Severity scale:  

Remove YesSearches from Chrome, Firefox browsers

removal by Lucia Danes - - | Type: Browser hijacker

YesSearches — a fake search engine that is launched by ShortcutBoost.exe process

YesSearches hijackerYesSearches - a fake search tool which controls your Firefox and Chrome web browsers to fill your searches with sponsored content.

Questions about redirect

YesSearches is a bogus search engine that has features of a browser hijacker.[1] This potentially unwanted program (PUP) can infiltrate the system unnoticed thru bundling. Once there, it drops Clqvrfsrv.exe, ShortcutBoost.exe and Uninst.exe to launch with every startup. Additionally, it replaces the default search engine and the homepage to domain to start rerouting its victim to sponsored sites. To prevent users from reverting these changes back, the virus also alters the computer's Registry. From first sight, YesSearches might look like a legitimate search engine which includes a Privacy policy, EULA,[2] and optional languages. However, as you must have already understood, it hides shady functionality behind these allegedly useful functions. You should not spend your time dealing with this hijacker. Make sure you terminate it right after it appears on your web browsers.

Name YesSearches
Type Browser hijacker
Main file Clqvrfsrv.exe; ShortcutBoost.exe; Uninst.exe
Detected as PUA.Yessearches
Affects web browsers Chrome, Firefox 
Symptoms Delivers intrusive advertisements, causes redirects, displays altered search results
Distribution Software bundles, deceptive promotions or websites
Main danger Collects various user information
Elimination Use Reimage Reimage Cleaner Intego for general system cleaning

The main aim of YesSearches virus is infiltrating third-party ads directly into the search results it displays on victim's screen. As a result, you might find difficulties in finding needed information quickly. Reasonable and safe search tools always limit the amount of commercial content displayed to their users and separate them from the organic search results. However, this browser hijacker acts in the opposite way. As a result, security vendors have started detecting it as PUA.Yessearches and similar.

Additionally, YesSearches seeks redirect victim's searches to third party sites that are typically working on increasing their search rank or visitors' number. While some part of these domains is considered to be safe, the other part should be avoided or at least left when entered. Beware that visiting such domains can end up with useless tools on your computer, e.g. fake optimization tools, rogue anti-spyware apps, etc. Additionally, such sites can locate tech support scams seeking to swindle users' personal data.

Furthermore, this potentially unwanted program is also capable of collecting various information about users. Fortunately, YesSearches does not collect personally identifiable information.[3] However, browser hijacker immediately after infiltration starts tracking and recording:

  • search keywords;
  • visited websites;
  • clicked ads;
  • IP address;
  • location.

YesSearches browser hijackerYesSearches is a shady search tool that might hijack your browser after installing freeware or shareware.

Aggregated information is usually used for advertising purposes, meaning that based on your activities online, the hijacker display targeted or personalized ads.[4] However, information about you might be shared or sold to third-parties. Thus, if you do not want to see more ads on the browser, you should remove YesSearches virus.

Browser hijackers are not hard to uninstall manually (check the instructions below). However, we recommend opting for automatic YesSearches removal. It allows deleting hijacker-related entries from the system using reputable anti-malware software like Reimage Reimage Cleaner Intego.

This automatic removal is beneficial for the system, according to various users, this program gets installed on the system with programs like VPlay. You need to uninstall this or any similar program and change browser settings to default if you want to get rid of YesSearches search engine. Uninstalling the program is not enough browser changes may still affect your browsing online. Cleaning the system thoroughly with anti-malware os system tools can terminate all additional processes and applications completely. 

YesSearches infiltration

Free software installers might include browser hijacker

The virus usually infiltrates the target system when users download freeware or shareware incorrectly. A security team from[5] reminds that PUPs cannot get into the system by themselves. They need users permission to enter the system, and users give it without even knowing it.

If you have recently downloaded some “safe” freeware from the Internet, then it means you have probably received a bundle with it. Shareware bundling is a method used to spread various potentially unwanted programs, such as questionable add-ons or plug-ins. Developers of the freeware do not warn you what lies behind „standard“ or „default“ installation options.

Most of the computer users rush through installation steps, hastily choose default settings for the installation and click finish. You should always pay attention to freeware installation:

  • Read the Terms and Agreements, as well as Privacy Policy.
  • Use “Custom” or “Advanced” installation settings instead of “Quick” or “Recommended.”
  • Untick all the boxes suggesting to install extra programs,
  • Do not give the authorization to change your homepage.

YesSearches virusYesSearches is a potentially unwanted program that displays commercial content to your browser and redirects to questionable websites.

Remove YesSearches from Google Chrome and Mozilla Firefox web browsers

One of the ways to remove YesSearches from your web browser is to download a reliable anti-spyware, update it to its latest version and run a full system scan. This should help you get rid of its reappearance on the system. Keep in mind that hijacker travels around together with numerous components, including specific BHOs and Windows services. Also, you should think about an alternative search engine that does not track its users and then share such data with third parties.

However, if you do not want to opt for automatic YesSearches removal, you can follow the manual removal guide below. Make sure you terminate the following processes at first: Clqvrfsrv.exe, ShortcutBoost.exe, Uninst.exe. Then, uninstall all apps that you don't know or seem suspicious and reset your web browsers:

You may remove virus damage with a help of Reimage Reimage Cleaner Intego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove redirect, follow these steps:

Eliminate from Windows systems

To uninstall YesSearches from Windows, follow these steps to get rid of every suspicious app that you can't remember installing:

  1. Click Start Control Panel Programs and Features (if you are Windows XP user, click on Add/Remove Programs). Click 'Start -> Control Panel -> Programs and Features' (if you are 'Windows XP' user, click on 'Add/Remove Programs').
  2. If you are Windows 10 / Windows 8 user, then right-click in the lower left corner of the screen. Once Quick Access Menu shows up, select Control Panel and Uninstall a Program. If you are 'Windows 10 / Windows 8' user, then right-click in the lower left corner of the screen. Once 'Quick Access Menu' shows up, select 'Control Panel' and 'Uninstall a Program'.
  3. Uninstall and related programs
    Here, look for or any other recently installed suspicious programs.
  4. Uninstall them and click OK to save these changes. Right click on each of suspicious entries and select 'Uninstall'
  5. Remove from Windows shortcuts
    Right click on the shortcut of Mozilla Firefox and select Properties. Right click on browsers' icon and select 'Properties'
  6. Go to Shortcut tab and look at the Target field. Delete malicious URL that is related to your virus. Select 'Shortcut' tab and delete '' or other suspicious URL

Repeat steps that are given above with all browsers' shortcuts, including Internet Explorer and Google Chrome. Make sure you check all locations of these shortcuts, including Desktop, Start Menu and taskbar.

Remove from Mozilla Firefox (FF)

Remove malicious Firefox extensions related to this browser hijacker as shown below:

  1. Remove dangerous extensions
    Open Mozilla Firefox, click on the menu icon (top right corner) and select Add-ons Extensions. Click on menu icon and select 'Add-ons'
  2. Here, select and other questionable plugins. Click Remove to delete these entries. Select 'Extensions' and look for malicious entries. Click 'Remove' to get rid of each of them
  3. Change your homepage if it was altered by virus:
    Click on the menu (top right corner), choose Options General.
  4. Here, delete malicious URL and enter preferable website or click Restore to default.
  5. Click OK to save these changes. When in 'General' tab, delete malicious URL from 'Home Page' section or click on 'Restore to Default' button. Click 'OK' to save changes
  6. Reset Mozilla Firefox
    Click on the Firefox menu on the top left and click on the question mark. Here, choose Troubleshooting Information. Click on menu icon and then on '?'. Select 'Troubleshooting Information'
  7. Now you will see Reset Firefox to its default state message with Reset Firefox button. Click this button for several times and complete removal. Click on 'Reset Firefox' button for a couple of times
WindowsFirefoxGoogle Chrome

Erase from Google Chrome

Get rid of YasSearches by removing suspicious extensions at first. Additionally, reset Google Chrome:

  1. Delete malicious plugins
    Open Google Chrome, click on the menu icon (top right corner) and select Tools Extensions. Click on menu icon. Select 'Tools' and 'Extensions'
  2. Here, select and other malicious plugins and select trash icon to delete these entries. Look for malicious entries and delete each of them by clicking on the Trash bin icon
  3. Change your homepage and default search engine if it was altered by your virus
    Click on menu icon and choose Settings.
  4. Here, look for the Open a specific page or set of pages under On startup option and click on Set pages. After clicking on menu and 'Settings', select 'Set pages'
  5. Now you should see another window. Here, delete malicious search sites and enter the one that you want to use as your homepage. Click 'X' to remove malicious URLs
  6. Click on menu icon again and choose Settings Manage Search engines under the Search section. When in 'Settings', select 'Manage search engines...'
  7. When in Search Engines..., remove malicious search sites. You should leave only Google or your preferred domain name. Click 'X' to remove malicious URLs
  8. Reset Google Chrome
    Click on menu icon on the top right of your Google Chrome and select Settings.
  9. Scroll down to the end of the page and click on Reset browser settings. When in 'Settings', scroll down to 'Reset browser settings' button and click on it
  10. Click Reset to confirm this action and complete removal. Click on 'Reset' button to complete your removal

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. It is a hassle when your website is protected from suspicious connections and unauthorized IP addresses.

The best solution for creating a tighter network could be a dedicated/fixed IP address. If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for server or network manager that need to monitor connections and activities. This is how you bypass some of the authentications factors and can remotely use your banking accounts without triggering suspicious with each login. 

VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world. It is better to clock the access to your website from different IP addresses. So you can keep the project safe and secure when you have the dedicated IP address VPN and protected access to the content management system.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Lucia Danes
Lucia Danes - Virus researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Lucia Danes
About the company Esolutions

Removal guides in other languages

  1. Twelwoge says:
    January 26th, 2016 at 8:41 am

    I have seen this virus on my sisters computer. It is particularly hard to remove it! she tried most of the stuff but only SpyHunter did the job

  2. Utirirad says:
    January 26th, 2016 at 8:42 am

    Before I had it in my PC, but these instructions helped. will never again be opened on my computer. EVER.

Your opinion regarding redirect