Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with many people and that could reduce Google Adsense income.

After some research I found that it is because "yontoo layers runtime" from yontoo (tagline says: Platform that allows you to control the websites you visit everyday.) but actually they are taking over. I am not sure with which software they are making a way into users computer but that seems very bad in terms of freedom of Internet and advt/marketing industry. I don't remember I have ever said "yes" to install yontoo on my computer. This piece of software is successful to install itself on my laptop/desktop and workstation at office.

I am going to disable it now but the question is how do I make my websites aware of Yontoo Runtime and stop them from replacing Google Ads?

Basically they are not able to replace all adsense ads but so far they are successfully replaced 1st instance of adsense advt and I am sure in future they will hit more.

There could be 2 approaches 1) Fool yontoo runtime by putting some misleading divs in html document to save actual ads, 2) Completely disable yontoo by working out some client side script (javascript) which can fail/crash yontoo runtime and so will fail it's purpose of replacing ads.

You can visit my blog (http://blogs.digitss.com) and see on top-right corner, if you find that Google ad replaced with something similar to image attached with question - it means your computer/browser is infected too.

Looking forward to reply from webmasters, if someone has already wrote some code/plugin to make website (and Google ads) safe from yontoo or similar runtime.

FYI: it was able to push this runtime in all browsers installed on machine. So a dangerous threat. And yes, I am just using Google ads - not sure if yontoo runtime is doing trick against other ad networks or not? I am sure they must be doing it with some handful of ad networks.

http://www.contenko.com search

  • Voting for move to SuperUser. As far as I can tell, this isn't site-related, but something that runs on the observing user's computer, probably piggy-backing on the installation of some other application like those annoying browser search toolbars, etc.
    – Su'
    Commented Jun 24, 2012 at 17:37
  • @Su' you're right it's on the end user computer but the question here is how do we protect adsense ads by making some changes in our website in such a way that even if user has browser addon installed we can still show the actual ads on website, instead of this hacked ads by such unknown runtime which can take advantage of we running website.
    – deej
    Commented Jun 24, 2012 at 17:51

1 Answer 1


Have you tried a replace script yourself? For example, if your ads are in their own container then you could have an external JS (or jQuery) onmouseover event that would swap the content for your ad content.

If it works then you know they are swapping the content on the page load. If it doesn't then you should try to swap onmousedown to hijack their redirect when it is triggered.

Lastly you could listen for onunload and swap (via redirect) the hijacked links there.

Remember you want to make sure you are only replacing links that were hijacked so you should be checking for affiliate codes that are incorrect or adsense id's that not yours etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.