What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] ad.yieldmanager

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Noviciate just helped me to remove antivirus 360. I was looking over WTT and found stuff on ad.yieldmanager which I saw in the site list in my ZoneAlarm. :pullhair: I have red "X"ed it all the way across my ZoneAlarm site list, but I assume I should remove it before I create a new Restore Point. I would not have known this is malware if it wasn't for you guys. Y'all get the adaboys! My reading seems to indicate pop-ups go with this thing. I'm not getting any yet. Running windows xp home, browser is firefox. Here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:04 AM, on 03/25/09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Microsoft Office\Office\OSA.EXE
D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ASUS Probe] D:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] D:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Office Startup.lnk = D:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.bleepingcomputer.com
O15 - Trusted Zone: *.mediafire.com
O15 - Trusted Zone: *.nutnworks.com
O15 - Trusted Zone: http://download.windowsupdate.com
O15 - Trusted Zone: http://*.windowsupdate.com
O15 - Trusted Zone: http://*.zonealarm.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1146187722687
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1177595026046
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

–
End of file - 6413 bytes


Thanks for any help!
I'm going to follow the model Doug presents in his posting about safe practices on Jan. 2009 as soon as I get this machine cleaned up!

Billed
Post #3
Hey Tomk, I may be overly sensitive as I just got over an infection. I was looking over the topics in this form and saw ad.yieldmanager.com. I recognized the name because it is in the site list in the privacy section of my ZoneAlarm Pro. It and Content.yieldmanager.edgesuites.net had green checks(allow) under mobile code and cookie control. I assumed that meant that ad.yieldmanager was there. However I did think it was strange that I wasn't getting any of the pop up screens people were describing. Figured it was only a matter of time. Of course I have red checked(disallowed) everything for these two entries in my ZoneAlarm. Hope I didn't chew up too much of you time, since there is nothing there. I'm sure there are plenty of people out there who need your help. Thanks!! Embarrassed, Billed
Post #4
billed,

Not a problem for me. Just wanted to be looking at the correct place.

Do you want to run an online scan just to help you sleep at night? Takes awhile but can't hurt anything.



Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #5
Hey Tomk,
I'm afraid this is going to be a long one. I ran two scans Fri night, Avast and Kasppersky, with lots of results.

Here is the Kasp. report:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, March 28, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, March 28, 2009 03:14:35
Records in database: 1978789
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 61276
Threat name: 7
Infected objects: 16
Suspicious objects: 1
Duration of the scan: 01:30:49


File name / Threat name / Threats count
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Bagle.bj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Bagle.ey 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Paylap.hj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\mail.bna.bellsouth.net\Inbox Infected: Email-Worm.Win32.Bagle.bj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\mail.bna.bellsouth.net\Inbox Infected: Email-Worm.Win32.Bagle.ey 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\mail.bna.bellsouth.net\Inbox Infected: Trojan-Spy.HTML.Paylap.hj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Copy of Local Folders\Inbox Infected: Email-Worm.Win32.Bagle.bj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Copy of Local Folders\Inbox Infected: Email-Worm.Win32.Bagle.ey 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Copy of Local Folders\Inbox Infected: Trojan-Spy.HTML.Paylap.hj 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Local Folders-1\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Judy Dengler\Application Data\Thunderbird\Profiles\830r4mpe.default\Mail\Local Folders-1\Junk Infected: Trojan-Spy.HTML.Paylap.bw 1
C:\System Volume Information\_restore{6A6A5767-371E-4840-AA8E-928E6B370674}\RP85\A0019868.exe Infected: Trojan-Downloader.Win32.FraudLoad.dvy 1
C:\System Volume Information\_restore{6A6A5767-371E-4840-AA8E-928E6B370674}\RP85\A0019869.exe Infected: Trojan-Downloader.Win32.FraudLoad.dvy 1
C:\System Volume Information\_restore{6A6A5767-371E-4840-AA8E-928E6B370674}\RP85\A0019870.exe Infected: Trojan-Downloader.Win32.FraudLoad.dvy 1
C:\System Volume Information\_restore{6A6A5767-371E-4840-AA8E-928E6B370674}\RP85\A0019871.exe Infected: Trojan-Downloader.Win32.FraudLoad.dvy 1
C:\System Volume Information\_restore{6A6A5767-371E-4840-AA8E-928E6B370674}\RP86\A0021963.EXE Infected: not-a-virus:FraudTool.Win32.Antivirus360.y 1
C:\Qoobox\Quarantine\C\Program Files\A360\av360.exe.vir Infected: not-a-virus:FraudTool.Win32.Antivirus360.y 1

The selected area was scanned.


I got two Alerts during the Avast scan, and three entries on the report.
1) C:\System Volume Information\_restore{6A6567-371E-480-AA8E-928E6B370674}\RP86\A0021963.EXE infected

2) C:\QOOBOX\Quaratine\C\Program Files\a360\av360.exe.vir infected

3) D:\Setup Files\Winzip81.EXE\Setup.WZ\Winzip32.EX Unable to scan archive is password protected

I'm aware that the first two are a result of the Antivirus 360 removal. I would like to do something to keep them from interrupting
my Avast scans. I have learned in the past that remove, delete, move to chest are actions to be taken seriously! A little advise here would be apprciated. Number three only shows up in the report, and may be harmless.

Now my attempt at being helpful. When I was setting up my scan at Kaspersky, I couldn't get at the box for Spyware, Adware, Dialers, and other potentially dangerous programs. I think this part of the help from Scanner 7 is saying they are always scanned.

To configure a scan:

1. In the lower part of the Kaspersky Online Scanner 7.0 window, click Settings to open the Settings section.
2. In the Settings section, do the following:
* To skip files that contain malicious programs of less dangerous categories, click to clear the Spyware, Adware, Dialers and other potentially dangerous programs check box.
* To skip compound files, clear the check box against the type of compound files that you want to skip:
o Archives. Kaspersky Online Scanner 7.0 scans files inside archives: ZIP, ARJ, CAB, and so on.
o Mail databases. Kaspersky Online Scanner 7.0 scans Microsoft Outlook and Microsoft Outlook Express mail database files.
3. Click Save to save your changes.


Note that you cannot choose to skip files that contain malicious programs of the most dangerous categories, such as Viruses, Worms, or Trojan Horse programs. Kaspersky Online Scanner 7.0 always detects these.


I left the checks as they were. That may mean I missed compound files, archives, and mail databases. It seem like the checks in the boxes are backwords, but the note is straight forward. It's confusing.

Well that's a bunch.
I do appreciate your help!

thanks,
Billed
Post #6
billed,

Looks like you did fine. :thumbup:

Here's what you found:
  • contaminated email
  • You didn't cleanup the quarantine for Combofix after your infection
  • You didn't clean out your restore points after your infection.

The first one is the hard one. I cannot tell which emails are infected. All I know is that you have email in 3 places that are infected. There is infected mail in your "normal" email folder. There is infected mail in a Bell South folder. And you have a copy of your email folders that is also infected. Everything appears to be in your inbox. You need to go through all of your mail in your inbox and delete everything you don't need and/or recognize. Please don't open any attachments or click on any links. That is the most likely way to get infected. Once you are done, empty your deleted mail folder.

  • Make sure you have an Internet Connection.
  • Download OTCleanIt to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

And this will take care of your restore points.

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #7
TOMK, Sorry it took so long to get back. The wife asked me to hang some decorative shelves that were given to us 3 years ago. MY BAD. I searched "inbox" and found 29 entries all seemed to relate to ThunderBird which we stopped using over a year ago. Sent them all to the recycle bin, ran OTCleanlt, and set a new restore point. Went back and reread your post and noticed your statement about a Bell South folder, so I repeated the procedure starting with a "Bell South" search. We haven't used bell for anything for more than a year. I've been to Preventing Malware - Tools and Practices for Safe Computing and I will be returning. I've also read Tallin's instructions he has linked to his name, and I have printed one of Abydos's posts where he describes his fortress. This screen has tabs for the two links you sent at the end of your post. When I'm done with this I'm off to read, and start building my fort. THANKS AND I SALUTE YOU TOMK, Billed
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI