PUP.Optional.WinYahoo: what it is and how to remove WinYahoo
PUP.Optional.WinYahoo is the name Malwarebytes gives to WinYahoo, a bundled program that sets Yahoo as your home page and search engine and adds an ad extension. To remove it, uninstall the program that came with the download, remove the extension, reset each browser and scan.
Facts checked October 9, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A quick scan confirms nothing else was installed alongside the yahoo.com search hijacker.
Do it yourself · free Remove WinYahoo yourself 2 steps, about 6 minutes, no software needed.
WinYahoo: summary
| Type | Potentially unwanted program (PUP) detected by Malwarebytes as PUP.Optional.WinYahoo; sets Yahoo as home page and search engine and installs an ad extension |
|---|---|
| Risk | Medium: ad tabs, settings you did not set, a scam page seen once in 2015; no stolen data seen |
| Symptoms | Yahoo as home page and search engine in several browsers; new tabs with ads; the Sale Charger extension; a scanner message naming PUP.Optional.WinYahoo |
| How to get rid of it | Uninstall the bundled program, remove the extension, reset each browser, scan and restart |
| Our check (9 October 2026) | No site to test and no sample run; the behaviour comes from Malwarebytes' 2015 analysis and a February 2025 forum case |
| Running since | Described by Malwarebytes on 13 May 2015; our first report 23 August 2021; last public user case February 2025 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| Also known as | WinYahoo, PUP.Optional.WinYahoo.Generic, PUP.Optional.WinYahoo.TskLnk |
|---|---|
| Installed on the PC | A folder in Program Files, a file starting with sb, and the Sale Charger extension, per Malwarebytes (2015) |
| Detection | Malwarebytes: PUP.Optional.WinYahoo. Microsoft: no Microsoft detection name is known; we searched Microsoft's pages and found none |
| Damage | Changed browser settings and ad tabs; no harm to files seen |
| Distribution | Software bundles: a free program's setup offers Yahoo on one screen |
| Name | WinYahoo |
| Evidence | 4 reports from affected users and security sites; no sample analysed yet |
| Search page | yahoo.com |
| Program | WinYahoo |
| Browsers | Chrome, Edge and Firefox |
| First seen | 23 August 2021 |
| Facts checked | 9 October 2026 |
Facts checked on 9 October 2026 against Malwarebytes' 2015 article and detection page, Microsoft Q&A threads from 2016 and 2020, a February 2025 Malwarebytes forum case and Microsoft Learn's PUA protection page. We did not run the installer and there is no website to test.
What PUP.Optional.WinYahoo is
PUP.Optional.WinYahoo is the name Malwarebytes gives to a potentially unwanted program called WinYahoo. It is not a virus and not a website. It is a bundled installer that sets Yahoo as the home page and search engine and adds a browser extension, and the name on your screen is a scan result, not the name of an attack.
- What it is
- A potentially unwanted program (PUP) that Malwarebytes detects as PUP.Optional.WinYahoo, with the associated detection PUP.Optional.WinYahoo.Generic
- Where the name comes from
- Named, per Malwarebytes (2015), for its files in the Program Files folder and for Yahoo as default search and home page; not related to the company Yahoo
- What it changes
- The home, start and search pages of Chrome, Firefox, Internet Explorer and Safari, according to Malwarebytes' detection page
- What else it brings
- Redirects to unwanted sites and browser extensions, add-ons or plug-ins
- How it arrives
- Inside the installer of another free program, as an offer on one screen of the setup
WinYahoo belongs with the browser hijackers: its main effect is a search engine and home page you did not choose. Some of its installers also brought fake updater pop-ups and a helper folder, the kind of leftover you also see with unwanted system tools.
Is WinYahoo dangerous? What it collects
What we could check on 9 October 2026
WinYahoo has no web address to open, so our usual site test (notification request, pop-ups, redirects, service worker) does not apply. We did not run the installer or a sample either. What follows is what we read and could confirm from public pages, plainly separated from what we could not.
WinYahoo and PUP.Optional.WinYahoo · sources read on 9 October 2026
- Our own test of a siteNot possible. The name belongs to an installer and its leftovers, not to a domain, so there was nothing to load and nothing we can say about notifications, pop-ups or redirects from our side.
- Our own run of the installerNot done. The behaviour below comes from Malwarebytes' analysis of 13 May 2015, one installer version, and may differ from what reaches a PC today.
- Detection still publishedMalwarebytes' threat page for PUP.Optional.WinYahoo is online, was last changed on 26 September 2023, and lists PUP.Optional.WinYahoo.Generic as an associated threat.
- Recent reportsA forum case from 18 February 2025 reports the detection returning on Microsoft Edge's
Secure Preferencesfile until a helper had the user run cleaning tools; the scan was clean on 21 February. - Claims of stolen dataThe old guide said it collects browsing habits, IP addresses and keystrokes. We found no source for that, so it is not confirmed.
- Where the installer is todayWe found no current download page or maker for WinYahoo; who distributes it now is not confirmed.
Medium risk Unwanted and worth removing: it changes browser settings and adds an extension that opens ad tabs. Nothing we read shows it stealing files or passwords. This verdict rests on reading, not on running the program, and a quiet result on a PC says nothing about what another installer version does.
What it changes on the PC
Most of what is known comes from one write-up by Malwarebytes researcher Joshua Cannell, published on 13 May 2015. The table separates what that write-up states from what we could not confirm.
| Where | What was found | Status |
|---|---|---|
| Program Files folder | Files created by the installer; the program is named after them. The exact folder name is not given in the sources we read | Stated by Malwarebytes (2015); folder name not confirmed |
| Chrome, Firefox, Internet Explorer, Opera | Home page, start page and search engine set to Yahoo; the Sale Charger extension or add-on installed in each | Stated by Malwarebytes (2015) |
Chrome Secure Preferences file | Changed from outside Chrome. The file holds a hash for each protected setting and a combined one called super_mac; WinYahoo calculated new values, so Chrome did not flag the change | Stated by Malwarebytes (2015) |
Edge Secure Preferences file | The 2025 forum case shows a detection on this file in Edge, at AppData\Local\Microsoft\Edge\User Data\Default | Reported by one user; cause not stated |
A file named sb plus a number | An obfuscated DLL downloaded from Amazon CloudFront next to the setup file, with a prefix sb and 2 or 3 digits | Stated by Malwarebytes (2015) |
AppData\Local\{GUID}\HowToRemove | A folder with uninst.exe, an HowToRemove.html page with screenshots, and Start menu and Recent shortcuts named HowToRemove. Malwarebytes listed every item as PUP.Optional.WinYahoo.TskLnk, along with an uninstall entry under HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Seen in a Malwarebytes log posted on Microsoft Q&A, 3 April 2020 |
| Windows registry | Our 2021 picture of a Malwarebytes scan lists one registry key and one registry value under HKEY_USERS\...\SOFTWARE. Their names are cut off | Seen in the picture; names not confirmed |
The old guide said a browser reset does not help. That is half right: a reset restores the settings, but leftovers can write them again, so remove the program and the extension first.
WinYahoo from 2015 to 2025
13 May 2015
Malwarebytes publishes the first analysis
The write-up examines a bundler for an Adobe Photoshop Album Starter Edition installer and the rogue extension Sale Charger.
February 2016
A reader asks if one scan was enough
A Windows XP user on Microsoft's Q&A forum had Malwarebytes quarantine the detection, saw a clean second scan and asked if that was enough. The answer pointed him to the 2015 write-up and to the end of Windows XP support.
July 2016
Detections on a Chrome settings file
The picture shows Malwarebytes listing two WinYahoo threats, a registry key and a registry value, and a real-time block of a file named
SYNHELPER.EXEin a Downloads folder. In its quarantine list two entries from 18 and 20 July 2016 point at Chrome's Secure Preferences file.
Malwarebytes scan results from our 2021 report: two PUP.Optional.WinYahoo detections (registry key and value), a block of SYNHELPER.EXE in Downloads, and quarantined Chrome Secure Preferences entries dated 18 and 20 July 2016. 3 April 2020
A Chromium update window every day
A Windows 10 user on Microsoft Q&A reported a window asking to update Chromium once or twice a day and an Internet Explorer shortcut that kept returning to the desktop. The Malwarebytes log named the leftovers
PUP.Optional.WinYahoo.TskLnk: aHowToRemovefolder in AppData, shortcuts and an uninstall entry. One answer suggested turning on Defender's PUA protection.23 August 2021
Our first report
We called it adware that fills browsers with ads.
From our 2021 report: a Yahoo search page opened through an address with partner codes, and a page warning that pop-up ads are enabled and telling the visitor to call a toll-free number. 18 to 21 February 2025
A detection on Edge's settings file
The detection kept returning on Edge's Secure Preferences file even after Edge was reinstalled. After a helper's cleaning tools, the scan came back clean. We did not run those tools.
What can actually go wrong
Nothing we read shows WinYahoo encrypting files or taking passwords. The real concerns come from the extension and from what the ads lead to.
- Medium
New tabs with ads, and sometimes a scam page
Sale Charger opened new tabs with advertisements. Malwarebytes saw one show a tech support scam. The script came from
salecharger-a.akamaihd.netand opened a tab after you clicked somewhere on a page. - Medium
Your searches go to Yahoo with partner codes
Searches still work, but the addresses in our 2021 pictures carry partner codes. We cannot say what is logged.
- Medium
Browser settings you did not set
Home page, start page and search engine change in several browsers, and Chrome's tamper protection was bypassed. Settings that come back mean something is still installed.
- Low
Malware reached through the ads
The old guide warned of malware, phishing and fake updates behind ad pages. In our sources only a tech support scam was seen.
- Low
Stolen data and keystrokes
The old guide claimed the program collects browsing habits, IP addresses and keystrokes. We found no source for that and did not see it, so we do not repeat it as fact.
What a search engine can see, genuine or not
- Words you search for
- IP address
- Browser and device details
- Time of each search
- Results you click
True of every default search engine, which is why a setting you did not choose is worth changing.
How WinYahoo got into your browser
WinYahoo is installed by a setup program, and the setup program usually belongs to something else you wanted. You agree to it on one screen.
- 1
You run a free program's setup
Malwarebytes examined a bundler for Adobe Photoshop Album Starter Edition, a free download. Click Next and the next screen depends on the PC.
- 2
The bundler checks for a virtual machine
In the analysed version the Yahoo offer appeared only when no virtual machine was detected; with one, other offers such as Norton 360 appeared. Malwarebytes calls this a technique commonly seen in malware.
- 3
You accept the offer
The bundler writes a file into a temporary folder, starts it as
setup.exeand passes it a secret command-line argument; without it the installer stops with an invalid-arguments message. - 4
The setup downloads the rest
It fetches an obfuscated DLL from Amazon CloudFront, a file starting with
sb, and uses it to install the program and the extension. - 5
The browsers are changed
Yahoo becomes the home page, start page and search engine, and the extension goes into each browser.
How to remove WinYahoo
How to remove WinYahoo and get your search engine back
Remove the extension first.
The search settings only stay fixed once nothing on the PC can change them again.
Which browser shows the ads?
Set your search engine and start page
Open Settings > Search engine, choose Change next to the address-bar engine and pick yours, then delete unknown entries under Manage search engines and site search. Under On startup, remove Yahoo if it is listed.
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on Sale Charger and anything you did not install.Full procedure with screenshots: Remove a browser extension
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm. Start page, search engine and pinned tabs reset and extensions turn off; bookmarks and saved passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Set your search engine and start page
Open Settings > Privacy, search, and services > Address bar and search and choose your engine; check Manage search engines for entries you did not add. Under Start, home, and new tabs, remove Yahoo from When Edge starts and Home button.
Remove extensions you do not recognise
Paste
edge://extensionsinto the address bar and click Remove under anything you did not install.Full procedure with screenshots: Remove a browser extension
Reset Edge
Open Settings > Reset settings > Restore settings to their default values and confirm. Extensions turn off and the start page resets; favourites, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Set your search engine and home page
Open Settings > Search and pick another Default Search Engine, removing engines you did not add under Search Shortcuts. In Settings > Home, set Homepage and new windows to Firefox Home (Default) if Yahoo is listed.
Remove the add-on, or try Troubleshoot Mode
Paste
about:addonsinto the address bar, open Extensions and choose Remove from the three-dot menu of any add-on you do not recognise. If there is no Remove option, the program that installed it controls it: uninstall that program in Windows, then use the menu > Help > Troubleshoot Mode and try again.Full procedure with screenshots: Remove a browser extension
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Set your search engine and homepage
Open Safari > Settings > Search and choose a different Search engine. In General, clear or change the Homepage address if it shows Yahoo.
Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install and click Uninstall. Check Finder > Applications for a program you did not install and move it to the Bin. WinYahoo's own installer is a Windows program; this is a general check for Safari.
Then, whichever browser you use
Step 1: Uninstall WinYahoo
Open Settings > Apps > Installed apps in Windows 11, or Settings > Apps > Apps & features in Windows 10. Sort the list by install date and find WinYahoo, then choose Uninstall from the three-dot menu next to it (in Windows 10, click the entry and then Uninstall).
Remove anything else installed on the same day that you do not recognise, because such programs usually arrive together in one installer. If the uninstaller opens a browser page with an offer or a survey, close it: the program is removed either way.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep your search engine and start page
If you accepted a bundled installer
Remove the program first, then the extension, then reset the browser. Do it in this order, because the program can write the settings again.
- 1
Uninstall what came with the download
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall anything installed on the day the home page changed (Uninstall a program or app in Windows On uGetFix). Step by step with screenshots: uninstall a program in Windows 11 and 10. If the list shows an entry with no name or an uninstaller in a
HowToRemovefolder, that is the 2020 variant's leftover. - 2
Remove the extension in each browser
Paste
chrome://extensions,edge://extensionsorabout:addonsinto the address bar and remove Sale Charger and anything you did not add (Remove a browser extension). Malwarebytes found Sale Charger in Chrome, Internet Explorer, Firefox and Opera. - 3
Reset each browser
Reset settings in Chrome, Edge and Firefox so the home page, start page and search engine return to their defaults (Reset a browser and fix a hijacked search engine). Do not edit the
Secure Preferencesfile by hand: Chrome marks outside changes as corrupt and resets the affected settings. - 4
Scan the PC
Run a Microsoft Defender Full scan, then the Microsoft Defender Antivirus (offline scan). Then turn on blocking of unwanted apps: in Windows Security > App & browser control > Reputation-based protection settings, switch on Potentially unwanted app blocking, or run
Set-MpPreference -PUAProtection Enabledin an administrator PowerShell window. - 5
Restart, scan again, check the browser
Restart Windows, scan once more and open each browser. If Yahoo is still the home page, something is still writing the settings.
How to keep it from happening again
Do
- Choose Custom or Advanced setup in an installer and untick extra browsers, search settings and toolbars; the WinYahoo offer was one screen with Yahoo's terms.
- Download programs from their makers' sites or the Microsoft Store, not from bundle portals.
- After installing free software, open each browser's home page and search settings once.
- Keep a current backup of your files (File History or OneDrive), so a clean-up never costs you documents.
- On public networks, a VPN hides your IP address from the sites and ad networks you visit; it does not block ads or malware.
Don't
- Click Next without looking, or pick Quick or Recommended setup.
- Accept an offer to make Yahoo or another search your default if you did not go to install it.
- Edit the
Secure Preferencesfile by hand.
Questions about WinYahoo
What is PUP.Optional.WinYahoo?
It is Malwarebytes' detection name for a potentially unwanted program called WinYahoo, not a virus and not a website. According to Malwarebytes, it changes the home, start and search pages of Chrome, Firefox, Internet Explorer and Safari, redirects to unwanted sites and installs browser extensions.
Its 2015 write-up says it is bundled inside the installers of other free programs and is not related to the company Yahoo. When the name appears in a scan, it means files or settings from such an installer are on your PC. It does not by itself mean files were stolen or encrypted.
Is WinYahoo a virus?
No. WinYahoo is a potentially unwanted program, a category that sits between wanted software and malware. It does not copy itself to other computers or destroy files. It is unwanted because it changes browser settings without a clear choice from you, installs an extension that opens ad tabs, and in 2015 bypassed Chrome's protection for its settings file.
Malwarebytes saw one of its ad tabs show a tech support scam. We found nothing showing it steals data, so we do not call it spyware. Remove it, but you do not need to treat the PC as taken over.
Why does the detection keep coming back on Secure Preferences?
A file that is flagged again after quarantine is being rewritten, or an earlier piece was missed. In a February 2025 Malwarebytes forum case, the flagged file was Edge's Secure Preferences.
Reinstalling Edge did not clear it, because the file lives in the user profile. The scan was clean on 21 February after a helper had the user run a removal script, an ESET scan and a FRST fix.
We did not run those tools. The cause in that case was not stated. Reset the browser and remove the bundled program first; if it still returns, post a scan log on a malware-removal forum.
What is Sale Charger?
Sale Charger is the rogue browser extension that Malwarebytes found installed together with WinYahoo, in Chrome, Internet Explorer, Firefox and Opera. It injects JavaScript fetched from salecharger-a.akamaihd.net into web pages, waits with a timer for you to click somewhere and then opens a new tab with an advertisement.
Malwarebytes saw it open a tech support scam page once. It is listed in the browser's extension page, so you can remove it there. We did not run it ourselves; this comes from the 2015 write-up.
Can WinYahoo steal my passwords or bank details?
We found no evidence that it does. The old guide said unwanted programs can log keystrokes and collect IP addresses and browsing habits, but cited no source for WinYahoo, and Malwarebytes' pages do not say it.
What is documented is a changed home page and search engine, a rogue extension and ad tabs, one of which showed a tech support scam. A scam page can still ask for payment details, so do not enter any, and never call a number shown on a pop-up. If you did, change the passwords you used and watch your accounts.
How did WinYahoo get on my PC?
Almost certainly through the setup of another free program. Malwarebytes examined a bundler for Adobe Photoshop Album Starter Edition: after you click Next, a screen offers Yahoo, and if you accept, the bundler starts the WinYahoo setup.
In that version the offer was shown only when no virtual machine was detected. Quick or Recommended setups hide such screens or tick them for you. Check Installed apps for the program you installed on the day the home page changed, and choose Custom or Advanced next time.
Is WinYahoo still around in 2026?
It is rare, but the name has not disappeared. Malwarebytes still publishes its detection page, last changed in September 2023, and a user on its forum had the detection return on Edge's Secure Preferences file in February 2025.
We found no current download page, maker or installer for WinYahoo, so new infections in 2026 are not confirmed. What people see today is mostly old leftovers:
- a changed settings file
- a HowToRemove folder
- a registry entry from an install years ago
Those leftovers keep the detection coming back until they are removed, which is why a scan can name WinYahoo on a PC where you never knowingly installed anything recently. Treat it as cleanup work, not as a sign of a new attack.
Does Microsoft Defender detect WinYahoo?
We found no Microsoft detection name for WinYahoo on Microsoft's pages, so we cannot tell you what Defender calls it. The name PUP.Optional.WinYahoo comes from Malwarebytes, and variants such as PUP.Optional.WinYahoo.Generic and PUP.Optional.WinYahoo.TskLnk are also Malwarebytes names. Defender handles this kind of software through its potentially unwanted app (PUA) protection, which Microsoft describes as blocking adware and bundled software.
Turn it on in Windows Security > App & browser control > Reputation-based protection settings, switch Potentially unwanted app blocking on, or run Set-MpPreference -PUAProtection Enabled as an administrator. Microsoft Edge has its own Block potentially unwanted apps setting for downloads. A clean Defender scan with a Malwarebytes detection still present usually means a leftover file or setting remains.
Will Fortect remove WinYahoo?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For WinYahoo, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Malwarebytes Labs: "WinYahoo" PUP Modifies Chrome Secure Preferences (13 May 2015) (read October 5, 2026)
- Malwarebytes Threat Alert: PUP.Optional.WinYahoo (page modified 26 September 2023) (read October 5, 2026)
- Malwarebytes Forums: Can't remove PUP.Optional.WinYahoo.Generic (thread of 18 to 21 February 2025) (read October 5, 2026)
- Microsoft Q&A: PUP.Optional.WinYahoo have been detected (thread of 4 February 2016) (read October 5, 2026)
- Mozilla Support: Cannot remove an add-on (extension or theme) (read October 5, 2026)
- Google Chrome Help: Change your default search engine (no longer online) (read October 5, 2026)
- Mozilla Support: Change your default search settings in Firefox (read October 5, 2026)
- Apple Support: Change your search settings in Safari on Mac (read October 5, 2026)
- Microsoft Support: Change your default search engine in Microsoft Edge (read October 5, 2026)
- Microsoft Q&A: I have been infected with malware (PUP.Optional.WinYahoo.TskLnk log, 3 April 2020) (read October 9, 2026)
- Microsoft Learn: Block potentially unwanted applications with Microsoft Defender Antivirus (read October 9, 2026)