9

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of https://www.google.com/webhp/... In addition, this only happens when searching from the Omnibox. Going to google.com and searching with the input field within the page creates a different URL.

Is this the result of some sort of virus? I've seen explanations for both sides. The explanations toward the malicious end suggest that it's because of the (possibly unintentional) installation of a "Conduit" search toolbar.

At any rate, I've checked all of my cookies, extensions, toolbars (none), registry, and installed programs as directed by various removal sites but nothing seems to suggest that I have this "Conduit" search bar or anything related.

Windows 7, Chrome 38

user2864874
  • 223
  • 1
  • 2
  • 4
  • so it can cause some kind of damage to my computer?! –  Jun 01 '16 at 13:47
  • 5
    I have removed the accepted answer here, as it was either deliberately hosting malware, or had been compromised. In either case, it was a bit spammy! – Rory Alsop Feb 26 '17 at 17:41

1 Answers1

10

No, it's not malicious.

From what I've looked into, it's rather widespread, and seen on PCs that have no indication of infection.

If you open Chrome and go to chrome://settings/searchEngines, you'll see the Query URL for Google. It'll probably look like "{google:baseURL}webhp/".

If it was going to a different domain, it might be worth more investigation, but your query is still going to Google's server. Unless Google's search was somehow compromised (seriously doubt it), you have nothing to worry about.

Please ignore the fearmongering from the general public. I've seen a ton of pages talking about the "webHP virus". These are unfounded, and written by people that don't understand what they're talking about.

Nick Simonian
  • 369
  • 2
  • 4