Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

http://ad.yieldmanager.com/st%3Fad_type - I can't get rid of this


  • This topic is locked This topic is locked
10 replies to this topic

#1 FutureDoc

FutureDoc

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 12:52 PM

I have been trying to get rid of this thing for quite a while now and haven't been able to. It happened mostly with Yahoo, but now I am redirected to a Dell/Google page http://www.google.com/hws/dell-usuk/afe?hl...om/st%3Fad_type. It states "Sorry, we couldn't find [url="http://ad.yieldmanager.com/st%3Fad_type...""]http://ad.yieldmanager.com/st%3Fad_type..."[/url] I have run Ad-Aware SE Personal and Spybot S&D and McAffee anti-virus. I don't seem to have any other problems, and I've never messed with the registry in fear of making things worse. Inclosed is the HJT file that I ran after running the other programs. And thanks for the help!

Edited by FutureDoc, 27 November 2008 - 04:02 PM.


BC AdBot (Login to Remove)

 


#2 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:34 PM

Posted 27 November 2008 - 02:27 PM

Hi FutureDoc,

Welcome to BC HijackThis forum. I am farbar. I am going to assist you with your problem.
  • You have the program Spybot S&D (Teatimer option) running on your machine. We need to disable TeaTimer so it does not interfere with the fixes we are about to do.
    • First disable TeaTimer:
      • Run Spybot-S&D
      • Go to the Mode menu, and make sure Advanced Mode is selected
      • On the left hand side, choose Tools -> Resident
      • Uncheck Resident TeaTimer and OK any prompts
      • Restart your computer.
      Instruction is also here: How to disable TeaTimer during HijackThis Cleanup

      Note:If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
    • Then download ResetTeaTimer.exe to your desktop. (In case you use Firefox, rightclick the link and choose "Save Link As").
      • Doubleclick ResetTeaTimer.exe and let it run.
    This will only take a few seconds.

  • Please open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below (if present):

    O2 - BHO: (no name) - {376892AE-1825-4E5F-9F85-23F9640051CC} - (no file)
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll


    Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

  • This is unrelated to your problem: Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This changed from what we know in 2006 read this article:

    http://www.clickz.com/news/article.php/3561546

    I suggest you remove the program if you are not using it.
    If you decided to uninstall it click on start > run > and then paste the following into the "open" field: appwiz.cpl and press OK. From within Add or Remove Programs uninstall the following if they exist:

    Viewpoint, Viewpoint Manager, Viewpoint Media Player.

    Also remove the folder in bold: C:\Program Files\Viewpoint

  • This is unrelated to your problem. Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
    Please follow these steps to remove older version Java components and update:
    • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
    • Go to where it says "Java SE Runtime Environment (JRE) 6 Update 10This release provides a new Java Plug-in that combines features...".
    • Click the "Download" button to the right.
    • Select your Platform: "Windows".
    • Select your Language: "Multi-language".
    • Read the License Agreement, and then check the box that says: "Accept License Agreement".
    • Click Continue and the page will refresh.
    • Click on the link to download Windows Offline Installation and save the file to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
    • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version.
  • Please copy and paste a fresh Hijackthis log to your reply and tell me if the problem is resolved.


#3 FutureDoc

FutureDoc
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 03:56 PM

Thanks for the reply, farbar. I followed all the steps that you gave me and have attached a new copy of my hijackthis report. I went to yahoo (the site that I had the most trouble with) and the advertisements still do not show up. They have a windows internet explorer error in their place. But, the ad yield manager error is no longer occurring, so I am no longer redirected to a Dell/Google search page immediately when the page I am trying to view is loading. What do you make of this?

Also, should I enable the TeaTimer again?

Edited by FutureDoc, 27 November 2008 - 05:55 PM.


#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:34 PM

Posted 27 November 2008 - 05:10 PM

The ad.yielmanager is gone. That is what you wanted.
  • Please describe your current problem clearly. To which yahoo site you are going and which advertisement is not showing up?

  • Please open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below (if present):

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u


    Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

  • Please download ATF Cleaner by Atribune & save it to your desktop.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main "Select Files to Delete" choose: Select All.
    • Click the Empty Selected button.
    • If you use Firefox browser click Firefox at the top and choose: Select All
    • Click the Empty Selected button.
      If you would like to keep your saved passwords, please click No at the prompt.
    • If you use Opera browser click Opera at the top and choose: Select All
    • Click the Empty Selected button.
      If you would like to keep your saved passwords, please click No at the prompt.
    • Click Exit on the Main menu to close the program.
    Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".


  • You have still some leftovers from an incomplete uninstalled Norton Antivirus on your computer.

    To remove the leftovers please download and run the Norton Removal Tool.

    Warning: The Norton Removal Tool uninstalls all Norton 2008/2007/2006/2005/2004/2003 products and Norton 360 from your computer. If you use ACT! or WinFAX, back up those databases before you proceed.

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Set the list of Files/Folders created to 3 Months.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

      Note:The logs will be created in this folder: C:\rsit


#5 FutureDoc

FutureDoc
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 05:54 PM

Okay, now I have completed the next set of steps and attached the "log" and "info" files.

As for the advertisements, when I go to yahoo sports, there is a advertisement that always is on the right of the screen that does not appear. This is the same as it was when I would get the ad yield manager error. If there is nothing that can be done, that is fine. Because as you said, the ad yield manager is gone and that was the main thing I was after.

Could you please check to see if all of the Norton files have been removed and advise me as to the Spybot TeaTimer (should I check enable now).

Thanks for all the help!

Edited by FutureDoc, 27 November 2008 - 06:29 PM.


#6 FutureDoc

FutureDoc
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 06:07 PM

Here is a print screen view of yahoo. It is the standard internet explorer diagnose connection problem message. When I click on diagnose problem, it says that there is not a detectable problem.

Thanks again!

Edited by FutureDoc, 27 November 2008 - 06:36 PM.


#7 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:34 PM

Posted 27 November 2008 - 06:21 PM

The Norton leftover services are removed.

The logs are looking good.

The advertisement is not showing up due to various reasons. The popup blocker or a security program might prevent the advertisement because it is listed as an adware or spyware. But to make sure you may copy the link of the yahoo page to your reply so that I can check it.

If you don't need me to check the page you may enable TeaTimer.

#8 FutureDoc

FutureDoc
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 06:27 PM

Here is the link:

http://sports.yahoo.com/

Thanks!

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:34 PM

Posted 27 November 2008 - 06:29 PM

No need to post the link. I found the page. The advertisement is nothing you need it. However you can try this:

Close Internet Explorer. Go to start > Control Panel > internet options.
  • Under security tab press default.
  • Under privacy tab press default.
  • Under General tab press Delete... then Delete All Check Also delete files and settings stored by Add-ons click Yes.


#10 FutureDoc

FutureDoc
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 27 November 2008 - 06:35 PM

Thanks for all the help! I think everything has been taken care of, so I will reset the TeaTimer, and I think you can close this post set. I appreciate your time spent helping me. :thumbsup:

#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:34 PM

Posted 27 November 2008 - 06:44 PM

You are welcome, glad I could help.

This thread will now be closed.

If you need this topic reopened, please send me a PM and I will reopen it for you. Include the address of this thread in your request.

If you should have a new issue, please start a new topic.

This applies only to the original topic starter. Everyone else please begin a New Topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users