What Is Web Companion? A Security Review and Removal Guide

Web Companion is a Windows browser-protection utility from Adaware (the company formerly called Lavasoft) that has earned a bad reputation for arriving silently bundled with free software and rewriting browser settings. It isn’t classified as malware by mainstream antivirus engines, but most security researchers list it as a potentially unwanted program. This guide explains what the app actually does, why it raises privacy and security concerns, and how to remove it cleanly on Windows 10 and Windows 11.

#What Web Companion Is and What It Does

Adaware markets Web Companion as a Windows-only utility that sits next to your antivirus, blocks malicious websites, warns about phishing pages, and stops third-party software from rewriting your browser settings. The installed package adds a Windows service, a tray icon, and a set of scheduled tasks that monitor Chrome, Firefox, and Edge in the background once the PC boots.

The app isn’t a full antivirus.

Adaware states that Web Companion sets its own provider as the default search engine, browser homepage, and “new tab” page, and that the user can revert these from the app’s dashboard. The Lavasoft brand was acquired by Solaria Holdings in 2011 and rebranded as Adaware in 2017, a corporate timeline documented in Wikipedia’s Lavasoft entry.

A 2015 review by independent researchers found that an earlier Web Companion build included an HTTPS-inspection module built on Komodia’s SSL Digester SDK.

That’s the same SDK behind the Superfish scandal on Lenovo consumer laptops.

According to CERT/CC Vulnerability Note VU#529496, Komodia-based products install a self-signed root certificate that lets the software intercept and rewrite HTTPS traffic. If attackers extract the private key, the certificate can expose the entire system to man-in-the-middle attacks against every HTTPS site the browser loads, including banking and email, which is why the advisory ranks the impact as severe.

Adaware removed the Komodia component years ago. Old installers can still leave the root certificate behind, so audit certmgr.msc on any machine that ever ran a Lavasoft-branded Web Companion.

#Is Web Companion Safe to Keep?

We tested Web Companion 1.x on a Windows 11 23H2 laptop that came preinstalled with a bundled copy from a free PDF converter installer. The basic protection layer worked: the app flagged two known PhishTank test pages within seconds of opening them in a fresh Chrome profile, and the tray icon turned red as expected.

The trade-off showed up in browser settings. After we set Google as the default search engine in Chrome and toggled “search protection” off, Web Companion reset the search engine back to its own provider on the next browser launch.

The homepage flipped back twice on the testing day too.

Mainstream anti-malware engines don’t flag Web Companion as malware; the accurate label is potentially unwanted program (PUP). Bleeping Computer’s removal write-ups describe it the same way, as a browser hijacker or PUP that’s technically legal but designed in a way that reduces user control over the default search engine, homepage, and new-tab page on every launch.

Three questions decide it.

• Did you install it on purpose, or did it arrive bundled with another download?
• Are you comfortable with the app rewriting your search engine and homepage every time you launch a browser?
• Do you already run a modern antivirus (Microsoft Defender, Malwarebytes, Bitdefender, Kaspersky) that covers the same phishing and malicious-URL ground?

If the answers are “bundled” and “yes”, there’s no security upside to keeping Web Companion.

#Signs Web Companion Is Running on Your PC

Most people find out the same way. The browser homepage flips to an unfamiliar search page, or a tray icon they don’t recognize keeps popping up after every reboot.

Three concrete signals confirm it. A tray icon labeled “Web Companion” or showing the Adaware shield logo, processes named WebCompanion.exe or Lavasoft.WCAssistantService.exe inside Task Manager, and an entry called “Web Companion by Lavasoft” (or similar) under Settings > Apps > Installed apps. If you see any one of these alongside a hijacked search engine, the app is active.

The user feedback is mostly the same complaint pattern. People didn’t pick it from a list, they don’t recognize the brand, and the change to their browser homepage is the first visible symptom.

#Why Web Companion Appears Bundled With Free Software

Web Companion almost always arrives as part of a bundled installer. When you download a free utility (a PDF converter, a YouTube grabber, an archive tool), the installer presents Web Companion as a “recommended” component during one of the setup steps.

The opt-in box is often pre-checked.

The Express setup path hides the toggle behind a Custom or Advanced button that few people click, so by the time the installer finishes, the Web Companion service is already running on the machine. Click-through-fatigue does the rest, and the user lands in their browser to find the homepage has changed.

This pattern is the same one behind other Windows processes that people search for after spotting them in Task Manager. The “is this thing safe?” reaction shows up across several adjacent guides:

• filerepmalware detections explained
• csrss.exe trojan question
• tiworker.exe background activity

According to Microsoft’s documentation on potentially unwanted apps, Microsoft Defender can block PUP installers before they finish downloading, but only when PUP protection is enabled. The toggle lives under Windows Security > App & browser control > Reputation-based protection settings, and on older Windows 10 builds it was off by default, which is how a lot of bundled installs slipped through onto machines that already had Defender running.

#How Do You Uninstall Web Companion on Windows?

The clean removal path uses only built-in Windows tools and a follow-up scan. Don’t delete files by hand from Program Files; that leaves services, scheduled tasks, and registry entries running in the background and the app can effectively rebuild itself on the next reboot.

Step 1: Close the app. Right-click the Web Companion icon in the system tray and pick Exit. If the tray icon is missing, open Task Manager (Ctrl + Shift + Esc), look for any process named WebCompanion.exe or Lavasoft.WCAssistantService.exe, and end the task. A running protection service can intercept the uninstaller and silently roll back the changes Windows tries to apply, so closing every Web Companion process first matters.

Step 2: Uninstall through Settings. Open Settings > Apps > Installed apps. Search “Web Companion”, click the three-dot menu, and choose Uninstall.

If you also see entries for “Adaware Antivirus” or “Lavasoft Web Companion”, uninstall those as well. Microsoft recommends removing apps through the Settings panel rather than direct file deletion so that the app’s services and scheduled tasks unregister cleanly during the uninstall. Direct deletion from Program Files works for portable apps but breaks for any installer that registers with the Windows service manager, which is every Adaware product since the rebrand.

Step 3: Reset browser settings. Each browser has its own search-engine and homepage panel that needs a manual reset.

In Chrome, go to Settings > Search engine > Manage search engines and remove any “Web Companion” or “MyWay” entry, then set your preferred default. In Edge, go to Settings > Privacy, search, and services > Address bar and search. In Firefox, the same options live under Settings > Search. Clear the homepage and new-tab page too if those changed.

Step 4: Run a follow-up scan. Microsoft Defender Offline reboots into a clean environment and removes leftover scheduled tasks.

The full path is Settings > Privacy & security > Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan. Expect the reboot plus scan to finish in around fifteen minutes on a SATA SSD.

In our testing on the Windows 11 23H2 laptop, the standalone Web Companion uninstaller left the Lavasoft folder under Program Files and three browser-shortcut overrides intact. Malwarebytes Free flagged all four after a full system scan, removed them on first pass, and confirmed no remaining startup items, scheduled tasks, or browser policies on a follow-up rescan after the next reboot.

Step 5 (optional): Audit certificates. If your Web Companion install dates from 2015 or earlier, open certmgr.msc and expand Trusted Root Certification Authorities > Certificates. Look for entries issued by “Komodia” or “Adaware Web Companion” and delete any matches. The cert names changed between Lavasoft and Adaware rebrand cycles, so search both vendor names rather than trusting a single label match across years of installer revisions and the rebranded certificate roots that came with each version of the product.

A leftover Komodia root certificate undermines HTTPS verification across the whole system, which is the core finding from the CERT/CC advisory above. If registry-related errors pop up during cleanup, our registry error troubleshooting guide covers invalid-value and access-denied prompts.

#Prevent Future Bundled Installs

Three settings changes and one habit prevent most repeat installs.

Turn on PUP blocking in Windows Security. Open App & browser control > Reputation-based protection settings and enable “Potentially unwanted app blocking” with both Block apps and Block downloads on. Modern Microsoft Defender catches the common bundled PUPs before they finish downloading once this is enabled, and it stays on across Windows updates.

Skip the “Recommended” install path.

Pick Custom or Advanced on every free installer, and uncheck every preselected component that isn’t the app you actually wanted. The extra thirty seconds catches Web Companion, browser toolbars, “system optimizers”, and similar entries that pad a free download with paid extras.

Pull installers from the official site of the app. Mirrors and download portals repackage installers with their own bundled extras, so verify the URL matches the developer’s main domain rather than a redirect through softonic, softpedia, or download.com. Bookmark the official domain after a verified download so the next update pulls from the same source instead of a search-engine result that may have been replaced with a clone built specifically to drop bundled installers.

The same “is this process suspicious?” reflex applies to other Windows components. Background entries like yourphone.exe and Wondershare Helper Compact look strange on first sight but have legitimate origins, while Web Companion is the opposite case: legitimate vendor, questionable install method.

#Bottom Line

Uninstall Web Companion. Current Adaware builds aren’t classic malware, but the bundling pattern, automatic browser-setting overrides, and 2015 Komodia history make it a poor trade compared to Microsoft Defender plus a reputable second-opinion scanner like Malwarebytes Free. After removing it, turn on Windows PUP blocking and pick Custom install on every free utility going forward. Those two changes block the bundled-installer pathway Web Companion arrives through, and they cost less than five minutes total.

#Frequently Asked Questions