Yoga Search Removal Guide

Threat Level:
6/10
Rate this Article:
Comments (0)
Article Views: 668
Category: Browser Hijackers

Yoga Search is a recently released browser extension for Google Chrome that you can get onto your browser unintentionally because its creators distribute it in a way that gets it onto your browser secretly, so you ought to remove it if it happens to get onto your browser. This extension’s name already says that it has something to do with searching and indeed it does. Testing has shown that this extension was designed to replace your browser’s search engine. Evidently, this browser extension was set to redirect web traffic to its propagated search engine. However, that search engine is a modified Yahoo search engine. For more information, please read this whole article.

If this application were to get onto your PC, it would create a second shortcut for Google Chrome. However, the twist here is that this shortcut contains "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa" command in the target line that launches Yoga Search if you click that shortcut, if you click the unmodified shortcut, this extension will not work and also will not change the search engine. However, if you open Chrome using the modified shortcut, the extension will change the search engine to https://search.yahoo.com/search?p={searchTerms}&xpubz=8z108mno&r=yy62f009mvb12&trk=b1v300 which is a modified Yahoo search engine that will present you with search results. However, it does not seem to have promotional links or ads on it, so we are unsure how the creators of this application make money off it.

Testing has shown that Yoga Search is a non-standard browser extension as it can drop more additional files and registry keys than regular Chrome extensions. Testing has shown that, if you install this application, then it will place its file in the following locations:

  • %LOCALAPPDATA%\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa
  • %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa
  • %Temp%\WS
  • %PROGRAMFILES(x86)%\EZSearch (older version only)
  • %PROGRAMFILES%\EZSearch (older version only)

Furthermore, this extension adds several registry keys to make this application work properly. The list of extensions includes the following:

  • HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch
  • HKLM\SYSTEM\ControlSet001\Services\WindowService
  • HKLM\SYSTEM\ControlSet002\Services\WindowService
    HKLM\SYSTEM\CurrentControlSet\Services\WindowService

Now let us discuss how this extension is disseminated. According to our research, it is likely that Yoga Search is distributed using bundled software installers because you cannot get it from the Chrome Web Store. We believe that its creators might have arranged this extension to be distributed through bundled software installers featured on various freeware websites. The bundled software installers can install this extension onto your browser by default and not warn you about it. However, you should be able to go to advanced or custom installation settings and deselect the installation of this extension and be done with it. You may encounter software bundles featuring Yoga Search on websites that distribute freeware, so you should avoid such websites not to get unreliable software on your PC. This browser extension comes from an unknown source, so you should not trust it.

We hope you found this article insightful and it has helped shed some light on Yoga Search. Testing has shown that the only purpose of this program is to replace your browser’s search engine in an effort generate web traffic to that customized search engine. However, it is unclear how the developers intend to monetize this application. Since this application is next to useless, we recommend that you remove it from your PC at your earliest convenience. We have created a guide to help you delete its files and registry keys manually.

Removal Guide

  1. Hold down Windows+E keys.
  2. Typethe following file paths In File Explorer’s address box.
    • %LOCALAPPDATA%\Google\Chrome\User Data\Extensions
    • %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Extensions
  3. Press Enter.
  4. Locate ikmapcaeknfgfmjlibnhcbchfablckbpa, right-click it and click Delete.
  5. Then, type %Temp% locate a folder named WS.
  6. Right-click it and click Delete it.
  7. Provided you have an older version of this application, go to %PROGRAMFILES(x86)% or %PROGRAMFILES%
  8. Locate and delete the EZSearch folder.
  9. Close the File Explorer.
  10. Right-click the Recycle Bin and click Empty the Recycle Bin.

Delete the registry keys

  1. Hold down Windows+R keys.
  2. Type regedit in the dialog box and press Enter.
  3. Navigate to the following keys and deleteEZSearch
    • HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  4. Lastly, navigate to the following keys and deleteWindowService
    • HKLM\SYSTEM\ControlSet001\Services
    • HKLM\SYSTEM\ControlSet002\Services
    • HKLM\SYSTEM\CurrentControlSet\Services
Download Remover for Yoga Search *
*SpyHunter scanner, published on this site, is intended to be used only as a detection tool. To use the removal functionality, you will need to purchase the full version of SpyHunter.

Yoga Search technical info for manual removal:

Files Modified/Created on the system:

# File Name File Size (Bytes) File Hash
1mediatek_86.exe51200 bytesMD5: ac91ab58cb640ab02b534bce9134716c
2ezsearch.dll57344 bytesMD5: 88bb84f3e7752e0422befb9f46af1fe3
3WindowService.exe8192 bytesMD5: 4f5f364cadeaf725e52d45156feebd93
4ezs.dll106496 bytesMD5: 7a9761576f19ceb77885201d39a1d644
5realtek_amd64.exe8192 bytesMD5: c40ed2585800b85b47c8eb021cb861df

Registry Modifications:

The following Registry Keys were created:

  • EZ
  • ezsearch.dll
  • SOFTWARE\Microsoft\Internet Explorer\Toolbar {09860DED-A434-49EA-AD61-427EF7B7F214}
  • Software\Microsoft\Internet Explorer\Toolbar {cce83e45-30b2-4bae-b1f5-25d128d27a43}
  • ezsearchbar
  • Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {09860DED-A434-49EA-AD61-427EF7B7F214}
  • ezs.dll
  • Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {CCE83E45-30B2-4BAE-B1F5-25D128D27A43}

Comments are closed.