Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

What IS yimg.com?


  • Please log in to reply
11 replies to this topic

#1 Wizzlmang

Wizzlmang

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:11:58 PM

Posted 08 May 2015 - 03:24 AM

Looking it up, a lot of people seem absolutely convinced it's a really bad browser hijacker, but I see yimg.com url's pop up in my webshield when ever I visit a yahoo site, an my browser hasn't been hijacked, leading me to assume it's a normal yahoo domaine

So what the hell is it?



BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:09:58 AM

Posted 08 May 2015 - 05:08 AM

Hi,

it's a yahoo domain. You can look at the registration information here: http://www.whois.com/whois/yimg.com and you will find that it is registrated for yahoo! inc.
It is part of their content delivery network, making pages load faster (hopefully) and distributing the load of the requests over multiple servers. I would guess that yimg stands for yahoo images. So any kind of multimedia content is probably going to be coming from there.


The reason that yimg.com is often refered to as malicious is based on fear and misinformation basically:
1)it seems to often be the slowest link, so many people notice it loading and slowing down their web experience when they didn't even request it opened, they worry it might eb malware.
2) It is a multimedia furnisher, therefore often uses flash, people see popups requesting yimg.com to store flash objects on their machine and don't know what it is and worry about the worst case.
They assume the worst and go to google. In comes the guy that wants to make a profit:
Lots of people search for something as a virus causes, let's call them dubious, programs and resellers to push their sales by offering themselves as removal tool on dedicated websites or removal pages. So now there are plenty of people worried this might be a virus and plenty of people eager to make you believe that it is a virus so you will buy their product.
At this point it becomes a self feeding process. Anyone coming online with "yimg.com" problems only gets virus-hits on google, then contributes by saying it's a virus, which causes the google hits to yield even more virus hits and even the people that are genuinely trying to help you (eg for free on forums) get dragged in because at this point it is reallly hard to find a single source saying this is not malware.

regards
myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#3 rp88

rp88

  • Members
  • 2,999 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:58 AM

Posted 08 May 2015 - 01:04 PM

There was a thread recently about this domain doing something to firefox users visiting youtube. The thread is linked to below.


http://www.bleepingcomputer.com/forums/t/574221/syimgcom-from-youtubing-within-firefox;-fixed-wleachblock-xpi/

Note that this yimg thing is NOT the same as ytimg, ytimg is a domain belonging to google which is involved in the playing of youtube videos (yes, very confusing that both yimg and ytimg should be appearing on youtube for some users).

Edited by rp88, 08 May 2015 - 01:04 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#4 RolandJS

RolandJS

  • Members
  • 4,519 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:02:58 AM

Posted 08 May 2015 - 01:48 PM

Sillyberry, you're probably right as rain!  I'm not home to review my earlier records.  As rp88 mentions, I probably confused s.yimg.com and s.ytimg.com! Topic 574221 concerned Firefox, youtube & the y-thingy. I cannot remember calling such malware or spyware or virus.

 All I was indicating is:

-- it [yimg or ytimg] simply dorked up some of my sessions with undeletable tabs within said sessions

-- each unloadable youtube video became an undeletable tab in whatever session was open

So, I simply rebuilt my sessions and "blacklisted" the y-thingy.Com in LeachBlock.  If others want to call such a virus, or spyware, or malware -- that's on them.


Edited by RolandJS, 08 May 2015 - 01:49 PM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#5 rp88

rp88

  • Members
  • 2,999 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:58 AM

Posted 09 May 2015 - 01:22 PM

I've been to youtube recently and haven't noticed anything to do with yimg. If it had done something to me and installed itself in my browser I wouldn't know how to spot this anyway though.


I did spot ytimg as a domain to let through or block in noscript, ytimg is a google domain which you have to allow temporarily when you want to play a youtube vid, it also somtimes contains images used on other google pages and services.

yimg certainly exists and maybe it does sometimes want to load on youtube (probably coming from an advert if anywhere), but the yimg and ytimg are quite different things, the latter will always want to load when you visit youtube. ytimg shouldn't have messed up anything, it is quite safe. yimg, I don't personally know about.

Edited by rp88, 09 May 2015 - 01:26 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#6 Al1000

Al1000

  • Global Moderator
  • 7,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:08:58 AM

Posted 09 May 2015 - 04:00 PM

Interesting. I have both yting.com and ying.com whitelisted in NoScript. I don't recall why I whitelisted ying.com, so I'll remove it from the list for the moment.

I searched the internet for information on it, and several people think it has something to do with Yahoo tracking.

#7 rp88

rp88

  • Members
  • 2,999 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:58 AM

Posted 10 May 2015 - 10:29 AM

AI1000: those should be yimg and ytimg, not ying and yting.If it comes to whitelisting in NoScript, maybe both come as default whitelisted, but yimg probably doesn't need to be. ytimg doesn't NEED to be either but whitelisting it might make it a few seconds quicker for you to get a youtube video to play.
Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#8 Patricia Williamson

Patricia Williamson

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:28 PM

Posted 14 May 2015 - 06:44 AM

Yimg.com is a domain which is used by yahoo buzz.It is an widget company and a part of networking sites and other technologies used for user tracking.

 



#9 Al1000

Al1000

  • Global Moderator
  • 7,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:08:58 AM

Posted 20 May 2015 - 08:49 AM

It's also necessary for viewing the comments under Yahoo News articles.

That was probably why I whitelisted it.

#10 one1nee

one1nee

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:02:58 PM

Posted 24 July 2015 - 11:27 PM

um.. i just realised that NoScript suddenlt blocked lots of scripts, that now i got 'Scripts Partially Allowed" in every webpage i visited, including the ones i usually visit daily/often. Including Ymail page. i have blocked yimg.com and now i cant see my emails list. So, is this yimg is harmful or harmless? should i allowed it in NoScript?



#11 Al1000

Al1000

  • Global Moderator
  • 7,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:08:58 AM

Posted 25 July 2015 - 01:28 AM

It will be fine.

 

I would go by what myrti said in post #2.



#12 Emack

Emack

  • Members
  • 1 posts
  • OFFLINE
  •  

Posted 01 February 2016 - 11:49 PM

Dss




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users