Yontoo est un programme qui s’installe généralement à votre insu via le téléchargement de logiciels gratuits
Caractèriqtiques
– Il appartient à une famille de PUP Optionnels (Potentially Unwanted Program).
– Vendeur : PUP.Optional.
Actions principales
– Il s’installe en tant que processus lancé au démarrage du système (RP),
– Il installe un programme d’extension pour le navigateur Mozilla Firefox (M2),
– Il installe un programme d’extension pour le navigateur Google Chrome (G2),
– Il s’installe en tant de Browser Helper Object de Navigateur internet (O2),
– Il s’installe dans la Base de Registres afin d’être lancé à chaque démarrage du système (O4),
– Il s’installe en tant que service pour être lancé à chaque démarrage du système (O23),(SS/SR),
– Il s’installe en tant que programme (O42),
– Il crée des dossiers supplémentaires (O43),
– Il s’installe dans le dossier Windows prefetcher (O45),
– Il créé une clé de registre ShareTools MSconfig StartupReg (O53),
– Il s’installe dans des dossiers particuliers de l’utilisateur (O84),
– Il pollue la base de Registres avec de nombreuses clés et valeurs (O88 ),
Aperçu ZHPDiag
—\\ Processus lancés —\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) —\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) —\\ Browser Helper Objects de navigateur (O2) —\\ Applications démarrées par registre & par dossier (O4) —\\ Logiciels installés (O42) —\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) —\\ Derniers fichiers créés dans Windows Prefetcher (O45) —\\ ShareTools MSconfig StartupReg (O53) —\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) —\\ Recherche particuliere à la racine de certains dossiers (O84) —\\ Scan Additionnel (O88 ) —\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) PUP.Optional.Yontoo [Malwarebytes] malwaretips.com – Supprimer l’extension “Yontoo” de tous les navigateurs installés,
G2 – GCE: Preference [User Data\Default] [niapdbllcanepiiimjjndipklodoedlc] Yontoo v.1.0.3 (Activé )
M2 – MFEP: prefs.js [Coolman – 6andx3ch.default\plugin@yontoo.com] [] Yontoo v1.20.02 (..)
O2 – BHO: Yontoo Layers – {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} (.Yontoo LLC.) — C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll
O4 – HKCU\..\Run: [Yontoo Desktop] C:\Documents and Settings\Coolman\Application Data\Yontoo\YontooDesktop.exe (.not file.)
O4 – HKUS\S-1-5-21-1333877253-4193380580-4002807941-1007\..\Run: [Yontoo Desktop] C:\Documents and Settings\Coolman\Application Data\Yontoo\YontooDesktop.exe (.not file.)
O42 – Logiciel: Yontoo 2.053 – (.Yontoo LLC.) [HKLM] — {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
O43 – CFD: 15/05/2013 – 14:00:59 – [0,804] —-D C:\Program Files\Yontoo
O43 – CFD: 15/05/2013 – 14:01:48 – [0,125] —-D C:\Documents and Settings\Coolman\Application Data\Yontoo
O45 – LFCP:[MD5.FF4E9684CE60631ACA0DE343B755359D] – 15/05/2013 – 13:00:54 —A- – C:\WINDOWS\Prefetch\YONTOO-C4.EXE-11DB6439.pf
O45 – LFCP:[MD5.F54FAF86B1083B71EC0EC939641159DC] – 15/05/2013 – 13:00:55 —A- – C:\WINDOWS\Prefetch\YONTOO-C4-10C0.EXE-3510B2BC.pf
O45 – LFCP:[MD5.674B6A2A602CF5CA0E6CDD0D3D977A40] – 15/05/2013 – 13:01:11 —A- – C:\WINDOWS\Prefetch\YONTOODESKTOP.EXE-1CAF6818.pf
O53 – SMSR:HKLM\…\startupreg\Yontoo Desktop [Key] . (…) — C:\Users\Coolman\AppData\Roaming\Yontoo\YontooDesktop.exe
O61 – LFC: 15/05/2013 – 13:01:24 —A- C:\Documents and Settings\Coolman\Application Data\Yontoo\dat\Desktop.OS.dll [59680]
O61 – LFC: 15/05/2013 – 13:01:28 —A- C:\Documents and Settings\Coolman\Application Data\Yontoo\dat\Desktop.OS.Plugin.dll [13600]
O61 – LFC: 15/05/2013 – 13:01:29 —A- C:\Documents and Settings\Coolman\Application Data\Yontoo\PlugIns.cache [23]
O61 – LFC: 15/05/2013 – 13:01:30 —A- C:\Documents and Settings\Coolman\Application Data\Yontoo\dat\HealthMonitor.dat [34592]
O61 – LFC: 15/05/2013 – 13:01:30 —A- C:\Documents and Settings\Coolman\Application Data\Yontoo\dat\HeartBeat.dat [22816]
O61 – LFC: 15/05/2013 – 18:34:00 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.3_0\back.js [1169]
O61 – LFC: 15/05/2013 – 18:34:01 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.3_0\background.html [80]
O61 – LFC: 15/05/2013 – 18:34:01 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.3_0\manifest.json [820]
O61 – LFC: 15/05/2013 – 18:34:01 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.3_0\yl.js [672]
O61 – LFC: 16/05/2013 – 11:01:22 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_niapdbllcanepiiimjjndipklodoedlc_0.localstorage [3072]
O61 – LFC: 16/05/2013 – 11:01:22 —A- C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_niapdbllcanepiiimjjndipklodoedlc_0.localstorage-journal
[MD5.41133F484BA4FAEFE172268C5B8D7734] [SPRF][19/01/2012] (.Yontoo LLC – Yontoo Runtime.) — C:\Users\Coolman\AppData\Local\Temp\YontooIEClient.dll [194848]
[MD5.7FE85C8E26E7E937F7113A20C8E26B6A] [SPRF][03/02/2012] (.Yontoo LLC – Installer.) — C:\Users\Coolman\AppData\Local\Temp\YontooSetup-Silent.exe [1048376]
[MD5.AE7E0C99C5BC7D28325C0CD7885C851F] [SPRF][24/10/2012] (.Yontoo LLC – Installer.) — C:\Users\Coolman\AppData\Local\Temp\YontooSetup-S.exe [1062504]
[HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
[HKCR\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}]
[HKCR\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}]
[HKCR\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
[HKLM\Software\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
[HKCR\YontooIEClient.Layers.1]
[HKCR\YontooIEClient.Api]
[HKCR\YontooIEClient.Api.1]
[HKCR\YontooIEClient.Layers]
[HKLM\Software\Classes\YontooIEClient.Api]
[HKLM\Software\Classes\YontooIEClient.Api.1]
[HKLM\Software\Classes\YontooIEClient.Layers]
[HKLM\Software\Classes\YontooIEClient.Layers.1]
[HKLM\Software\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}]
[HKLM\Software\Wow6432Node\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}[HKLM\Software\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}]
[HKLM\Software\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}]
[HKLM\Software\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}]
[HKLM\Software\Classes\AppID\YontooIEClient.DLL]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]:Yontoo Desktop[HKLM\Software\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}]
[HKLM\Software\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}]
[HKLM\Software\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}]
[HKLM\Software\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}]
[HKLM\Software\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
[HKLM\Software\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}]
[HKLM\Software\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}]
[HKLM\Software\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[HKLM\SYSTEM\CurrentControlSet\Services\Yontoo Desktop Updater]
C:\Program Files\Yontoo Layers
C:\Program Files\Yontoo Layers Client
C:\Program Files\Yontoo Layers Runtime
C:\Program Files\yontoo
C:\Documents and Settings\Coolman\Application Data\yontoo
C:\Documents and Settings\Coolman\Application Data\Mozilla\Firefox\Profiles\6andx3ch.default\Extensions\plugin@yontoo.com
SR – | Auto 01/05/2013 23552 | (Yontoo Desktop Updater) . (.Microsoft.) – C:\Program Files\Yontoo\Y2Desktop.Updater.exe Alias :
Liens :
Remove Yontoo Adware (Uninstall Guide)
Supprimer (Remove) :
– Supprimer le plugin “Yontoo” de tous les navigateurs installés,
– Supprimer le logiciel “Yontoo” via le panneau de configuration Windows,
– Modifier les pages de recherche et de démarrage de tous les navigateurs installés,
– Vider le cache des navigateurs
– Appliquer un script de nettoyage ZHPFix pour les lignes identifiées dans les rapports ZHPDiag & NCDiag(C) Copyrights 2014 – Nicolas Coolman – All rights reserved