Do you know what Yeadesktop.com is?
While you may find Yeadesktop.com as a refreshing alternative to the likes of Google, Yahoo, and Bing, we want to warn you that it is not a real search engine. Our malware researchers have concluded that it is a highly malicious browser hijacker that is distributed in malicious ways and was designed to hijack your browser and its target line so that you would not be able to modify the homepage address line. It is unclear what its objective is, but research has shown that this malicious search engine redirects search queries to another search engine that might feature ads in the search results. Besides, Yeadesktop.com itself features many advertisements on it main page, so that could be the primary motivation for doing so.
According to our malware analysts, you can get Yeadesktop.com by downloading it from http://down.yeadesktop.com/YeaDesk/yeadesktop2{.}exe. However, the link is hidden, so you cannot access it if you do not have the full address. However, that is not how its developers distribute it anyway. Researchers say that it is bundled with malicious software installers and possibly several other third-party applications and put up for download on freeware websites. The owners of these sites get paid by developers of the bundled software for distributing it. So Yeadesktop.com might share its revenue with its promoters and distributers. Another important thing to note is that the installers might inject Yeadesktop.com into your browser without your knowledge or authorization. Researchers say that the program this hijacker comes is named 1.0.0.1 with a little icon of a present box.
If this application is installed, then it will replace your browser’s homepage address with Yeadesktop.com. It will do that provided that use Microsoft Internet Explorer, Google Chrome, or Mozilla Firefox. Moreover, it will not only change the homepage address but also prevent you from changing it back to its default setting. Researchers say that Yeadesktop.com is set to hijack the browser’s target line as well. The installer or accompanying program is set to inject the URL of this hijacker into the Target line. As a result, each time you open your browser, the homepage will be reset to Yeadesktop.com.
Yeadesktop.com screenshot
Scroll down for full removal instructions
Now let us talk about Yeadesktop.com itself. This search engine has many region-specific advertisements displayed on its main page. However, some of the ads that are embedded in the main page are named in the Cyrillic alphabet. Therefore, it is reasonable to assume that this hijacker comes from Russian. Nevertheless, one of the promoted websites that hosts games is hosted at Games.softgames.de. It redirects all search queries to a search engine called S.popular123.com which is an unknown and highly suspicious search engine. Researchers say that that its search results can feature promotional links that can redirect you to potentially malicious websites.
In closing, it is evident that Yeadesktop.com is an unreliable search engine that was created with the intention of forcing you to use it and, therefore, its developers have employed target hijacking to prevent you from replacing the homepage address. The developers want you to use this search engine to search the web and view this hijacker’s questionable ads. Therefore, to keep your computer out of harm’s way, we recommend that you remove this malicious search engine from your PC using the guide below.
Fix the Target line hijack
- Right-click the browser’s shortcut.
- Select Properties and open the Shortcut tab.
- Erase http://www.yeadesktop.com/ from the Target line.
- Erase --load-extension="C:\Users\user\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" http://www.yeadesktop.com/ from the Target line if you use Chrome.
- Click OK.
Remove malicious files
- Hold down Win+E keys.
- In the address box, type the following addresses an press Enter.
- %PROGRAMFILES(x86)%
- %PROGRAMFILES%
- %ALLUSERSPROFILE%\Start Menu\Programs
- %APPDATA%\Microsoft\Windows\Start Menu\Programs
- %USERPROFILE%\Microsoft\Windows\Start Menu\Programs
- %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs
- %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs
- Find YeaDesktop
- Right-click it and click Delete.
In non-techie terms:
Yeadesktop.com is a search engine that our malware analysts have classified as a browser hijacker due to how it is being disseminated. It is set to hijack your browser’s homepage address and make you use it to browse the web. However, since this hijacker features ads on its main page and probably in its search results, we recommend that you remove it from your pc as soon as the opportunity arises.