmjlibnhcbchfablckbp.
5. Repeat the same for %Temp%\WS.
6. Follow steps 6–8 given above to delete malicious registry keys.