Yontoo Adware

Yontoo Adware Description

Yontoo is a browser add-on for multiple types of web browsers (including Internet Explorer and Chrome) that adds a self-described 'virtual graphic layer' on top of normal web pages. In most cases, this is used to enable certain types of content for the Facebook website, but in some scenarios, Yontoo may deliver irrelevant content such as advertisements that interfere with web-browsing due to their sheer numbers. Although malware researchers haven't noted any characteristics that would indicate that Yontoo is a serious security threat to your PC, you may wish to be cautious about installing Yontoo and remain alert for potentially negative content that Yontoo may display in your web browser. If you'd like to remove Yontoo from your computer, it's recommended that you use anti-malware software to insure the complete removal of all of Yontoo's components.

Why Yontoo Gives You Reasons to Rage Against the Machine

Yontoo's browser-specific toolbar is marketed by the name PageRage, and must be downloaded manually to be installed on your PC. In most cases, installations of Yontoo occur after you install a related Facebook application that requires Yontoo technology. Yontoo can be used to deliver benign or harmless content, and malware researchers haven't found any indications that Yontoo will directly attack your PC with the consent of the Yontoo company. Unfortunately, Yontoo also has a seedier side, as noted below.

Along with its appealing features, Yontoo also may degrade the performance of your PC and use up a significant amount of bandwidth to perform its constant website-layering functions. Yontoo may also be used to display advertisements, sponsored offers, links to unusual sites and other forms of content that aren't related to your interests. Yontoo is capable of displaying this content in excessive quantities that actually harm your ability to interact with real website content.

Why Yontoo's Past Should Be of Concern in the Present

Although there have never been reports of serious Yontoo attacks or exploits, nonetheless, widespread and unwanted propagation of Yontoo was reported early in 2012. This indicates that Yontoo is still being packaged with other Facebook applications and, although Yontoo still requires your consent to be installed, may be installed in a somewhat misleading or unnoticeable manner. As long as you pay close attention to installation-related messages when installing browser add-ons or Facebook apps, your computer should be safe from unwanted Yontoo installations.

Yontoo should be easy to detect in your web browser due to its highly-visible symptoms, but we don't recommend that you try to delete Yontoo by its included removal features. Toolbars that are linked to Yontoo have been known to be difficult to remove completely, and scanning your PC with a qualified anti-malware program is likely to be the most expedient solution to a Yontoo problem.

Aliases


TROJ_GEN.RCBH1C7Generic5.FR [AVG]Adware/Gaba [Fortinet]AdWare.Win32.Gabpath [Ikarus]Win32:Gabpath-OY [GData]Troj/DwnLdr-JYF [Sophos]Artemis!C03154CDDB74 [McAfee-GW-Edition]TR/ATRAPS.Gen2 [AntiVir]Adware.Win32.GabaAdWare.Win32.Gabpath!IKnot-a-virus:AdWare.Win32.Gaba.njw [Kaspersky]Win32:Gabpath-OY [Adw] [Avast]Adware.Gaba!QngOsncZpnkunknown virus Win32/DH{DwNh} [AVG]W32/AutoRun.HLP!worm [Fortinet]
More aliases (391)

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Yontoo Adware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\Yontoo\Y2Desktop.Updater.exe File name: Y2Desktop.Updater.exe
Size: 23.55 KB (23552 bytes)
MD5: 24fb8db6d1d55e2c5d0a53dfe48e6af8
Detection count: 7,567
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Yontoo\
Group: Malware file
Last Updated: January 27, 2020
%APPDATA%\Yontoo\YontooDesktop.exe File name: YontooDesktop.exe
Size: 42.78 KB (42784 bytes)
MD5: b67c31c0e28830be1f2e564ef684a138
Detection count: 1,157
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Yontoo\
Group: Malware file
Last Updated: April 18, 2013
%WINDIR%BOX_cFosTASK.exe File name: BOX_cFosTASK.exe
Size: 405.21 KB (405218 bytes)
MD5: d692a04e3b0fa1db641ef237fa2ef2e2
Detection count: 506
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: January 19, 2020
%APPDATA%\Yontoo\dat\cst.exe File name: cst.exe
Size: 13.31 KB (13312 bytes)
MD5: ab0f942b8a465c2e4399167537bccd7f
Detection count: 494
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Yontoo\dat\
Group: Malware file
Last Updated: January 24, 2020
%PROGRAMFILES(x86)%\Yontoo\OptChrome.exe File name: OptChrome.exe
Size: 133.63 KB (133632 bytes)
MD5: 0d510b5136682baf10782e230c5d285f
Detection count: 215
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Yontoo\
Group: Malware file
Last Updated: March 26, 2016
%TEMP%Soundfx .exe File name: Soundfx .exe
Size: 1.59 MB (1590784 bytes)
MD5: b218fbe9034245e70ac091167eea7b96
Detection count: 176
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: December 18, 2012
%USERPROFILE%\Desktop\iExplore.exe File name: iExplore.exe
Size: 780.28 KB (780283 bytes)
MD5: ea5d533ede0a185245cc754e744bbd3a
Detection count: 138
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Desktop\
Group: Malware file
Last Updated: January 26, 2020
%USERPROFILE%\My Documents\YontooClientSetup.Exe File name: YontooClientSetup.Exe
Size: 554.1 KB (554104 bytes)
MD5: fa83259165c4d0c68a3ccf346093e78e
Detection count: 119
File type: Executable File
Mime Type: unknown/Exe
Path: %USERPROFILE%\My Documents\
Group: Malware file
Last Updated: March 26, 2016
%APPDATA%SoundcardAudiocodec.exe File name: SoundcardAudiocodec.exe
Size: 643.07 KB (643072 bytes)
MD5: 7beac080a6ea9eee6ae67da366bf0005
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 18, 2012
%LOCALAPPDATA%\WideSearch\wsearch.exe File name: wsearch.exe
Size: 419.84 KB (419840 bytes)
MD5: 66529767fe6f9d9c2eb617a733e64c53
Detection count: 47
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\WideSearch\
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Microsoft\Windows\Templates\spsreng.exe File name: spsreng.exe
Size: 8.19 KB (8192 bytes)
MD5: 07f9bf43264060abcd3bb1686b78b66d
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Templates\
Group: Malware file
Last Updated: December 18, 2012
%SystemDrive%\RECYCLER\S-1-5-21-2626416508-434419615-3162726493-1006\$e147bd530acf0dfb79a40265a25de046\n. File name: n.
Size: 51.2 KB (51200 bytes)
MD5: f76f11e753ae6353f56be5b7c0e18d12
Detection count: 42
Path: %SystemDrive%\RECYCLER\S-1-5-21-2626416508-434419615-3162726493-1006\$e147bd530acf0dfb79a40265a25de046\
Group: Malware file
Last Updated: December 18, 2012
%WINDIR%\System32\PSEXESVC.EXE File name: PSEXESVC.EXE
Size: 61.44 KB (61440 bytes)
MD5: 4849b669497c3359e5f09e3613cd7e2f
Detection count: 37
File type: Executable File
Mime Type: unknown/EXE
Path: %WINDIR%\System32\
Group: Malware file
Last Updated: November 18, 2019
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\AAD8VVY1\YontooUninstaller.exe File name: YontooUninstaller.exe
Size: 523.55 KB (523552 bytes)
MD5: f473f6e32b773edee97950d2746fd088
Detection count: 35
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\AAD8VVY1\
Group: Malware file
Last Updated: March 26, 2016
%APPDATA%\Blammi\Blammi.exe File name: Blammi.exe
Size: 1.68 MB (1687552 bytes)
MD5: c03154cddb74ccdda551fbbb80628605
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Blammi\
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%dwm.exe File name: dwm.exe
Size: 1.27 MB (1270272 bytes)
MD5: f80eb5a04e2d6cfaa149011df1367c19
Detection count: 20
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\PhrozenSoft\DCLegacyViewer\DCModule.exe File name: DCModule.exe
Size: 1.08 MB (1089024 bytes)
MD5: acd33a57f6bbc9cfdd729fce6fd16387
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\PhrozenSoft\DCLegacyViewer\
Group: Malware file
Last Updated: January 26, 2020
c:\directory\CyberGate\install\TEST123.exe File name: TEST123.exe
Size: 16.38 KB (16384 bytes)
MD5: bf96ec1265858f2fd625fde9676df9cb
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: c:\directory\CyberGate\install\
Group: Malware file
Last Updated: September 18, 2018
%USERPROFILE%\Desktop\EZ_Sirefix.exe File name: EZ_Sirefix.exe
Size: 2.03 MB (2033481 bytes)
MD5: 9eef4ef1cf01c5a6567776a77079230a
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Desktop\
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Microsoft\Windows\Templates\mscorlib.exe File name: mscorlib.exe
Size: 10.75 KB (10752 bytes)
MD5: 4ff56eb620defbbdbc13ff75708c1d81
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Templates\
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\winhost\winhost.exe File name: winhost.exe
Size: 58.36 KB (58368 bytes)
MD5: 20c02c85181c98b3f136fba654ade5d6
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\winhost\
Group: Malware file
Last Updated: December 18, 2012
%WINDIR%\SysWow64\config\systemprofile\appdata\roaming\adobe\sp.dll File name: sp.dll
Size: 160.25 KB (160256 bytes)
MD5: 7cc0fad47e5f5d329394e76935dcc0b0
Detection count: 12
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\SysWow64\config\systemprofile\appdata\roaming\adobe\
Group: Malware file
Last Updated: December 18, 2012
%PROGRAMFILES%\ESET\TNODUP.exe File name: TNODUP.exe
Size: 1.89 MB (1892352 bytes)
MD5: 61f4456f9848da1f5385799415ff8e69
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\ESET\
Group: Malware file
Last Updated: November 9, 2019
%WINDIR%\system32\4092\svchost.exe File name: svchost.exe
Size: 474.62 KB (474624 bytes)
MD5: 9583aab3a301b59ff22e0de96f776931
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32\4092\
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%SpotifyGenerator(2).exe File name: SpotifyGenerator(2).exe
Size: 16.38 KB (16384 bytes)
MD5: b83c4a29a048ae5c9e0376272820bd71
Detection count: 1
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 18, 2012
%CommonAppData%\Temp\YontooTix2700750.log File name: %CommonAppData%\Temp\YontooTix2700750.log
Mime Type: unknown/log
Group: Malware file
%CommonAppData%\Yontoo Layers\YontooIEClient.dll File name: %CommonAppData%\Yontoo Layers\YontooIEClient.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\Yontoo Layers Runtime\YontooIEClient.dll File name: %ProgramFiles%\Yontoo Layers Runtime\YontooIEClient.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\YontooFFClient.xpi File name: %Temp%\YontooFFClient.xpi
Mime Type: unknown/xpi
Group: Malware file
%Temp%\YontooIEClient.dll File name: %Temp%\YontooIEClient.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\YontooLayers.crx File name: %Temp%\YontooLayers.crx
Mime Type: unknown/crx
Group: Malware file
%Temp%\YontooLayers.pem File name: %Temp%\YontooLayers.pem
Mime Type: unknown/pem
Group: Malware file
%Temp%\YontooSetup-Silent.exe File name: %Temp%\YontooSetup-Silent.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
OptChrome.exe File name: OptChrome.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications


The following newly produced Registry Values are:

CLSID{1AD27395-1659-4DFF-A319-2CFA243861A5}{7E84186E-B5DE-4226-8A66-6E49C6B511B4}{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}{99066096-8989-4612-841F-621A01D54AD7}{CFDAFE39-20CE-451D-BD45-A37452F39CF0}{D372567D-67C1-4B29-B3F0-159B52B3E967}{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}{FE9271F2-6EFD-44b0-A826-84C829536E93}Directory%ALLUSERSPROFILE%\9466af57-1f38-4973-ab1c-22f7e17e2d6a%ALLUSERSPROFILE%\Application Data\9466af57-1f38-4973-ab1c-22f7e17e2d6a%ALLUSERSPROFILE%\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}%ALLUSERSPROFILE%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}%APPDATA%\Yontoo%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc%ProgramFiles%\Yontoo%ProgramFiles%\Yontoo Layers Runtime%PROGRAMFILES(x86)%\Yontoo%ProgramFiles(x86)%\Yontoo Layers%PROGRAMFILES(x86)%\Yontoo Layers Runtime%TEMP%\YontooLayers%UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlcRegistry keySOFTWARE\Classes\AppID\YontooIEClient.DLLSOFTWARE\Classes\Wow6432Node\AppID\YontooIEClient.DLLSoftware\Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}SOFTWARE\Classes\YontooIEClient.ApiSOFTWARE\Classes\YontooIEClient.Api.1SOFTWARE\Classes\YontooIEClient.LayersSOFTWARE\Classes\YontooIEClient.Layers.1SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}SOFTWARE\Wow6432Node\Classes\AppID\YontooIEClient.DLLSOFTWARE\Wow6432Node\Google\chrome\Extensions\niapdbllcanepiiimjjndipklodoedlcSOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}SOFTWARE\Wow6432Node\Tarma Installer\Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}SYSTEM\ControlSet001\services\Yontoo Desktop UpdaterSYSTEM\ControlSet002\services\Yontoo Desktop UpdaterSYSTEM\CurrentControlSet\services\Yontoo Desktop UpdaterRegexp file mask%TEMP%\YontooFFClient.xpi%TEMP%\YontooIEClient.dll%TEMP%\YontooLayers.crx%TEMP%\YontooSetup-Silent.exeHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{889DF117-14D1-44EE-9F31-C5FB5D47F68B}Clsid{1AD27395-1659-4DFF-A319-2CFA243861A5}HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\YontooIEClient.DLL\"AppID" = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}\"Default" = "YontooIEClient"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9D9785E5-3424-40B6-A287-BA143AD53109}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{FC1DD4E4-688F-4E9B-BAE5-BFB6A956AE51}\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}"Default" = "1"

Additional Information

The following URL's were detected:
yontoo.com
Posted: February 17, 2012
Threat Metric
Threat Level: 2/10
Infected PCs 254,069
Home Malware Programs Adware Yontoo Adware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.