Yontoo Adware
Posted: February 17, 2012
Threat Metric
The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to
give every identifiable malware threat. Our Threat Meter includes several criteria based off of
specific malware threats to value their severity, reach and volume. The Threat Meter is able to give
you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count,
Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic
breakdown of how all threats are ranked within our own extensive malware database. The scoring for
each specific malware threat can be easily compared to other emerging threats to draw a contrast in
its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to
remove a threat or pursue additional analytical research for all types of computer users.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Ranking: | 4,255 |
|---|---|
| Threat Level: | 2/10 |
| Infected PCs: | 298,690 |
| First Seen: | August 17, 2010 |
|---|---|
| Last Seen: | March 3, 2025 |
| OS(es) Affected: | Windows |
Yontoo is a browser add-on for multiple types of web browsers (including Internet Explorer and Chrome) that adds a self-described 'virtual graphic layer' on top of normal web pages. In most cases, this is used to enable certain types of content for the Facebook website, but in some scenarios, Yontoo may deliver irrelevant content such as advertisements that interfere with web-browsing due to their sheer numbers. Although malware researchers haven't noted any characteristics that would indicate that Yontoo is a serious security threat to your PC, you may wish to be cautious about installing Yontoo and remain alert for potentially negative content that Yontoo may display in your web browser. If you'd like to remove Yontoo from your computer, it's recommended that you use anti-malware software to insure the complete removal of all of Yontoo's components.
Why Yontoo Gives You Reasons to Rage Against the Machine
Yontoo's browser-specific toolbar is marketed by the name PageRage, and must be downloaded manually to be installed on your PC. In most cases, installations of Yontoo occur after you install a related Facebook application that requires Yontoo technology. Yontoo can be used to deliver benign or harmless content, and malware researchers haven't found any indications that Yontoo will directly attack your PC with the consent of the Yontoo company. Unfortunately, Yontoo also has a seedier side, as noted below.
Along with its appealing features, Yontoo also may degrade the performance of your PC and use up a significant amount of bandwidth to perform its constant website-layering functions. Yontoo may also be used to display advertisements, sponsored offers, links to unusual sites and other forms of content that aren't related to your interests. Yontoo is capable of displaying this content in excessive quantities that actually harm your ability to interact with real website content.
Why Yontoo's Past Should Be of Concern in the Present
Although there have never been reports of serious Yontoo attacks or exploits, nonetheless, widespread and unwanted propagation of Yontoo was reported early in 2012. This indicates that Yontoo is still being packaged with other Facebook applications and, although Yontoo still requires your consent to be installed, may be installed in a somewhat misleading or unnoticeable manner. As long as you pay close attention to installation-related messages when installing browser add-ons or Facebook apps, your computer should be safe from unwanted Yontoo installations.
Yontoo should be easy to detect in your web browser due to its highly-visible symptoms, but we don't recommend that you try to delete Yontoo by its included removal features. Toolbars that are linked to Yontoo have been known to be difficult to remove completely, and scanning your PC with a qualified anti-malware program is likely to be the most expedient solution to a Yontoo problem.
Aliases
Generic5.FR [AVG]Adware/Gaba [Fortinet]AdWare.Win32.Gabpath [Ikarus]Win32:Gabpath-OY [GData]Troj/DwnLdr-JYF [Sophos]Artemis!C03154CDDB74 [McAfee-GW-Edition]TR/ATRAPS.Gen2 [AntiVir]not-a-virus:AdWare.Win32.Gaba.njw [Kaspersky]Win32:Gabpath-OY [Adw] [Avast]unknown virus Win32/DH{DwNh} [AVG]W32/AutoRun.HLP!worm [Fortinet]Trojan/win32.agent.gen [Antiy-AVL]TR/Rogue.7619581 [AntiVir]Win32.HLLW.Autoruner1.17062 [DrWeb]W32/Autorun.worm.aacz [McAfee]
More aliases (391)
More aliases (391)
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe
File name: Y2Desktop.Updater.exeSize: 23.55 KB (23552 bytes)
MD5: 24fb8db6d1d55e2c5d0a53dfe48e6af8
Detection count: 8,633
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe
Group: Malware file
Last Updated: October 15, 2024
C:\Users\<username>\AppData\Roaming\Yontoo\dat\cst.exe
File name: cst.exeSize: 13.31 KB (13312 bytes)
MD5: ab0f942b8a465c2e4399167537bccd7f
Detection count: 735
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Roaming\Yontoo\dat\cst.exe
Group: Malware file
Last Updated: October 15, 2024
C:\Windows\BOX_cFosTASK.exe
File name: BOX_cFosTASK.exeSize: 405.21 KB (405218 bytes)
MD5: d692a04e3b0fa1db641ef237fa2ef2e2
Detection count: 525
File type: Executable File
Mime Type: unknown/exe
Path: C:\Windows\BOX_cFosTASK.exe
Group: Malware file
Last Updated: August 9, 2022
E:\3. Všechny programy 1.1 TB\!.Čistící 477 GB\1-257 GB\!6.CD+Závady+Opravy-Viry 176 GB\9-3.CD-bootovací,opravy-všechny\!!!! Nové programy\1-Programy CD\!.programy z CD-FalconFour Ultimate Boot CD v4.61\HBCD\WINTOOLS\R-KILL.COM
File name: R-KILL.COMSize: 780.28 KB (780283 bytes)
MD5: ea5d533ede0a185245cc754e744bbd3a
Detection count: 396
File type: Command, executable file
Mime Type: unknown/COM
Path: E:\3. Všechny programy 1.1 TB\!.Čistící 477 GB\1-257 GB\!6.CD+Závady+Opravy-Viry 176 GB\9-3.CD-bootovací,opravy-všechny\!!!! Nové programy\1-Programy CD\!.programy z CD-FalconFour Ultimate Boot CD v4.61\HBCD\WINTOOLS\R-KILL.COM
Group: Malware file
Last Updated: November 17, 2024
%ALLUSERSPROFILE%\Tarma Installer\{68F250EA-9638-4DCF-96C4-D68CC340EC48}\A86207CA0123E3DC._bu
File name: A86207CA0123E3DC._buSize: 133.63 KB (133632 bytes)
MD5: d7ad793a77f97f7e31a8ecdbb88eb1b2
Detection count: 386
Mime Type: unknown/_bu
Path: %ALLUSERSPROFILE%\Tarma Installer\{68F250EA-9638-4DCF-96C4-D68CC340EC48}\A86207CA0123E3DC._bu
Group: Malware file
Last Updated: September 15, 2024
C:\$Recycle.Bin\S-1-5-21-1788207478-340930373-1749900118-1000\$RWA9VJ1\Quarantine\C\Program Files (x86)\Yontoo\OptChrome.exe.vir
File name: OptChrome.exe.virSize: 138.24 KB (138240 bytes)
MD5: e014fa47c8e1ebd80f114ff87934f907
Detection count: 274
Mime Type: unknown/vir
Path: C:\$Recycle.Bin\S-1-5-21-1788207478-340930373-1749900118-1000\$RWA9VJ1\Quarantine\C\Program Files (x86)\Yontoo\OptChrome.exe.vir
Group: Malware file
Last Updated: January 25, 2025
%USERPROFILE%\My Documents\YontooClientSetup.Exe
File name: YontooClientSetup.ExeSize: 554.1 KB (554104 bytes)
MD5: fa83259165c4d0c68a3ccf346093e78e
Detection count: 122
File type: Executable File
Mime Type: unknown/Exe
Path: %USERPROFILE%\My Documents
Group: Malware file
Last Updated: October 3, 2020
%APPDATA%\SoundcardAudiocodec.exe
File name: SoundcardAudiocodec.exeSize: 643.07 KB (643072 bytes)
MD5: 7beac080a6ea9eee6ae67da366bf0005
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Yontoo\YontooDesktop.exe
File name: YontooDesktop.exeSize: 42.78 KB (42784 bytes)
MD5: 1c8317e85a2dcf1de39a07d95eb20afa
Detection count: 63
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Yontoo
Group: Malware file
Last Updated: March 26, 2016
C:\Program Files\Yontoo\OptChrome.exe
File name: OptChrome.exeSize: 133.63 KB (133632 bytes)
MD5: 1a090eded97f116b28ebf6a6c0fe2b64
Detection count: 59
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files\Yontoo\OptChrome.exe
Group: Malware file
Last Updated: January 18, 2024
%WINDIR%\System32\PSEXESVC.EXE
File name: PSEXESVC.EXESize: 61.44 KB (61440 bytes)
MD5: 4849b669497c3359e5f09e3613cd7e2f
Detection count: 49
File type: Executable File
Mime Type: unknown/EXE
Path: %WINDIR%\System32
Group: Malware file
Last Updated: August 17, 2020
%LOCALAPPDATA%\WideSearch\wsearch.exe
File name: wsearch.exeSize: 419.84 KB (419840 bytes)
MD5: 66529767fe6f9d9c2eb617a733e64c53
Detection count: 47
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\WideSearch
Group: Malware file
Last Updated: December 18, 2012
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\AAD8VVY1\YontooUninstaller.exe
File name: YontooUninstaller.exeSize: 523.55 KB (523552 bytes)
MD5: f473f6e32b773edee97950d2746fd088
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\AAD8VVY1
Group: Malware file
Last Updated: April 1, 2020
%APPDATA%\nightupdate\svchost.exe
File name: svchost.exeSize: 301.03 KB (301032 bytes)
MD5: 22025ca0d008c0e17e26ddcfe10faffb
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\nightupdate
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Microsoft\Windows\Templates\spsreng.exe
File name: spsreng.exeSize: 8.19 KB (8192 bytes)
MD5: 07f9bf43264060abcd3bb1686b78b66d
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Templates
Group: Malware file
Last Updated: December 18, 2012
%SystemDrive%\RECYCLER\S-1-5-21-2626416508-434419615-3162726493-1006\$e147bd530acf0dfb79a40265a25de046\n.
File name: n.Size: 51.2 KB (51200 bytes)
MD5: f76f11e753ae6353f56be5b7c0e18d12
Detection count: 42
Path: %SystemDrive%\RECYCLER\S-1-5-21-2626416508-434419615-3162726493-1006\$e147bd530acf0dfb79a40265a25de046
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Blammi\Blammi.exe
File name: Blammi.exeSize: 1.68 MB (1687552 bytes)
MD5: c03154cddb74ccdda551fbbb80628605
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Blammi
Group: Malware file
Last Updated: December 18, 2012
%SYSTEMDRIVE%\Users\<username>\Desktop\Virus\Advanced MalwarePack\ZeroAccess\EZ_Sirefix.exe
File name: EZ_Sirefix.exeSize: 2.03 MB (2033481 bytes)
MD5: 9eef4ef1cf01c5a6567776a77079230a
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\Virus\Advanced MalwarePack\ZeroAccess\EZ_Sirefix.exe
Group: Malware file
Last Updated: May 29, 2023
G:\[SOLUCION] lXxDanteasdfxXl\Nueva carpeta\Eset Smart Security 5 Full en español 32 bits by angelithotutorial\ESETSM~1\TNod 1.4.1\TNODUP.exe
File name: TNODUP.exeSize: 1.89 MB (1892352 bytes)
MD5: 61f4456f9848da1f5385799415ff8e69
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: G:\[SOLUCION] lXxDanteasdfxXl\Nueva carpeta\Eset Smart Security 5 Full en español 32 bits by angelithotutorial\ESETSM~1\TNod 1.4.1\TNODUP.exe
Group: Malware file
Last Updated: April 4, 2022
%APPDATA%\dwm.exe
File name: dwm.exeSize: 1.27 MB (1270272 bytes)
MD5: f80eb5a04e2d6cfaa149011df1367c19
Detection count: 20
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\Microsoft\Windows\Templates\mscorlib.exe
File name: mscorlib.exeSize: 10.75 KB (10752 bytes)
MD5: 4ff56eb620defbbdbc13ff75708c1d81
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Templates
Group: Malware file
Last Updated: December 18, 2012
%APPDATA%\winhost\winhost.exe
File name: winhost.exeSize: 58.36 KB (58368 bytes)
MD5: 20c02c85181c98b3f136fba654ade5d6
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\winhost
Group: Malware file
Last Updated: December 18, 2012
%WINDIR%\SysWow64\config\systemprofile\appdata\roaming\adobe\sp.dll
File name: sp.dllSize: 160.25 KB (160256 bytes)
MD5: 7cc0fad47e5f5d329394e76935dcc0b0
Detection count: 12
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\SysWow64\config\systemprofile\appdata\roaming\adobe
Group: Malware file
Last Updated: December 18, 2012
%CommonAppData%\Temp\YontooTix2700750.log
File name: %CommonAppData%\Temp\YontooTix2700750.logMime Type: unknown/log
Group: Malware file
%CommonAppData%\Yontoo Layers\YontooIEClient.dll
File name: %CommonAppData%\Yontoo Layers\YontooIEClient.dllFile type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\Yontoo Layers Runtime\YontooIEClient.dll
File name: %ProgramFiles%\Yontoo Layers Runtime\YontooIEClient.dllFile type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\YontooFFClient.xpi
File name: %Temp%\YontooFFClient.xpiMime Type: unknown/xpi
Group: Malware file
%Temp%\YontooIEClient.dll
File name: %Temp%\YontooIEClient.dllFile type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\YontooLayers.crx
File name: %Temp%\YontooLayers.crxMime Type: unknown/crx
Group: Malware file
%Temp%\YontooLayers.pem
File name: %Temp%\YontooLayers.pemMime Type: unknown/pem
Group: Malware file
%Temp%\YontooSetup-Silent.exe
File name: %Temp%\YontooSetup-Silent.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
OptChrome.exe
File name: OptChrome.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
More files
Registry Modifications
The following newly produced Registry Values are:
CLSID{1AD27395-1659-4DFF-A319-2CFA243861A5}{7E84186E-B5DE-4226-8A66-6E49C6B511B4}{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}{99066096-8989-4612-841F-621A01D54AD7}{CFDAFE39-20CE-451D-BD45-A37452F39CF0}{D372567D-67C1-4B29-B3F0-159B52B3E967}{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}{FE9271F2-6EFD-44b0-A826-84C829536E93}HKEY..\..\{CLSID Path}{1AD27395-1659-4DFF-A319-2CFA243861A5}Regexp file mask%TEMP%\YontooFFClient.xpi%TEMP%\YontooIEClient.dll%TEMP%\YontooLayers.crx%TEMP%\YontooSetup-Silent.exeHKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\YontooIEClient.DLL\"AppID" = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}\"Default" = "YontooIEClient"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9D9785E5-3424-40B6-A287-BA143AD53109}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{FC1DD4E4-688F-4E9B-BAE5-BFB6A956AE51}\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}"Default" = "1"HKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\AppID\YontooIEClient.DLLSOFTWARE\Classes\Wow6432Node\AppID\YontooIEClient.DLLSoftware\Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}SOFTWARE\Classes\YontooIEClient.ApiSOFTWARE\Classes\YontooIEClient.Api.1SOFTWARE\Classes\YontooIEClient.LayersSOFTWARE\Classes\YontooIEClient.Layers.1SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}SOFTWARE\Wow6432Node\Classes\AppID\YontooIEClient.DLLSOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}SOFTWARE\Wow6432Node\Tarma Installer\Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}SYSTEM\ControlSet001\services\Yontoo Desktop UpdaterSYSTEM\ControlSet002\services\Yontoo Desktop UpdaterSYSTEM\CurrentControlSet\services\Yontoo Desktop UpdaterHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
CLSID{1AD27395-1659-4DFF-A319-2CFA243861A5}{7E84186E-B5DE-4226-8A66-6E49C6B511B4}{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}{99066096-8989-4612-841F-621A01D54AD7}{CFDAFE39-20CE-451D-BD45-A37452F39CF0}{D372567D-67C1-4B29-B3F0-159B52B3E967}{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}{FE9271F2-6EFD-44b0-A826-84C829536E93}HKEY..\..\{CLSID Path}{1AD27395-1659-4DFF-A319-2CFA243861A5}Regexp file mask%TEMP%\YontooFFClient.xpi%TEMP%\YontooIEClient.dll%TEMP%\YontooLayers.crx%TEMP%\YontooSetup-Silent.exeHKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\YontooIEClient.DLL\"AppID" = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}\"Default" = "YontooIEClient"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9D9785E5-3424-40B6-A287-BA143AD53109}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"Default" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{FC1DD4E4-688F-4E9B-BAE5-BFB6A956AE51}\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}"Default" = "1"HKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\AppID\YontooIEClient.DLLSOFTWARE\Classes\Wow6432Node\AppID\YontooIEClient.DLLSoftware\Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}SOFTWARE\Classes\YontooIEClient.ApiSOFTWARE\Classes\YontooIEClient.Api.1SOFTWARE\Classes\YontooIEClient.LayersSOFTWARE\Classes\YontooIEClient.Layers.1SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}SOFTWARE\Wow6432Node\Classes\AppID\YontooIEClient.DLLSOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\yontoo-0B90_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-Silent-0CC4_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}SOFTWARE\Wow6432Node\Tarma Installer\Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}SYSTEM\ControlSet001\services\Yontoo Desktop UpdaterSYSTEM\ControlSet002\services\Yontoo Desktop UpdaterSYSTEM\CurrentControlSet\services\Yontoo Desktop UpdaterHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Additional Information
The following directories were created:
%ALLUSERSPROFILE%\9466af57-1f38-4973-ab1c-22f7e17e2d6a%ALLUSERSPROFILE%\Application Data\9466af57-1f38-4973-ab1c-22f7e17e2d6a%ALLUSERSPROFILE%\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}%ALLUSERSPROFILE%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}%APPDATA%\Yontoo%PROGRAMFILES(x86)%\Yontoo%PROGRAMFILES(x86)%\Yontoo Layers Runtime%ProgramFiles%\Yontoo%ProgramFiles%\Yontoo Layers Runtime%ProgramFiles(x86)%\Yontoo Layers%TEMP%\YontooLayers
The following URL's were detected:
yontoo.com
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.