Remove Navigation.iwatchavi.com “Virus” from Chrome/Firefox

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.


This page aims to help you remove Navigation.iwatchavi.com. These Navigation.iwatchavi.com removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

Why Navigation.iwatchavi.com is not a “virus”?

Viruses are malicious programs, aimed at inflicting damage to your system, stealing personal data from your hard drive/online accounts and generally harming your PC and virtual security. Navigation.iwatchavi.com does not do any of that and therefore is not a computer virus. For the most part it doesn’t damage your system and it doesn’t extract information from your hard drive or any of your accounts. Some may argue that Navigation.iwatchavi.com may track and record your browser activity in order to later sell that data to third-party companies, thus generating revenue for its developers. This, however, happens quite rarely and even when it does, the information that Navigation.iwatchavi.com has access to, is very limited and can hardly be used to harm your privacy. That being said, we need to come up with another term for this program that would be better suited for its nature. This term is Browser Hijacker.

Why is Navigation.iwatchavi.com unwanted?

Browser Hijackers are generally considered unwanted programs, but unlike viruses, most of them are relatively harmless for your machine. As a matter of fact, the main reason why they are unwanted, is because of how annoying they can be. Their main purpose, once installed on your PC, is to flood your browser with various intrusive ads that heavily disrupt your browsing experience. For instance, if you have Navigation.iwatchavi.com on your PC and you open Mozilla (or Chrome or IE or any other browser) numerous pop-ups, banners and box messages mat start appearing on your screen. It doesn’t matter what page you are on – they are going to be everywhere. Due to the intrusive behaviour of those ads, many users start thinking that their computer has been infected by an actual virus.

Still, as annoying as they may be, Browser Hijackers programs such as Navigation.iwatchavi.com won’t do much, apart from constantly generating those obstructive adverts. An important thing to mention here is that you should never click on them. The reason for that is because some of those ads might redirect you to sites that are illegal or may land you more Browser Hijackers programs or even infect your machine with a virus. This may sound scary but in fact it happens quite rarely. For the most part these pop-ups are gonna be harmless, but there is no need for any unnecessary risks. Also clicking on them won’t gain you anything useful – usually you will get redirected to a site that you have visited earlier or to a page that is simply one big banner. Keep in mind that you could get redirected to another page even without clicking on those ads. If this happens, make sure to close the new page as quickly as possible, without interacting with it.

How did I land Navigation.iwatchavi.com?

There are several ways for it to happen. In this article we will cover the most common ones.

The first method for Navigation.iwatchavi.com distribution throughout the Internet is via spam e-mails. It is usually easy to avoid those e-mails, because they go directly to your spam folder. Still some of them might go into your mailbox, therefore it won’t hurt to double-check the name and title of the letter you’re about to open, before doing so.

Another method is through torrent sites and file-sharing websites. It is easy to see why this is a common way for Navigation.iwatchavi.com to get distributed. Often such sites aren’t strictly legal and one can easily upload content there. A good advice is to generally keep away from such places.

Probably the most common way for Navigation.iwatchavi.com to get installed on your machine is via other programs that can be downloaded for free. Free software is always appealing but often might lead to unforeseen consequences. In this case the intrusive software is bundled with the program you have downloaded and once you install that program, you also get the added content which might be Navigation.iwatchavi.com. This is effective because most people don’t pay much attention to the installation details. In fact, it is pretty easy to avoid landing the unwanted software if you just check what added content there is. In order to do so, opt for the advanced settings in the installation menu. There you should be able to choose which added features are going to be installed. Uncheck anything that looks suspicious. If you are not sure, just uncheck everything. Usually, there’s nothing that appealing and/or useful about those add-ons anyway. By following these instructions, you can be pretty sure, that you won’t have the unwanted program installed on your PC.

SUMMARY:

Name Navigation.iwatchavi.com
Type Browser Hijacker
Danger Level Medium (displays annoying ads that may disrupt your normal browsing experience, might track browser activity).
Symptoms Intrusive ads, box messages, banners that start popping up once you open your browser. Doesn’t matter which browser you’re using. 
Distribution Method Torrent or file-sharing sites; Spam e-mails; Bundling with free programs (most common distribution method)
Detection Tool Navigation.iwatchavi.com may be difficult to track down. Use SpyHunter – a professional parasite scanner – to make sure you find all files related to the infection.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

 

Remove Navigation.iwatchavi.com from Chrome/Firefox


Readers are interested in:

 

Step1

Reboot in Safe Mode (use this guide if you don’t know how to do it).

This was the first preparation.

Step2

WARNING!
To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Reveal All Hidden Files and Folders.

  • Do not skip this  – Navigation.iwatchavi.com may have hidden some of its files.

Hold together the Start Key and R. Type appwiz.cpl –> OK.

appwiz

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:

msconfig_opt

Startup —> Uncheck entries that have “Unknown” as Manufacturer.

Step3

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Step4

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

browser-hijacker-taskbar-properties

Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Navigation.iwatchavi.com from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Navigation.iwatchavi.com from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the Browser Hijackers/malware —> Remove.
chrome-logo-transparent-backgroundRemove Navigation.iwatchavi.com from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.

  • At this point the threat is gone from Chrome, but complete the entire guide or it may reappear on a system reboot.

Step5

Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are dangerous. Google them or ask us in the comments.

WARNING! READ CAREFULLY BEFORE PROCEEDING!

This is the most important and difficult part. If you delete the wrong file, it may damage your system irreversibly. If you can not do this,
>> Download SpyHunter - a professional parasite scanner and remover.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Right click on each of the problematic processes separately and select Open File LocationEnd the process after you open the folder, then delete the directories you were sent to.

malware-start-taskbar

Step6

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

Remember to leave us a comment if you run into any trouble!

Was this guide helpful?

  • HowToRemove.Guide Team

    Hi,

    It is hard to say without checking it out first. Can you post them (the IPs) here in the comments section?

     
  • HowToRemove.Guide Team

    Hi,

    Delete these entries.

     
  • HowToRemove.Guide Team

    Hello,

    You should remove these IPs.

     
  • Tarek

    I have the IP’s of down.baidu2016.com, 123.sogou..com, http://www.czzsyzgm.com, http://www.czzsyzxl..com, and union.baidu2019..com. Note that the two czzy ones are different near the end if you missed it. They all have the same ip adress too.

     
    • HowToRemove.Guide Team

      Hi Tarek, these sites are responsible for the advertisements you see on your screen. You should delete all lines with a chinese name from the hosts file.

      Let me know if you encounter any errors with saving the file afterwards.

       
  • HowToRemove.Guide Team

    Hi Sertac, do this:

    First search for Notepad in google search, right click on the executable and select run as admin. Open the program and navigate to the file from the open menu inside Notepad. You’ll now be able to save the changes.

     
    • Chandu

      How can i delete them ?

       
      • HowToRemove.Guide Team

        Hi Chandu, do this:

        First search for Notepad in google search, right click on the executable and select run as admin. Open the program and navigate to the file from the open menu inside Notepad. You’ll now be able to save the changes.

         
  • HowToRemove.Guide Team

    Hello Sertac,

    Can you tell us what steps from our guide you were successful in completing? Did you enter save mode?

     
  • HowToRemove.Guide Team

    Hello Sertac,

    there wouldn’t be any reason to uninstall Chrome if you have managed to successfully execute the step pertinent to Chrome.

     
  • HowToRemove.Guide Team

    Just to be clear, do you still have trouble with the iwatchavi issue? If this one has been resolved, what other problems remain?

     
  • HowToRemove.Guide Team

    Hi there, if its only this without any name attached to it you are good.

     
  • HowToRemove.Guide Team

    You still have something on your machine. Did you look in chrome add-ons? Can you try a different browser and check if you get iwatchavi too, so we can confirm its exclusive to chrome?

    It’s also possible your DNS settings have been messed with. Go to the settings of your Lan Adapter, choose properties and look for the IP4 menu. Do you have any fixed numbers written in the DNS field? If you have switch it to automatic instead.

     
    • Sertaç Yazgan

      Hopefully DNS was the problem… I correected it and nothing seems to come back for now but if there is anything wrong again I will post it…

       
    • Sertaç Yazgan

      Yes the DNS was altered, corrected it, done all the steps again, spyhunter again, came back again…. done trying sorry 🙁

       
      • HowToRemove.Guide Team

        Did you confirm it to be Chrome specific?

         
  • HowToRemove.Guide Team

    Hi Arnab, now you delete them from the file.

     
  • HowToRemove.Guide Team

    Hi Myrah, we have manual comment approval due to bot spam. All of these DNS are related to chinese sites that distribute advertisements. You should have them deleted.

     
  • HowToRemove.Guide Team

    Any entry that starts with 127.0.0.1 should be safe, as this effectively points to your own PC and shuts down access to the domain in question.

    Can you try checking up if your DNS has changed? You can look it up in your network adapter settings, IP4 protocol.

     
  • TexasLilly

    Thanks for the help.
    After “localhost” I get all this:

    127.0.0.1 down.baidu2016..com

    127.0.0.1 123.sogou..com

    127.0.0.1 http://www.czzsyzgm..com

    127.0.0.1 http://www.czzsyzxl..com

    127.0.0.1 union.baidu2019..com

     
    • HowToRemove.Guide Team

      Hi TexasLilly,
      these IPs are safe. Our team researched them and they turn out to be harmless. If you have any other questions, we will be glad to answer them.