Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Yontoo / Shop-Up (FF Extension) Virus?

  • Please log in to reply
2 replies to this topic

#1 Ruthie64


  • Members
  • 1 posts
  • Local time:11:41 PM

Posted 21 October 2013 - 11:42 PM

First, I thank anyone who has time to take a look and even attempt to help with this issue. It has been driving me insane for a week now.

The first sign of trouble was the dreaded random double underlined linked words.
I ran multiple scans of my laptop (running on Windows 7) and thought the issue was cleared. After a day of no issues, the problem returned. I then checked my FireFox (which I use at all times) extensions and add ons, and found something called "Shop-Up".
This extension will allow me to click on "remove". It appears to be gone, the random word links are gone, but upon next reboot, it is all returned. I tried multiple restore dates, none have cleared any of this at all.

I found a page .. somewhere (didn't think to save it grrrr), saying this is connneted to "yontoo".
I went into control Panal, and both programs were listed. Yontoo, uninstalled. Shop-Up, will not.

So, I researched a bit more and found this walk through page:


I have followed these steps multiple times and found both Yontoo and Shop-Up files hidden this way. Some can be deleted, some not.
Tonight, I went to reboot my laptop and it refused to load again in normal mode.
I went to SafeMode, booted, did a restore, again, and it then rebooted normally. Upon rebooting, I now had a desktop for Error Expert 1.5, which, I have never seen before on my system and don't recall downloading.
Now this program, not only will not uninstall, but it tells me it doesn't exist in my programs. 


Now, tonight, all of the random double underlined words are again back.


Any ideas at all, like ... any? LOL.
Im ready to turn this thing off, put it in a box and drive to the recycle center.


Than you for any help anyone can offer.




Mod Edit:  Removed DDS log, not permitted/used in this forum and issue appears to simply be adware issue, commonly handled in this forum - Hamluis.

Edited by hamluis, 22 October 2013 - 06:15 AM.
Removed DDS data - Hamluis.

BC AdBot (Login to Remove)


#2 noknojon


  • Banned
  • 10,871 posts
  • Gender:Not Telling
  • Local time:01:41 PM

Posted 22 October 2013 - 12:55 AM

Hello -

I have requested that those logs be removed as I think they are totally unrelated -


Please read this topic from our quietman7 that explains your description of the problem -


Are the double-underlined random words that you are referring to like the example provided in this topic (Post #1)?

If so, this is called in-text advertising and it is very common. Kontera, Text Enhance and Vibrant are are some of the more popular advertising networks that provide in-text advertising and information services.

The double-underlined word is actually a keyword embedded within text of a web page. The keyword is intended to provide consumers with information that is related to what they are reading. When hovering your mouse over this keyword, a pop up ad is displayed with a preview of the ad the text links to. This process works by allowing webmasters to insert JavaScript code into web pages that displays relevant advertisements from an inventory of advertisers.


This script scans a web page and dynamically modifies keywords an advertiser has targeted on the page and double-underlines them. The words and the double-lines under them are usually blue in color but it is not uncommon for them to appear in various other colors such as red or green.

The full content of the post is linked below =>


Tell us if this explains your problem


Thank You -

#3 noknojon


  • Banned
  • 10,871 posts
  • Gender:Not Telling
  • Local time:01:41 PM

Posted 22 October 2013 - 12:59 AM

Following your Full reading of the above, please run just this 1 scan =>


Please download Junkware Removal Tool by thisisu to your desktop
Shut down your protection software now to avoid potential conflicts.

How To Temporarily Disable Your Anti-virus
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.


Thank You -

Edited by noknojon, 22 October 2013 - 01:00 AM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users