WebAdvisor by McAfee

What is WebAdvisor by McAfee?

WebAdvisor by McAfee is a legitimate browser extension by McAfee that often gets mimicked by browser hijackers and PUPs that try to take over the users’ browsers. If your browser has a hijacker that poses as WebAdvisor by McAfee, it’s recommended that you remove it.

WebAdvisor By McAfee Virus 1
The WebAdvisor by McAfee virus secretly gain permission to add more rogue components to the user’s browser

The purpose of the real WebAdvisor extension is to warn users about potentially harmful sites that they may be about to visit. Whenever you try to go to a site that may contain dangerous elements, WebAdvisor would warn you with a pop-up on your screen that tells you to be careful and to avoid that site. You still have the option to ignore the warning and proceed to the site, but you should at least consider the WebAdvisor warning.

On the other hand, aggressive ads, page-redirects, and even unauthorized homepage and search engine changes in Chrome, Firefox is what you are likely to experience if a browser hijacker pretends to be McAfee’s WebAdvisor gets installed on your machine. In such cases, it may seem like the extension is guarding you while you are online, but in reality, it’s being more obstructive than helpful. Due to the presence of the hijacker in your system, the browser’s performance may be affected and your Chrome, Firefox, Edge (or other) browser may become very slow due to the excessive amount of RAM that goes to the hijacker process/processes.

If pop-ups are frequently showing up on your screen or if the browser’s homepage and/or default search engine have been changed without your informed approval, then it is highly likely that you are dealing with a WebAdvisor by McAfee virus hijacker. Such hijackers may also spam you with ads and try to get you to install security software that you don’t really need.

Another likely consequence of the presence of a WebAdvisor-mimicking browser hijacker is the installation of additional rogue components in your browser, including Ssoption, Walliant, Affairsspeedup, Great Discover, Onrymspeedup. These are either browser hijackers or other potentially unwanted programs (PUPs) and if you see any of them in your browser, it’s likely that you also have a WebAdvisor by McAfee virus hijacker (and vice versa). In fact, this is yet another common problem with hijackers such as these – they tend to secretly gain permission to add more rogue components to the user’s browser. The end goal is to typically make money through ads and paid promotions of sites, products, and services, but the truth is that, although the main purpose of most such hijackers isn’t to damage the computer, this could still end up being an indirect result of their presence in the system. In other words, if a hijacker is in your browser, this could lead to your computer becoming more vulnerable and exposed to hackers and scammers. Before you know it, you may find yourself dealing with a Ransomware or Trojan Horse infection that has taken place because your system’s security has been weakened by the hijacker’s presence.

Obviously, the best response to all of this is to clean every browser on your computer, as well as find and delete any hijacker data or settings present in the system – this will not only stop any hijackers from disrupting you but will also decrease the chances of running into Trojans, Ransomware, Spyware, or other similar threats. 

It’s usually feasible to do the removal manually, and we will do our best to help you with it by providing you with a detailed guide. However, if for some reason, you are still unable to delete the WebAdvisor by McAfee virus using the manual steps, or if you don’t have the time to complete those steps, know that you can always try using a specialized security tool such as the one you will see linked further down this post.

NameWebAdvisor by McAfee virus
TypeBrowser Hijacker/PUP
Detection Tool

anti-malware offerOFFER *Free Remover allows you, subject to a 48-hour waiting period, one remediation and removal for results found. SpyHunter's EULA,  Privacy Policy, and more details about Free Remover.

Remove WebAdvisor by McAfee Virus

To remove WebAdvisor, all files, settings changes, and software related to the hijacker must be eliminated from your computer.

  1. We suggest you start by searching for a newly-installed program that the hijacker may have been bundled with, and delete that program.
  2. Next, you should see if there are WebAdvisor processes running on your PC at the moment and quit them.
  3. The third step is to remove WebAdvisor is to clean the Hosts file, the Registry, the DNS settings, and the list of Startup items.
  4. Finally, you must go to every browser (even ones that seem unaffected), remove from them any unwanted extensions, and clear their data.

For detailed instructions about each of these steps, we suggest reading the following lines.

Detailed WebAdvisor Removal Guide

Since WebAdvisor may be able to communicate with the servers of its creators and receive new instructions from them that may hinder the removal process, we suggest keeping your PC disconnected from the web for the duration of this guide.

Step 1

By going to Start Menu > Control Panel > Uninstall a Program, you will be able to see all programs that are on your computer and see their installation dates. Once you go there, search for a recently installed program (added right before you started noticing WebAdvisor) that you think could have something to do with the hijacker. If there is such a suspicious program there, we suggest removing it, especially if you don’t recognize it or if you don’t remember installing it on the computer.

Pay attention to the options in the uninstallation menu – if there’s an option to leave custom/personalized settings for the program or other non-essential data related to it, make sure to opt-out of said option since nothing related to the suspicious program should be allowed to remain on your PC.

Note: Obviously, if you see the WebAdvisor by McAfee virus app in the Uninstall a Program (Programs and Features), you should remove that too.


Step 2


Start the Task Manager (Ctrl + Shift + Esc to start it) and click Processes from the top. Now the list of processes for a Web Advisor process. If you find it, right-click it, open the File Location, then quit the process, and delete it File Location folder.

1 1
2 1

If there isn’t a WebAdvisor process in the Task Manager, sort the list by virtual memory or CPU usage, look at the ones that have the highest usage values, and see if any of them have unusual or questionable names that are unfamiliar to you and/or that make you suspect that the process may be linked to the hijacker.

If you find anything like this, use your smartphone or another device with an Internet connection (since the Internet connection on your PC should currently be stopped) and search online for more information about the suspected process. If there’s information from reliable sources that tells you that the process may be harmful and/or related to the WebAdvisor by McAfee virus, you should quit the process and delete its location folder as we showed you above.

You can also use our free scanner from below to test the files in the location folder and see if any of them are infected as another way of finding out if the suspected process is indeed harmful.

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    If a file (or several files) is found to be infected, then the process must be stopped. Once you end the rogue process, also make sure to delete its folder. If you aren’t allowed to delete something that’s in the rogue process’ folder, delete the other data and return for what’s left after the end of the guide.

    Step 3

    The WebAdvisor by McAfee virus may attempt to restart the processes that you quit during the last step – to make sure this doesn’t happen, enable Safe Mode on your computer.

    Step 4

    Press together the Windows key and R key type the following line in the newly-appeared window and click OK.

    • ncpa.cpl

    Next, in the window that opens, single out and right-click on the icon of the network that you normally use with this computer. Then open the Properties settings and find and click on Internet protocol Version 4. After that, go to Properties again and select “Obtain an IP address automatically” and “Obtain DNS server address automatically” in the next window (if these options aren’t already selected).

    Finally, go to Advanced > DNS, delete anything that might be in the DNS server addresses list, and click OK on everything.

    4 1024x431

    Go back to Run, type the line shown below in it, and hit Enter to go to the corresponding system settings section.

    • msconfig

    Once you see System Configuration, click Startup, uncheck anything that may have an unknown manufacturer according to the list as well as any item you may not recognize and then click OK.


    For a third time, use Run to go to this file:

    • notepad %windir%/system32/Drivers/etc/host

    When the file opens, take a look at what’s written inside it, right below the two “Localhost” lines. If any text is there (including any IP addresses), it must be copied and sent to us in the comments. We will then have a look at your comment and tell you if what you’ve sent us indicates that the file has been hijacked by the rogue software, in which case you would have to delete that text from the file.

    On the other hand, if “Localhost” is the last thing written in that file, you should directly proceed to the 5th step of this guide.


    Step 5

    Now you must go to the Registry Editor – search for the regedit.exe app in the Start Menu and open it, then click Yes, and the Registry Editor should appear on your screen. Once it does, press Ctrl and together to evoke the search bar of the Editor and use that search bar to look for WebAdvisor items in the Registry. Delete every item that gets found and repeat the search after every deletion to see if there are more items related to the hijacker.

    Once you are no longer finding any WebAdvisor by McAfee virus items in the Registry, use the panel to the left to visit the directories shown below:

    • HKEY_CURRENT_USER/Software/Random Directory
    • HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run
    • HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main

    In each of them, look for items with randomly-generated names similar to this “238ry3ud9238ur98tu984ty9842yf982ud9823ut98hgd892” – anything that has a name that looks like this must be deleted. Still, if you are uncertain, we strongly recommend that you first consult us using the comments section on this page.

    Step 6

    Finally, it is time to clean your browsers. Start with the main one by right-clicking its icon, selecting the Properties option, going to Shortcut, and deleting anything in the Target field that’s written past “.exe“.

    You must then start that browser, click its menu (browser menus are typically indicated by a small icon in either upper corner of the browser’s window), and open the Extensions/Add-ons section. Users who are with the Chrome browser must first select More Tools from the browser menu to reveal the Extensions option.

    When you get to the Extensions/Add-ons page, look for the WebAdvisor by McAfee virus extension or for any other extensions that may be unwanted, disable them, and then select the Remove button.

    7 1024x482

    Select the browser menu again, select the Settings or the Options button, depending on which browser you are currently using.

    Next, go to Privacy and Security (you might need to select Advanced to reveal the Privacy and Security section) and then find and click on a button labelled Clear browsing data (or Choose what to clear if you are in Microsoft Edge).

    8 1024x508

    In the Clear browsing data window, put ticks in all boxes except the one for your Passwords and then select Clear data to start the deletion process – it may take several minutes if this hasn’t been done recently.


    Once you are finished with your main browser, remember to repeat the current step for every other browser on your computer.

     If you are still having problems with WebAdvisor by McAfee virus

    If WebAdvisor by McAfee virus is still being a nuisance, then it may be time to try more drastic measures. One option is to take the computer to an IT professional, but since this can be very time-consuming, another variant is to try cleaning the system with a specialized program that can find and delete everything from WebAdvisor by McAfee virus that’s still in your system and browsers. As was mentioned earlier on this page, there is one such powerful tool available here that can help you clean your computer and browsers, so consider giving it a try if you are still getting bothered by this unpleasant hijacker.


    About the author


    Brandon Skies

    Brandon is a researcher and content creator in the fields of cyber-security and virtual privacy. Years of experience enable him to provide readers with important information and adequate solutions for the latest software and malware problems.

    Leave a Comment

    Buy SpyHunter now and remove any malware immediately

    Remove Now

    $7 / Month          $4.69 / Month*

    33% off expires in


    *Regional prices may vary.