PUA_YONTOO.GB

March 07, 2018

Analysis by: Byron Jon Gelera

ALIASES:

PUA.Yontoo (Norton)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Potentially Unwanted Application
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

TECHNICAL DETAILS

File Size:

1,342,064 bytes

File Type:

EXE

Memory Resident:

Initial Samples Received Date:

22 Feb 2018

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application drops the following files:

%Program Files%\Yontoo\YontooIEClient.dll
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
%User Temp%\{hex numbers}.dat
%User Temp%\{hex numbers}\_Setup.dll
%User Temp%\{hex numbers}\_Setupx.dll
%User Temp%\{hex numbers}\Setup.ico
%User Temp%\{hex numbers}\x64\regsvr32.exe
%User Temp%\{hex numbers}\x86\regsvr32.exe
%User Temp%\7za.exe._tm
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.exe
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.log
%User Temp%\InstallHandler.txt
%User Temp%\InstallHandler.txt.tmp
%User Temp%\OptChrome.exe._tm
%User Temp%\sqlite3.exe._tm
%User Temp%\YontooFFClient.xpi._tm
%User Temp%\YontooIEClient.dll._tm
%User Temp%\YontooLayers.crx._tm
%User Temp%\YontooLayers.pem._tm
%User Temp%\YontooSetup-S.exe._tm
%User Temp%\YontooSetup-S-{hex numbers}.exe
%User Temp%\YontooSetup-S-{hex numbers}.log

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

%Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Ext\
PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\YontooIEClient.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api.1\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers.1\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\InProcServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\NumMethods

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\NumMethods

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}\defaultEnableAppsList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{99066096-8989-4612-841F-621A01D54AD7}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{9D9785E5-3424-40B6-A287-BA143AD53109}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{4889CB45-FFEB-486E-8785-D034DAC2ACE6}

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{361E80BE-388B-4270-BF54-A10C2B756504}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
path = "%User Temp%\YontooLayers.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
version = "1.0.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
(Default) = "912a21a1-0a9d-4b13-bc04-8ad67663fdd0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}
(Default) = "270f8071-1ef7-4d47-9f19-e1759654aa66"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
(Default) = "YontooIEClient"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\YontooIEClient.DLL
AppID = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api.1
(Default) = "Yontoo Api"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api.1\CLSID
(Default) = "{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api
(Default) = "Yontoo Api"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api\CLSID
(Default) = "{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Api\CurVer
(Default) = "YontooIEClient.Api.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
(Default) = "Yontoo Api"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\ProgID
(Default) = "YontooIEClient.Api.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\VersionIndependentProgID
(Default) = "YontooIEClient.Api"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\InprocServer32
(Default) = "%Program Files%\Yontoo\YontooIEClient.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\TypeLib
(Default) = "{D372567D-67C1-4B29-B3F0-159B52B3E967}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers.1
(Default) = "Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers.1\CLSID
(Default) = "{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers
(Default) = "Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers\CLSID
(Default) = "{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
YontooIEClient.Layers\CurVer
(Default) = "YontooIEClient.Layers.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
(Default) = "Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ProgID
(Default) = "YontooIEClient.Layers.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\VersionIndependentProgID
(Default) = "YontooIEClient.Layers"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\InprocServer32
(Default) = "%Program Files%\Yontoo\YontooIEClient.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\TypeLib
(Default) = "{D372567D-67C1-4B29-B3F0-159B52B3E967}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
(Default) = "Yontoo Layers"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
NoExplorer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0
(Default) = "YontooIEClient 1.0 Type Library"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
FLAGS
(Default) = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
0\win32
(Default) = "%Program Files%\Yontoo\YontooIEClient.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\1.0\
HELPDIR
(Default) = "%Program Files%\Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
(Default) = "ILayers"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ProxyStubClsid
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\TypeLib
(Default) = "{D372567D-67C1-4B29-B3F0-159B52B3E967}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
(Default) = "IApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ProxyStubClsid
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\TypeLib
(Default) = "{D372567D-67C1-4B29-B3F0-159B52B3E967}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\InProcServer32
(Default) = "%Program Files%\Yontoo\YontooIEClient.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\InProcServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
(Default) = "PSFactoryBuffer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ProxyStubClsid32
(Default) = "{10DE7085-6A1E-4D41-A7BF-9AF93E351401}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
(Default) = "ILayers"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\NumMethods
(Default) = "7"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ProxyStubClsid32
(Default) = "{10DE7085-6A1E-4D41-A7BF-9AF93E351401}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
(Default) = "IApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\NumMethods
(Default) = "17"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}
(Default) = "270f8071-1ef7-4d47-9f19-e1759654aa66"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}\defaultEnableAppsList
(Default) = "ezLooker,pagerage,buzzdock,toprelatedtopics,twittube"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
(Default) = "b3a895d6-eaed-49ca-b3a9-8a0b7af6e87b"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{99066096-8989-4612-841F-621A01D54AD7}
(Default) = "40820231-978b-45f0-8d80-2d9f059812a6"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{9D9785E5-3424-40B6-A287-BA143AD53109}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}
{889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
UninstallString = "%Program Files%\TARMAI~1\{889DF~1\Setup.exe /remove /q0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
QuietUninstallString = "%Program Files%\TARMAI~1\{889DF~1\Setup.exe /remove /q"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
ModifyPath = "%Program Files%\TARMAI~1\{889DF~1\Setup.exe /q0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Version = "17432578"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
VersionMajor = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
VersionMinor = "10"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
EstimatedSize = "1927"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Language = "1033"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
TSAware = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
TinFolder = "%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
TinVersion = "5021"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
InstallDate = "20180222"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
InstallLocation = "%Program Files%\Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
InstallSource = "%User Temp%"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
DisplayIcon = "%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
DisplayName = "Yontoo 1.10.02"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
DisplayVersion = "1.10.02"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Publisher = "Yontoo LLC"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
URLInfoAbout = "http://www.yontoo.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Contact = "support@yontoo.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
(Default) = "Yontoo"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
TizPath = "%User Temp%\YontooSetup-S.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Components\{4889CB45-FFEB-486E-8785-D034DAC2ACE6}
{361E80BE-388B-4270-BF54-A10C2B756504} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{361E80BE-388B-4270-BF54-A10C2B756504}
(Default) = "ezLooker"

HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\
Products\{361E80BE-388B-4270-BF54-A10C2B756504}
TizPath = "(Initial Path and Filename)"

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

http://{BLOCKED}e.{BLOCKED}.com/InstallHandler.aspx?alpha={base-64 encoded string}

SOLUTION

Minimum Scan Engine:

9.850

SSAPI PATTERN File:

1.923.00

SSAPI PATTERN Date:

01 Mar 2018

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
- niapdbllcanepiiimjjndipklodoedlc
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {FE9271F2-6EFD-44b0-A826-84C829536E93}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved
- {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
- {CFDAFE39-20CE-451D-BD45-A37452F39CF0}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
- YontooIEClient.DLL
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- YontooIEClient.Api.1
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- YontooIEClient.Api
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- YontooIEClient.Layers.1
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
- YontooIEClient.Layers
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
- {FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {D372567D-67C1-4B29-B3F0-159B52B3E967}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {1AD27395-1659-4DFF-A319-2CFA243861A5}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {1AD27395-1659-4DFF-A319-2CFA243861A5}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {FE9271F2-6EFD-44b0-A826-84C829536E93}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {7E84186E-B5DE-4226-8A66-6E49C6B511B4}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {99066096-8989-4612-841F-621A01D54AD7}
In HKEY_LOCAL_MACHINE\SOFTWARE
- Tarma Installer
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- {889DF117-14D1-44EE-9F31-C5FB5D47F68B}

To delete the registry key this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions
Still in the left panel, locate and delete the key:
niapdbllcanepiiimjjndipklodoedlc
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
Still in the left panel, locate and delete the key:
{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Again Still in the left panel, locate and delete the key:
{FE9271F2-6EFD-44b0-A826-84C829536E93}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
Still in the left panel, locate and delete the key:
{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
Still in the left panel, locate and delete the key:
{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Again Still in the left panel, locate and delete the key:
YontooIEClient.DLL
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes
Still in the left panel, locate and delete the key:
YontooIEClient.Api.1
Again Still in the left panel, locate and delete the key:
YontooIEClient.Api
Again Still in the left panel, locate and delete the key:
{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Again Still in the left panel, locate and delete the key:
YontooIEClient.Layers.1
Again Still in the left panel, locate and delete the key:
YontooIEClient.Layers
Again Still in the left panel, locate and delete the key:
{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects
Still in the left panel, locate and delete the key:
{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
Still in the left panel, locate and delete the key:
{D372567D-67C1-4B29-B3F0-159B52B3E967}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
Still in the left panel, locate and delete the key:
{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Again Still in the left panel, locate and delete the key:
{1AD27395-1659-4DFF-A319-2CFA243861A5}
Again Still in the left panel, locate and delete the key:
{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Again Still in the left panel, locate and delete the key:
{1AD27395-1659-4DFF-A319-2CFA243861A5}
Again Still in the left panel, locate and delete the key:
{FE9271F2-6EFD-44b0-A826-84C829536E93}
Again Still in the left panel, locate and delete the key:
{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Again Still in the left panel, locate and delete the key:
{99066096-8989-4612-841F-621A01D54AD7}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE
Still in the left panel, locate and delete the key:
Tarma Installer
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
Still in the left panel, locate and delete the key:
{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Close Registry Editor.

Step 4

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the File name* input box, type:

%Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86
In the Look In drop-down list, select My Computer, then press Enter.
Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2 to 4 for the remaining folders: %Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86

*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
%Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86
Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2-3 for the remaining folders: %Program Files%\Yontoo
%ProgramData%\Tarma Installer
%ProgramData%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
%ProgramData%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
%User Temp%\{hex numbers}
%User Temp%\{hex numbers}\x64
%User Temp%\{hex numbers}\x86

*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 5

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%User Temp%\7za.exe._tm
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.exe
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.log
%User Temp%\InstallHandler.txt
%User Temp%\InstallHandler.txt.tmp
%User Temp%\OptChrome.exe._tm
%User Temp%\sqlite3.exe._tm
%User Temp%\YontooFFClient.xpi._tm
%User Temp%\YontooIEClient.dll._tm
%User Temp%\YontooLayers.crx._tm
%User Temp%\YontooLayers.pem._tm
%User Temp%\YontooSetup-S.exe._tm
%User Temp%\YontooSetup-S-{hex numbers}.exe
%User Temp%\YontooSetup-S-{hex numbers}.log

To delete malware/grayware files:

For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search....
In the File name* input box, type
%User Temp%\7za.exe._tm
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.exe
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.log
%User Temp%\InstallHandler.txt
%User Temp%\InstallHandler.txt.tmp
%User Temp%\OptChrome.exe._tm
%User Temp%\sqlite3.exe._tm
%User Temp%\YontooFFClient.xpi._tm
%User Temp%\YontooIEClient.dll._tm
%User Temp%\YontooLayers.crx._tm
%User Temp%\YontooLayers.pem._tm
%User Temp%\YontooSetup-S.exe._tm
%User Temp%\YontooSetup-S-{hex numbers}.exe
%User Temp%\YontooSetup-S-{hex numbers}.log
In the Look In drop-down list, select My Computer then press Enter.
Once located, select the file then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.
*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
%User Temp%\7za.exe._tm
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.exe
%User Temp%\ezLooker-S-Setup_Suite1-{hex numbers}.log
%User Temp%\InstallHandler.txt
%User Temp%\InstallHandler.txt.tmp
%User Temp%\OptChrome.exe._tm
%User Temp%\sqlite3.exe._tm
%User Temp%\YontooFFClient.xpi._tm
%User Temp%\YontooIEClient.dll._tm
%User Temp%\YontooLayers.crx._tm
%User Temp%\YontooLayers.pem._tm
%User Temp%\YontooSetup-S.exe._tm
%User Temp%\YontooSetup-S-{hex numbers}.exe
%User Temp%\YontooSetup-S-{hex numbers}.log
Once located, select the file then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.
*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 6

Scan your computer with your Trend Micro product to delete files detected as PUA_YONTOO.GB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Did this description help? Tell us how we did.

PUA_YONTOO.GB

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

PUA_YONTOO.GB

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific