Home Malware Programs Browser Hijackers YinStart

YinStart

Posted: March 28, 2006

This browser hijacker changes the default Internet Explorer start page to www.1yin.com and sends a web browser to certain sites without asking for user permission. YinStart installs its files into the main Windows directory and alters the registry, so it could run on every computer startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 smss.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainStartPage=http://www.1yin.comHKEY_CURRENT_USERSoftwareMicrosoftWindowsNTCurrentVersionWindowsRun=%Windir%smss.exeHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicessmss.exe=%Windir%smss.exeHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunsmss.exe=%Windir%smss.exe
Loading...