Removal instructions for browser-hijacking software promoting searchtabs.io

Also Known As: searchtabs.io browser hijacker
Damage level: Medium

What kind of website is searchtabs.io?

Searchtabs.io is the address of a fake search engine. During a routine inspection of suspicious sites, our researchers found a deceptive page using a pornographic lure to push an installation setup. This installer contained a browser hijacker promoting the searchtabs.io website.

While software within this classification usually endorses sites by making changes to browser settings, this setup made no alterations to the browser on our testing system. It is noteworthy that this hijacker utilizes a persistence-ensuring mechanism to prevent users from recovering their browsers.

searchtabs.io browser hijacker

Searchtabs.io promoting browser hijacker overview

After installing the setup promoting searchtabs.io on our test machine, we learned that it affects new browser tabs/windows. Whenever they are opened, a redirect is generated to searchtabs.io with a randomized search query that is different each time.

Fake search engines are classed as such since they typically cannot provide search results and redirect to legitimate Internet search websites (e.g., Bing, Google, Yahoo, etc.). Browser-hijacking software tends to cause redirects to illegitimate search engines when a new browser tab/window is opened or a search query is entered into the URL bar. However, as previously mentioned, the behavior of the searchtabs.io promoting browser hijacker is entirely different.

Furthermore, this piece of software uses a persistence-ensuring technique to complicate its removal. These redirects are generated through a process named "UITheme.exe".

However, merely terminating it does not eliminate the redirects. This browser hijacker uses a tool from the Microsoft Deployment ToolKit called "ServiceUI". The tool ensures that "UITheme.exe" is restarted after it is ended using the Windows Task Manager and following system reboots.

Due to this, there is a certain sequence to removing this hijacker; the steps can be found below.

Threat Summary:
Name searchtabs.io redirect
Threat Type Browser Hijacker, Redirect, Search Hijacker, Toolbar, Unwanted New Tab
Detection Names (malicious installer) Avast (FileRepMalware [Adw]), DrWeb (Trojan.Adject.1), McAfee (Artemis!1C5FE79233C4), Webroot (W32.Adware.Gen), Full List Of Detections (VirusTotal)
Detection Names (UITheme.exe) Bkav Pro (W64.AIDetectMalware), CrowdStrike Falcon (Win/malicious_confidence_70% (D)), Full List Of Detections (VirusTotal)
Promoted URL searchtabs.io
Affected Browser Settings Homepage, new tab URL, default search engine
Symptoms Users are forced to visit the hijacker's website and search the Internet using their search engines.
Distribution methods Deceptive pop-up ads, free software installers (bundling).
Damage Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites.
Malware Removal (Windows)

To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.
▼ Download Combo Cleaner
To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Browser hijackers in general

We have investigated countless browser hijackers; searches-world.com is an example of a setup similar to the one promoting searchtabs.io, while New keyCute Goats TabHoroscope HarmonyExtreme Sports Wallpapers – are just some of our newest finds.

Typically, browser-hijacking software appears legitimate and harmless. It offers a wide variety of features, ranging from sophisticated tools to amusing widgets. However, these functionalities seldom work as promised, and in most cases – they do not work at all.

It must be stressed that even if a piece of software operates as advertised – that is not a guarantee of either legitimacy or safety.

It must be mentioned that aside from causing redirects, browser hijackers often have the ability to spy on users' browsing activity.

Information of interest may include: browsing and search engine histories, Internet cookies, log-in credentials, personally identifiable details, finance-related data, etc. The collected information can then be monetized via sale to third-parties. Therefore, software within this classification is also considered to be a privacy threat.

How did searchtabs.io promoting browser hijacker install on my computer?

We downloaded an installer of the hijacker promoting searchtabs.io from a webpage using an adult-oriented lure. Browser-hijacking software is commonly pushed through various scam pages and legitimate-looking promotional sites. Users primarily access such webpages via redirects generated by websites utilizing rogue advertising networks, mistyped URLs, spam browser notifications, intrusive ads, or installed adware.

"Bundling" – packing regular program installation setups with unwanted/malicious additions – is also used to proliferate browser hijackers.

Download from untrustworthy sources (e.g., freeware and free file-hosting sites, Peer-to-Peer sharing networks, etc.) and rushed installations (e.g., ignored terms, used "Easy/Quick" settings, etc.) – increase the risk of unintentionally allowing bundled content into the device.

Browser hijackers are spread by intrusive advertisements as well. When clicked on, some of the adverts can execute scripts to perform downloads/installations without user permission.

How to avoid installation of browser hijackers?

It is essential to research software and download it only from official/verified channels. When installing, we recommend reading terms, inspecting available options, using the "Custom" or "Advanced" settings, and opting out of all supplements (e.g., apps, extensions, tools, etc.).

We also advise being careful while browsing since fake and dangerous online content usually appears legitimate and harmless. For example, while intrusive ads may look ordinary/innocuous – they redirect to unreliable and questionable websites (e.g., gambling, scam-promoting, pornography, adult dating, etc.).

If you keep encountering advertisements and/or redirects of this kind, check the device and immediately remove all suspicious applications and browser extensions/plug-ins. If your computer is already infected with searchtabs.io, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate this browser hijacker.

Appearance of searchtabs.io redirects (GIF):

searchtabs.io browser hijacker redirects (GIF)

Screenshots of deceptive websites promoting an installer containing this browser hijacker:

Deceptive website used to promote searchtabs.io browser hijacker 1 Deceptive website used to promote searchtabs.io browser hijacker 2

Removal steps for this browser hijacker:

searchtabs.io browser hijacker removal step 1

Open Windows Task Manager, locate the "ServiceUI.exe" process and terminate it by clicking "End task".

searchtabs.io browser hijacker removal step 2

Afterward, locate "UITheme.exe" on Windows Task Manager and end this process by clicking "End task".

searchtabs.io browser hijacker removal step 3

Open the "System32" Windows folder (C:\Windows\System32), locate "UITheme.exe" and delete it.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:


declining installation of browser hijackers while downloading free software sampleA browser hijacker is a type of adware infection that modifies Internet browser settings by assigning the homepage and default Internet search engine settings to some other (unwanted) website URL. Commonly, this type of adware infiltrates operating systems through free software downloads. If your download is managed by a download client, ensure that you decline offers to install advertised toolbars or applications that seek to change your homepage and default Internet search engine settings.

Post a comment:
If you have additional information on searchtabs.io browser hijacker or it's removal please share your knowledge in the comments section below.

Frequently Asked Questions (FAQ)

What is the purpose of forcing users to visit searchtabs.io website?

Redirects to websites like searchtabs.io are generated because cyber criminals (i.e., developers of browser hijackers and fake search engines) profit through them.

Is visiting searchtabs.io a threat to my privacy?

To a certain extent, yes. Sites like searchtabs.io tend to collect information about their visitors. This data can then be shared with and/or sold to third-parties.

How did a browser hijacker infiltrate my computer?

The most widely used distribution methods include: deceptive promotional webpages, online scams, bundled installers, freeware and free file-hosting websites, Peer-to-Peer sharing networks, spam browser notifications, and intrusive adverts.

Will Combo Cleaner help me remove browser hijackers?

Combo Cleaner will scan your computer and eliminate detected browser-hijacking apps. Keep in mind that manual removal (performed without security tools) might be ineffective. In cases where multiple browser hijackers are present, after one is removed – the others may simply reinstall it. What is more, removal-related settings might be inaccessible with browser-hijacking software installed. Hence, it is essential to eliminate browser hijackers thoroughly and all at once.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Removal Instructions in other languages
Software uninstall instructions
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
searchtabs.io browser hijacker QR code
Scan this QR code to have an easy access removal guide of searchtabs.io browser hijacker on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.