What is

Finding in your Mozilla Firefox, Google Chrome, and Internet Explorer can mean only one thing: Your system has been infected by a browser hijacker. However, if this infection is present on your computer, it is quite likely that you will also find other malicious programs on your PC. This hijacker may not be the biggest threat you have ever met but it can still introduce you to potentially unsafe third-party web content. One click on the wrong content could lead to additional malware infections or online scams that can end very badly for you. If it is important for you to feel secure in your virtual world, we advise you to remove as soon as possible. For more details, please go on reading our report to learn how you can avoid such an attack and what you can do now to put an end to this one.testtest

Where does come from?

There is practically no chance that you install this Russian language browser hijacker in official ways from authentic promotional websites. It is quite likely that it sneaks onto your system in questionable ways. You may want to download a free file or software and search the web to find a page where you can download it. However, what you may not know is that even reputable search engines, such as Google, Yahoo, and Bing can display potentially unreliable and downright malicious file-sharing websites right on the first results page. Cyber criminals know what they are doing and they also know how to catch potential victims and how to appear in search engines when the trigger keywords are used. The worst that can happen is that you end up on a file-sharing website you are not familiar with. If it is a malicious page, every single click on its contents could drop infections onto your system or open malicious pages in new tabs. Most of the time you do not even drop one single threat but a whole bundle of them.

It is enough for you to click on one of the 3 to 4 download buttons, a flashy third-party ad, or a fake banner notification that warns you to use a VPN program to stay hidden while you are visiting such sites. A bundle can contain practically any kind of malicious software installers, including adware programs, browser hijackers, fake alerts, Trojans as well as potentially unwanted programs. Apart from visiting suspicious file-sharing pages, you can also be exposed to unsafe third-party ads if you land on online gambling, gaming, dating, and porn-related pages. We also need to mention the possibility that your computer may have been infected previously and, for example, an adware application shows you the corrupt third-party ad while you are browsing the web peacefully. It should be clear by now that even if you delete, your system will not be entirely clean and secure. Therefore, you should also apply a trustworthy malware scanner to see how bad the malware situation is on your PC.

How does work?

According to our malware researchers at, this infection is a new version of the infamous .This browser hijacker mainly changes your home page settings in the affected browsers, Mozilla Firefox, Google Chrome, and Internet Explorer. However, this particular infection is more persistent than most of its peers as it uses WMI (Windows Management Instrumentation) subscription to change the Target lines of your browser shortcuts. In other words, this means that even if you realize the unfavorable home page change and want to modify it, you will fail every time because you cannot remove that simply. This hijacker may set either or as your home page. This Russian search page is rather annoying with its potentially harmful third-party ads and the overcrowded page layout. You can find a line of thumbnail links to the most popular websites, such as Amazon, Dell, ebay, Walmart, and LinkedIn. In addition to these, you can also see a panel of 28 online game thumbnail links that lead to a questionable website ( that displays annoying and potentially unreliable third-party ads. If you are a security-minded user, you would want to delete from your system just by looking at it at the first time.

The search engine redirects all your searches to another unreliable search engine, It is possible that by using this search website you could be exposed to harmful third-party content in the form of third-party ads and sponsored links. If you engage with any of these, you could infect your system with additional malware threats or become the next victim of online scams. Therefore, we advise you to remove ASAP.

How do I delete

As we have mentioned, it is not too easy to eliminate this browser hijacker fully. Nevertheless, we have included the necessary step-by-step instructions for you if you want to manually put an end to this infection. If you follow these steps carefully, you can remove without a trace even if you are not an expert. But we also know that there are users who would prefer something automatic instead. Thus, we recommend that you apply a reliable anti-malware program (e.g., SpyHunter) to tackle all your current and future system security-related issues.

Restore your Target lines

  1. Right-click on the browser shortcut on your desktop.
  2. Select Properties and go to the General tab.
  3. Make sure that Read-only is unchecked.
  4. Switch to the Shortcut tab and delete the added string in the Target line after the quotes. Click OK.
  5. Right-click on the shortcut on your Taskbar to display the menu.
  6. Right-click on the browser name option at the bottom.
  7. Repeat steps 2 to 5 to restore the Target line.

Remove from Windows

  1. Press Win+Q and enter “cmd”.
  2. Right-click on the Command Prompt link below and select the “Run as administrator” option.
  3. Enter these commands on separate lines and hit the Enter key after both lines to execute:
    “wmic/namespace:\\root\subscription PATH__EventConsumer delete”
    “wmic/namespace:\\root\subscription PATH__EventFilter delete”
  4. Close the Command Prompt.
  5. Tap Win+R and enter regedit. Press OK.
  6. Remove the following registry keys:
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YeaDesktop (64-bit)
  7. Exit your editor.
  8. Tap Win+E to launch the Windows File Explorer.
  9. Bin the following folders:
    %ALLUSERSPROFILE%\Start Menu\Programs\YeaDesktop
    %APPDATA%\Microsoft\Windows\Start Menu\Programs\YeaDesktop
    %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\YeaDesktop
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\YeaDesktop
    %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\YeaDesktop
    %PROGRAMFILES(x86)%\YeaDesktop (64-bit)
  10. Empty your Recycle Bin and reboot your PC. 100% FREE spyware scan and
    tested removal of*

Leave a Comment

Enter the numbers in the box to the right *