Adware:MSIL/SuperWeb.A represents a family of browser-based adware programs written in Microsoft Intermediate Language (MSIL) — the compiled code format used by .NET applications. First identified as part of the notorious SuperWeb LLC advertising network, this threat installs browser extensions and helper objects that inject unwanted advertisements into your web browsing sessions. While technically classified as adware rather than a destructive virus, SuperWeb variants track your browsing habits, redirect searches to sponsored results, and create system-level persistence that survives standard uninstall procedures.
The SuperWeb family encompasses dozens of individually-named programs (BrowserAir, LyricsSay, SaverOn, PriceMeter, and many others), but they share common code signatures, distribution methods, and removal challenges. Users typically encounter aggressive pop-ups, in-text advertisements on sites that normally don't have them, and suspicious toolbars that appear without explicit consent. Because these programs operate in a legal gray area — bundled with legitimate software under layers of EULA fine print — traditional antivirus solutions sometimes fail to flag them during installation.
Threat Profile
| Attribute | Details |
|---|---|
| Family | SuperWeb LLC adware family (BrowserAir, LyricsSay, SaverOn, PriceMeter, etc.) |
| Classification | Adware / Potentially Unwanted Program (PUP) / Browser Hijacker |
| Platform | Windows (XP through 11), primarily targeting Chrome, Firefox, Edge, and Internet Explorer |
| Code Base | Microsoft Intermediate Language (MSIL/.NET Framework 2.0-4.x) |
| First Documented | SuperWeb network active 2012-2016; variants still circulating |
| Distribution | Software bundling, fake update prompts, repackaged freeware installers |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, browser extension APIs, helper DLLs |
| Primary Capabilities | Ad injection, search redirection, browsing history collection, affiliate fraud |
| Common File Locations | %LOCALAPPDATA%\[RandomName], %PROGRAMFILES(X86)%\[BrandName], browser extension folders |
| Network Behavior | Communicates with ad-serving domains (known for the family: superweb.com, superfish-related domains, various CDN endpoints) |
| Data at Risk | Browsing history, search queries, clicked links, possibly form data depending on variant |
| Removal Difficulty | Moderate — standard uninstall often leaves components; requires registry/filesystem cleanup |
How It Spreads
SuperWeb adware rarely arrives alone. The most common infection vector involves software bundling — the practice of packaging unwanted programs with legitimate free software. When you download a video converter, PDF reader, or codec pack from a third-party download site (not the official publisher), the installer often contains multiple "offers" for additional software. SuperWeb variants hide in these installers, often pre-checked for installation or disclosed only in tiny text during "Express" setup modes.
The second major distribution method exploits user trust through fake update notifications. You might see a browser pop-up claiming your Flash Player, Java, or video codec is out of date, complete with official-looking logos and urgent language. Clicking "Update Now" actually downloads a malicious installer that bundles the adware. Some variants also spread through compromised browser extensions — you install what appears to be a legitimate coupon-finder or weather toolbar, but it silently installs the SuperWeb payload alongside its advertised functionality.
Common distribution vectors include:
- Repackaged freeware installers on sites like Softonic, Download.com (user-submitted software), and torrent sites
- Fake system update pages mimicking Microsoft, Adobe, or media player update prompts
- Malicious advertising (malvertising) on legitimate websites, particularly streaming and file-sharing sites
- Email attachments disguised as invoices, shipping notifications, or document viewers
- Compromised browser extensions that update themselves to include adware components
- Pay-per-install (PPI) networks where affiliates earn money for each installation, incentivizing deceptive bundling
What It Does On Your Machine
Once installed, Adware:MSIL/SuperWeb.A establishes multiple points of control over your browsing experience. The primary component installs as a browser extension or Browser Helper Object (BHO) that injects JavaScript into every webpage you visit. This injected code scans page content for keywords, then inserts additional advertisements — often as pop-unders (ads that appear behind your current window), in-text links (random words become clickable ads), or banner replacements (swapping legitimate ads with the adware's own ads to steal revenue from website owners).
The program monitors your browsing activity to build an advertising profile. Every search query, visited URL, and clicked link gets logged and transmitted to remote servers operated by the SuperWeb network or its affiliates. This data serves two purposes: targeted advertising (showing you products related to your recent searches) and affiliate fraud (the adware injects its own affiliate tracking codes into product links, stealing commissions from legitimate referrers). In some variants, the tracking extends to form data — though full credential theft is not the primary goal, some users have reported saved passwords becoming compromised after infection.
System-level changes ensure the adware survives casual removal attempts. SuperWeb creates Windows registry entries that reinstall the browser extension after you manually delete it. Scheduled tasks check periodically whether the main executable is running and restart it if necessary. Some variants install a Windows service or replace legitimate system DLLs with modified versions that include advertising hooks. The .NET framework requirement means the malware can leverage the same system privileges your legitimate applications use, making it difficult for basic antivirus programs to distinguish malicious behavior from normal software operation.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or disable Wi-Fi before beginning the removal process. This prevents the adware from downloading updates, communicating with command servers, or installing additional components while you work. It also protects any passwords or financial data you might need to access later from being intercepted during cleanup.
Boot Into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (Windows 7) or hold Shift while clicking Restart, then navigate to Troubleshoot → Advanced Options → Startup Settings → Restart → press 4 (Windows 8/10/11). Safe Mode loads only essential drivers and prevents the adware's startup entries from launching, making removal significantly easier. Choose the "with Networking" option so you can download removal tools if needed.
Uninstall Suspicious Programs
Open Control Panel → Programs and Features (or Settings → Apps on Windows 10/11) and look for recently installed programs you don't recognize. Common SuperWeb brand names include BrowserAir, SaverOn, LyricsSay, PriceMeter, and similar generic-sounding names. Sort by "Installed On" date to identify programs that appeared around the time problems started. Uninstall everything suspicious, but note that this built-in uninstaller often leaves components behind intentionally.
Remove Browser Extensions
Open each browser you use and remove all extensions you didn't explicitly install. In Chrome: three-dot menu → Extensions → Remove. In Firefox: three-line menu → Add-ons → Extensions → Remove. In Edge: three-dot menu → Extensions → Manage extensions → Remove. Pay special attention to extensions with generic names or that lack recognizable publisher information. SuperWeb extensions often masquerade as coupon finders, shopping helpers, or video downloaders.
Clean Registry Persistence Entries
Press Win+R, type regedit, and hit Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names (matching the uninstalled programs) pointing to executables in AppData or Program Files directories. Right-click and delete these entries. Also check HKEY_CURRENT_USER\Software and HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node for folders named after the adware brand — delete the entire folder.
Remove Scheduled Tasks
Press Win+R, type taskschd.msc, and hit Enter to open Task Scheduler. Look through Task Scheduler Library for tasks with suspicious names or that reference the adware's installation directory. SuperWeb variants often create tasks that run hourly or at logon to check for updates or restart disabled components. Right-click any suspicious task and select Delete. Common task names include "[BrandName]Update" or random alphanumeric strings.
Delete the Installation Folders
Open File Explorer and navigate to C:\Program Files (x86)\ and C:\Users\[YourUsername]\AppData\Local\. Delete any folders matching the adware name or containing executables you identified in the registry. You may need to show hidden files (View tab → check "Hidden items"). If Windows says the file is in use, restart in Safe Mode if you're not already there, or use the Command Prompt (run as administrator) with the command rmdir /s /q "C:\path\to\folder" to force deletion.
Run Malwarebytes or AdwCleaner
Download Malwarebytes Free (malwarebytes.com) or AdwCleaner (also from Malwarebytes) using a clean computer or your phone, then transfer via USB. Install and run a full scan — these tools specifically target PUPs and adware that standard antivirus misses. Quarantine everything they find. Malwarebytes maintains an extensive SuperWeb signature database and can catch registry entries, browser modifications, and file remnants you might have missed during manual cleanup.
Reset Browser Settings
Even after removing extensions, some settings changes persist. In Chrome: Settings → Reset settings → Restore settings to their original defaults. In Firefox: Help → More Troubleshooting Information → Refresh Firefox. In Edge: Settings → Reset settings → Restore settings to their default values. This clears the homepage hijacks, default search engine changes, and any injected startup pages. You'll need to reconfigure your preferences afterward, but it guarantees a clean slate.
Restart and Verify
Restart your computer normally (not Safe Mode) and reconnect to the internet. Open your browsers and verify that ads are no longer appearing where they shouldn't, your homepage is correct, and searches return expected results. Check Task Manager (Ctrl+Shift+Esc) for suspicious processes with high CPU usage. Monitor your system for 24-48 hours — if pop-ups return or you notice unusual network activity, the infection may have additional components requiring professional removal.
Prevention
- Download software only from official publisher websites — not third-party download portals. If you need VLC, get it from videolan.org, not from a "VLC download" Google result leading to a repackaged installer.
- Always choose "Custom" or "Advanced" installation instead of "Express" or "Recommended" when installing free software. Read every screen carefully and uncheck any offers for additional software, toolbars, or homepage changes.
- Keep legitimate software updated through official channels — enable automatic updates for Windows, your browsers, Adobe products, and Java. Real updates never arrive as random browser pop-ups demanding immediate action.
- Use a reputable ad blocker like uBlock Origin (not to be confused with uBlock or AdBlock Plus, which have different ownership). Ad blockers prevent malicious advertisements from appearing in the first place, eliminating the most common infection vector.
- Maintain real-time protection with Windows Defender (built into Windows 10/11) or a reputable third-party antivirus that includes anti-PUP detection. Enable all protection modules, including potentially unwanted application blocking.
- Create a limited user account for daily use instead of always running as administrator. Adware and malware installations often require elevated privileges — using a standard account adds a prompt before system-level changes.
- Review your installed programs monthly and uninstall anything you don't recognize or no longer use. Adware sometimes sneaks in during routine updates of legitimate software that has changed ownership or monetization practices.
- Be skeptical of "free" offers that seem too good to be true — free registry cleaners, system optimizers, driver updaters, and video downloaders are frequent adware carriers. Windows has built-in maintenance tools that handle most of these tasks without third-party software.
Bring It In
Manual removal works for many SuperWeb infections, but some variants install rootkit-like components or modify system files in ways that require specialized tools and experience. If you've followed these steps and still see suspicious ads, or if you're uncomfortable editing the registry and working in Safe Mode, professional removal is the safer option. Computer Repair Roswell has cleaned hundreds of adware infections from Roswell-area computers — we know the common hiding spots, the registry keys that regenerate themselves, and the legitimate files that adware exploits.
We're located at 1750 Hembree Road in Roswell, just minutes from the Roswell City Center and easily accessible from Alpharetta, Sandy Springs, and Marietta. Call us at (770) 679-8324 to describe your symptoms — we can often tell you over the phone whether you need immediate service or if you can safely bring the system in during regular business hours. Most adware removals take 2-4 hours including verification scans, and we'll also check for other security issues that might have snuck in alongside the primary infection. Don't let SuperWeb variants steal your browsing privacy and system performance — bring it in and we'll get your computer back to normal.