What is Search Selector?
The Malwarebytes research team has determined that Search Selector is a search hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.
How do I know if my computer is affected by Search Selector?
You may see this entry in your list of installed Chrome extensions:
and these warnings during install:
You will see this icon in your Chrome menu-bar:
and this changed setting:
How did Search Selector get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was downloaded from the webstore:
How do I remove Search Selector?
Our program Malwarebytes can detect and remove this potentially unwanted program.
- Please download Malwarebytes for Windows to your desktop.
- Double-click MBSetup.exe and follow the prompts to install the program.
- When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get started button.
- Click Scan to start a Threat Scan.
- When the scan is finished click Quarantine to remove the found threats.
- Reboot the system if prompted to complete the removal process.
- No, Malwarebytes removes Search Selector completely.
We hope our application and this guide have helped you eradicate this hijacker.
Technical details for experts
Possible signs in FRST logs:
CHR DefaultSearchURL: Default -> hxxp://selected-search.com/search?q={searchTerms}& CHR DefaultSearchKeyword: Default -> ss CHR Extension: (Search Selector) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip [2019-11-13]Alterations made by the installer:
File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0 Adds the file About.pdf"="9/11/2019 12:31 PM, 62988 bytes, A Adds the file manifest.json"="11/13/2019 9:00 AM, 1938 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\_metadata Adds the file computed_hashes.json"="11/13/2019 9:01 AM, 12000 bytes, A Adds the file verified_contents.json"="9/11/2019 12:28 PM, 4525 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\css Adds the file popup.css"="9/11/2019 10:34 AM, 124 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\html Adds the file popup.html"="9/11/2019 10:34 AM, 1007 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\engines Adds the file bing.png"="9/11/2019 10:34 AM, 16569 bytes, A Adds the file google.png"="9/11/2019 10:34 AM, 21125 bytes, A Adds the file yahoo.png"="9/11/2019 10:34 AM, 49488 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons Adds the file 128.png"="11/13/2019 9:00 AM, 4052 bytes, A Adds the file 16.png"="11/13/2019 9:00 AM, 468 bytes, A Adds the file 256.png"="11/13/2019 9:00 AM, 9206 bytes, A Adds the file 32.png"="11/13/2019 9:00 AM, 991 bytes, A Adds the file 48.png"="11/13/2019 9:00 AM, 1816 bytes, A Adds the file 64.png"="11/13/2019 9:00 AM, 2141 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs Adds the file jquery.autocomplete.js"="9/11/2019 10:34 AM, 33061 bytes, A Adds the file jquery.js"="9/11/2019 10:34 AM, 247597 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\css Adds the file bootstrap.css"="9/11/2019 10:34 AM, 146082 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts Adds the file glyphicons-halflings-regular.eot"="9/11/2019 10:34 AM, 20127 bytes, A Adds the file glyphicons-halflings-regular.svg"="9/11/2019 10:34 AM, 108738 bytes, A Adds the file glyphicons-halflings-regular.ttf"="9/11/2019 10:34 AM, 45404 bytes, A Adds the file glyphicons-halflings-regular.woff"="9/11/2019 10:34 AM, 23424 bytes, A Adds the file glyphicons-halflings-regular.woff2"="9/11/2019 10:34 AM, 18028 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\js Adds the file bootstrap.js"="9/11/2019 10:34 AM, 68954 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts Adds the file background.js"="9/11/2019 12:33 PM, 1320 bytes, A Adds the file consts.js"="9/11/2019 10:34 AM, 871 bytes, A Adds the file popup.js"="9/11/2019 10:34 AM, 341 bytes, A Adds the file utils.js"="9/11/2019 10:34 AM, 3018 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings] "egenicdiafgbhogabodhpfcbcgnpocip"="REG_SZ", "C28C0190CA7F6DA54CAC043EB51AE06F71D667D55D5CB4A3962FD7EEC36A64BC"Malwarebytes log:
Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 11/13/19 Scan Time: 9:13 AM Log File: 6f9c8af8-05ed-11ea-b5b8-00ffdcc6fdfc.json -Software Information- Version: 4.0.4.49 Components Version: 1.0.718 Update Package Version: 1.0.14864 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 233922 Threats Detected: 46 Threats Quarantined: 46 Time Elapsed: 5 min, 32 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 1 PUP.Optional.SelectedSearch, HKCU\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|egenicdiafgbhogabodhpfcbcgnpocip, Quarantined, 281, 757187, , , , Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 14 PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\css, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\engines, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\_metadata, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\html, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\css, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EGENICDIAFGBHOGABODHPFCBCGNPOCIP, Quarantined, 281, 757187, 1.0.14864, , ame, File: 31 PUP.Optional.SelectedSearch, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EGENICDIAFGBHOGABODHPFCBCGNPOCIP\2.0_0\MANIFEST.JSON, Quarantined, 281, 757187, 1.0.14864, , ame, PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\css\popup.css, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\html\popup.html, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\engines\bing.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\engines\google.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\engines\yahoo.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\128.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\16.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\256.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\32.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\48.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\images\icons\64.png, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\css\bootstrap.css, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts\glyphicons-halflings-regular.eot, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts\glyphicons-halflings-regular.svg, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts\glyphicons-halflings-regular.ttf, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts\glyphicons-halflings-regular.woff, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\fonts\glyphicons-halflings-regular.woff2, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\bootstrap\js\bootstrap.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\jquery.autocomplete.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\libs\jquery.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts\background.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts\consts.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts\popup.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\scripts\utils.js, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\_metadata\computed_hashes.json, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\_metadata\verified_contents.json, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\egenicdiafgbhogabodhpfcbcgnpocip\2.0_0\About.pdf, Quarantined, 281, 757187, , , , PUP.Optional.SelectedSearch, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 281, 757186, 1.0.14864, , ame, Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end)The full version of Malwarebytes can protect your computer against this type of threats.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention