Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

s.yimg.com from YouTubing within Firefox; fixed w/LeachBlock xpi


  • Please log in to reply
9 replies to this topic

#1 RolandJS

RolandJS

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:09:29 AM

Posted 23 April 2015 - 07:20 PM

  Another poster mentioned s.yimg.com rearing itself within Firefox.  s.yimg.com appears after one has YouTube'd within Firefox.

Googling s.yimg.com coughs up several threads dealing with this - problem.

  I fixed by installing LeachBlock [an xpi from Mozilla add-on store]; then blacklisting s.yimg.com within.

Although I haven't tried it yet, BlockSite offers a very similar function within.

  I hope this is the correct forum for this solution.  It is no longer a problem for me because of LeachBlock.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:29 AM

Posted 23 April 2015 - 08:00 PM

From what I can see, the s.yimg.com website is down at the moment.

4rEOCbs.png

And if your browser gets hijacked, blocking it doesn't solve the issue, it's still there. You should remove it instead.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 RolandJS

RolandJS
  • Topic Starter

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:09:29 AM

Posted 23 April 2015 - 08:17 PM

Aura, you're right as rain!  I recommend blocking the site BEFORE it hijacks FF.  I ran into yimg through Session Manager.  Was able to "rebuild" each session affected.  Then, blocked yimg via LeachBlock -- no more problems.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,773 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:29 AM

Posted 23 April 2015 - 08:50 PM

Topic moved to more appropriate forum.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 RolandJS

RolandJS
  • Topic Starter

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:09:29 AM

Posted 23 April 2015 - 09:13 PM

thanks quietman!  I did not even see that forum, which was the better one  :)  I need new glasses!


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,773 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:29 AM

Posted 23 April 2015 - 09:30 PM

No problem RolandJS

I would lend you my bifocals but although they don't seem to do much good these days, I couldn't read a thing without them/
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 rp88

rp88

  • Members
  • 3,061 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:29 PM

Posted 24 April 2015 - 09:38 AM

I'm guessing whatever this browser hijacker is running NoScript when visiting youtube (and any other sites it could be coming from as well)would prevent it from getting into firefox in the first place?
Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#8 RolandJS

RolandJS
  • Topic Starter

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:09:29 AM

Posted 24 April 2015 - 10:24 AM

Not necessarily.  I've run NoScript for a few years now; and this s.yimg.com did get in and dork up a few session saves.

After using Leachblock, I can't remember any more problems.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#9 rp88

rp88

  • Members
  • 3,061 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:29 PM

Posted 25 April 2015 - 09:03 AM

What precisely is this s.yimg.com thing then(a malicious self installing extension, some rule getting automatically written into the dns or something, a full exe file virus, a plugin)? According to the screen shot you posted it is a yahoo domain, so I would be very surprised to find it going through youtube. Is it coming through adverts on youtube or something?

Edited by rp88, 25 April 2015 - 09:04 AM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#10 RolandJS

RolandJS
  • Topic Starter

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:09:29 AM

Posted 25 April 2015 - 09:45 PM

rp88, I never did research nor find out from other sources exactly what this s.yimg.com is, what & how it does what it does.  I'm hoping a couple of BC tech regulars will tell us what they know, I want to learn from them also.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users