{"id":28065,"date":"2024-11-04T17:18:55","date_gmt":"2024-11-04T17:18:55","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=28065"},"modified":"2024-11-04T17:52:11","modified_gmt":"2024-11-04T17:52:11","slug":"pua-win32-webcompanion","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/pua-win32-webcompanion\/","title":{"rendered":"PUA:Win32\/Webcompanion"},"content":{"rendered":"

PUA:Win32\/Webcompanion is a potentially unwanted program<\/strong> positioned as a malicious link blocker. In fact, it modifies browser settings and installs additional unwanted software and browser extensions. The program is commonly distributed as bundled or recommended software alongside freeware programs.<\/p>\n

PUA:Win32\/Webcompanion Overview<\/h2>\n

PUA:Win32\/Webcompanion is a Microsoft Defender detection associated with a potentially unwanted program<\/a> called Adaware Web Companion<\/strong>. This program, developed by Lavasoft, is positioned as a malicious link blocker. Thus, it filters traffic completely and if it finds a site dangerous, it blocks access to it, acting as an Internet Security module. However, it has gained notoriety and is classified as potentially unwanted software.<\/p>\n

\"PUA:Win32\/Webcompanion
PUA:Win32\/Webcompanion detection<\/figcaption><\/figure>\n

Adaware Web Companion is not a malicious program<\/strong> by itself, but given its distribution method and the actions it performs on the system, there are quite solid reasons why it can be considered as unwanted.<\/p>\n

Although Adaware Web Companion has an official website, like most unwanted programs it is distributed as bundleware<\/strong>, as additional “recommended” software bundled with other programs. And, when uninstalling the main program which installed the PUA:Win32\/Webcompanion, the latter is not removed but remains in the system.<\/p>\n

As for its actions, it can redirect traffic, search queries, and sometimes even change the start page and search engine after installation. While it does not always make these changes, it did so in our tests, and user reviews indicate that such cases happen more often than not. Changes generally depend on various factors such as the program version, user’s IP address, geographical location, and presence of anti-malware software on the system (which we will revisit later).<\/p>\n

Technical Analysis<\/h2>\n

When downloaded from the official website, the installation process appears ordinary and unremarkable. However, most users acquire it unintentionally as part of bundled software<\/a> with other programs.<\/p>\n

\"Adaware
Adaware Web Companion installer<\/figcaption><\/figure>\n

After installation, the program runs in the system tray and continues operating quietly, making it unlikely that the user will notice it.<\/p>\n

\"PUA:Win32\/Webcompanion
PUA:Win32\/Webcompanion in the tray<\/figcaption><\/figure>\n

Let\u2019s examine this program\u2019s inner workings to understand its operation. So, start with the installation process: the program has an online installer that downloads the necessary files to the C:\\Program Files (x86)\\Lavasoft\\Web Companion\\<\/strong> folder.<\/p>\n

During installation, it checks a selection of system values, mostly ones responsible for browser and system configurations:<\/p>\n