---
metadata:
  - name: generator
    content: Diplodoc Platform v5.50.6
alternate:
  - https://yandex.com/support/common/en/security/rescue-tool.md
  - https://yandex.com/support/common/ru/security/rescue-tool.md
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.com/support/common/en/llms.txt

# Protection against unwanted software

When you download torrent clients, add-ons, and other programs from suspicious sites that distribute pirated content, unwanted programs can be installed on your computer without your knowledge. They're not viruses, but they can slow down your browser, install additional toolbars without your consent, and redirect you to fraudulent, phishing, or advertising sites.


{% cut "**How to remove unwanted software**" %}


Check your system with another antivirus utility, such as [Dr.Web CureIt!](https://free.drweb.com/?lng=en) or [Kaspersky Virus Removal Tool](https://support.kaspersky.com/kvrt2020).

If unwanted software wasn't found or some malicious programs weren't removed, run the cleanup again.

If you repeated the cleanup and no unwanted programs were detected or removed but you're sure that the computer is at risk, try using [free antiviruses](https://yandex.com/support/common/en/security/antiviruses-free.md) or contact support.


{% endcut %}

{% cut "**Dangers of unwanted software**" %}



{% cut "**Modified system startup parameters (StartPage)**" %}


The unwanted program adds an [address](https://en.wikipedia.org/wiki/URL) of an ad site that mimics a popular internet service to the [system registry](https://en.wikipedia.org/wiki/Windows_Registry). The key with the address is added to the section where licensed software is registered for [autorun](https://en.wikipedia.org/wiki/AutoRun).

As a result, the ad site opens up every time you restart the computer.

![](../_assets/threat-startpage.png)

{% endcut %}

{% cut "**A filter driver that shows unwanted content (Fake NetFilter)**" %}


The unwanted program is a filter driver that intercepts internet traffic to display intrusive and shocking ads in your browser, open ad tabs, redirect you to unwanted sites, or steal your personal data.


{% note info %}

The filter driver works in any browser and even when the browser is closed.

{% endnote %}



{% endcut %}

{% cut "**Infected DNS**" %}


The unwanted program changes the DNS settings.

When the user opens a webpage, the browser usually sends a request specifying the domain to a special [DNS server](https://en.wikipedia.org/wiki/Name_server), and the server responds with the domain's [IP address](https://en.wikipedia.org/wiki/IP_address).

Unwanted software changes the DNS server address in the system settings. As a result, all requests are sent to another server, which redirects the user to fraudulent, phishing, or ad pages.

![](../_assets/threat-infected-dns.png)

{% endcut %}

{% cut "**Unwanted software that modifies traffic (PBot)**" %}


The unwanted program runs every time the infected computer is turned on and monitors applications. When the user opens a browser, malware inserts its code into the browser process to redirect them to ad or [phishing](https://yandex.com/support/common/en/security/phishing.md#fake-sites) pages, change the [default search](https://yandex.com/support/common/en/browsers-settings/yandex-searches.md) settings, and steal their [personal data](https://yandex.com/support/common/en/security/phishing.md).


{% endcut %}

{% cut "**Infected hosts**" %}


The [hosts](https://en.wikipedia.org/wiki/Hosts_(file)) system file, which is stored in the `C:\Windows\System32\drivers\etc` folder, contains a list of site domain addresses and their corresponding [IP address](https://en.wikipedia.org/wiki/IP_address).

Malware can add wrong addresses to the `hosts` file, blocking access to popular sites, redirecting you to phishing pages, or disabling browser security features.

![](../_assets/threat-infected-hosts.png){.border-yes}

If you use Windows, here's what you can do to cure your device:

1. Run Notepad as an administrator (to do this, right-click the program shortcut and select **Run as administrator**).
1. Open the `C:\WINDOWS\system32\drivers\etc\hosts` file in Notepad.
1. Delete all lines except `127.0.0.1 localhost` from the file and save the changes.


{% endcut %}

{% cut "**Unwanted extensions**" %}


The program secretly installs malicious extensions that open ad tabs in the browser, show intrusive and shocking ads, or steal your [personal data](https://yandex.com/support/common/en/security/phishing.md).

Antiviruses are bad at recognizing malicious extensions. This is because all extensions work inside the browser and don't affect the computer's operating system.

It's best to install extensions from [Opera Add-ons](https://addons.opera.com/en/extensions) or [Chrome Web Store](https://chrome.google.com/webstore/category/extensions), where they're tested for malware.

To check extensions that are installed in browsers:

1. Click the menu button in the browser and select the extensions menu item (depending on the browser, it may be called **Additions**, **Additional tools**, **Extensions**, or **Add-ons**).
1. Remove strange extensions.


{% note info %}

If you aren't sure whether the problem is caused by an extension, try disabling extensions one at a time and refreshing the page (**Ctrl** + **R**). If the problem disappears after you disable an extension, it means that the extension causes the problem and needs to be removed.

{% endnote %}



{% endcut %}

{% cut "**Modified browser shortcuts (Infected LNK)**" %}


The unwanted program changes the browser launch shortcut, adding new parameters (most often, a site address) or launching another app instead of the browser. As a result, ad pages open at every launch.

To check the shortcut properties:

1. Right-click the shortcut and select **Properties**.
    
1. Make sure that the **Target** line only contains the path to the browser's executable file.
    
    Example:
    ```
    C:\Program Files\Google\Chrome\Application\chrome.exe
    ```
    
1. If the **Target** line includes a path to an unknown file after a space, delete it and click **OK**.
    
    Example:
    ```
    C:\Program Files\Google\Chrome\Application\chrome.exe load-and-launch-app=C:\Users\user\AppData\Local\Google\Chrome\UserData\Default\def_apps\ipcleopmlacobpjligchhkpongdjlfjh\35.0_0
    ```
    
    ![](../_assets/threat-infected-lnk.png){.border-yes}

{% endcut %}

{% endcut %}

<style scoped>
.yfm .border-yes {
    border: 1px solid #ccc;
}