Do you know what Yoga Search is?
According to our cybersecurity experts, Yoga Search is a browser extension for Google from, and you might want to remove because it does not do anything useful. In fact, it can make your browsing experience worse as it can change the default search engine of your browser without your authorization. This program is not exactly malicious, so researchers have classified it as a potentially unwanted program (PUP) because of the undesirable actions it can perform once on your PC. If you want to learn more about it, please read this whole description.
Our researchers say that Yoga Search is identical to EZSearch. In fact, they both are the same application because they are just extension names of the same infection. Unfortunately, the developers of this malicious application are unknown which I not surprising since they do not want to reveal themselves to avoid criticism for this junk application.
Researchers say that the methods for distributing this program are unknown. The sample they have tested, however, worked on Google Chrome only, but the Chrome Web Store definitely does not have it up for download. Therefore, it is reasonable to assume that the shady developers may have made arrangements to have this extension bundled with third-party software. If that is the case, then this extension could be bundled with freeware that is distributed on websites dedicated to distributing this kind of software and makes money of bundling legitimate software with the likes of Yoga Search. The bundled installers might not disclose the presence of this application and inject into your browser by default. However, you may be able to deselect this application after selecting advanced or custom settings.
If you install Yoga Search on your browser, then it will create a new shortcut "Google Chrome.lnk" on the Desktop. The target line of this new shortcut contains "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa." So you will end up having to shortcuts on your desktop: one will be legitimate, and the other one will have this modified target line that will load this extension. Furthermore, Yoga Search will replace your browser’s search engine with https://search.yahoo.com/search?p={searchTerms}&xpubz=8z108mno&r=yy62f009mvb12&trk=b1v300. If you use this search engine for searching the web, then there is no telling whether it will provide you with reliable and safe search results. Note that this extension does not change the search engine for the unmodified chrome shortcut. It is clear as day that this extension was designed to replace your browser’s search engine, but it does not seem to feature promotional links or ads, so we have no idea how the developers monetize this software.
The older version of Yoga Search can drop its files in either %PROGRAMFILES(x86)%\EZSearch or %PROGRAMFILES%\EZSearch depending on the architecture of Windows which can be either 64-bit or 32-bit. The newer version drops the files at the following locations:
- %LOCALAPPDATA%\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa
- %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa
- %Temp%\WS
It also creates necessary registry keys listed below”
- HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZSearch
- HKLM\SYSTEM\ControlSet001\Services\WindowService
- HKLM\SYSTEM\ControlSet002\Services\WindowService
- HKLM\SYSTEM\CurrentControlSet\Services\WindowService
As you can see, Yoga Search is one shady application whose developers have gone out of their way to make this program as low key as possible. We do not know how they managed to monetize this application, but it is obvious that they did not but in all this effort for nothing. In any case, Yoga Search is a shady application that was set to create another shortcut for Chrome that used another search engine. There is nothing useful about that, so we suggest that you remove this extension from your PC as soon as you can.
Removal Guide
- Press Windows+E keys.
- In File Explorer’s address box, type the following file paths.
- %LOCALAPPDATA%\Google\Chrome\User Data\Extensions
- %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Extensions
- Press Enter.
- Find ikmapcaeknfgfmjlibnhcbchfablckbpa, right-click it and click Delete.
- Then, type %Temp% find a folder named WS and delete it.
- If you have an older version of this application, go to either %PROGRAMFILES(x86)% or %PROGRAMFILES%
- Find and delete the EZSearch folder.
- Close the File Explorer.
- Empty the Recycle Bin.
- Press Windows+R keys.
- Type regedit in the dialog box and press Enter.
- Go to the following keys and delete EZSearch
- HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- Lastly, go to the following keys and delete WindowService.
- HKLM\SYSTEM\ControlSet001\Services
- HKLM\SYSTEM\ControlSet002\Services
- HKLM\SYSTEM\CurrentControlSet\Services
In non-techie terms:
Yoga Search is a potentially unwanted program because it serves no purpose other than to replace your browser’s search engine through rather deceptive means that involve creating a second modified shortcut for Google Chrome. The purpose for doing so is unknown because it does not seem like the modified search engine was designed to show promotional links and ads.