Yahoo Messenger Virus 2

Lately we often see our friend in the friends list in yahoo messenger send a message that contains a link that actually is a virus that can threaten computer without aware if we do click of the link.

So, before the incident occurred. There are 6 well you see how right to eradicate the virus attacks the application of this chat:

1. Disable 'System Restore' during the cleaning process.
2. Disable Windows autorun, so the virus can not be activated automatically when the access to the drive / flash disk.

* Click the 'start'
* Click 'run'
* Type 'GPEDIT.MSC', without quotes. Then the screen will display 'Group Policy'
* In the 'Computer Configuration and User Configuration,' click 'Administrative templates'
* Click the 'System'
* Right click on 'Turn On Autoplay', select 'Properties'. Then the screen will appear 'on Tun Autoplay propeties'
* In the tabulation 'Settings', select' Enabled '
* In the 'Tun off Autoplay on' select 'All drives'
* Click 'Ok'


3. Turn off the virus, use the tools' security task manager 'and delete the file [sysmgr.exe, vshost.exe, winservices.exe, *. tmp]

Just a note,. Tmp files that have indicated an extension TMP [example: 5755.tmp]. Right-click on the file and select 'Remove', select the option 'Move files to Quarantine.

4. Repair registry that has been modified by the virus. To speed up the process of elimination, please copy the script below on the notepad program and save it with the name repair.inf. Run the file in the following manner: repair.inf Right-click, and select install.

[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee


[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del


[UnhookRegKey]

HKLM, Software \ CLASSES \ batfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ comfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ exefile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ piffile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ regfile \ shell \ open \ command,,, "regedit.exe"% 1 ""
HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"
HKCU, SessionInformation, ProgramCount, 0x00010001, 3
HKCU, AppEvents \ schemes \ Apps \ Explorer \ BlockedPopup \. Current,,, "C: \ WINDOWS \ media \ Windows XP Pop-up Blocked.wav"
HKCU, AppEvents \ schemes \ Apps \ Explorer \ EmptyRecycleBin \. Current,,, "C: \ Windows \ media \ Windows XP Recycle.wav"
HKCU, AppEvents \ schemes \ Apps \ Explorer \ Navigating \. Current,,, "C: \ Windows \ media \ Windows XP Start.wav"
HKCU, AppEvents \ schemes \ Apps \ Explorer \ SecurityBand \. Current,,, "C: \ WINDOWS \ media \ Windows XP Information Bar.wav"

[del]

HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, Microsoft (R) System Manager
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Run, help bMaxUserPortWindows Service
HKLM, SYSTEM \ CurrentControlSet \ Services \ TCPIP \ Parameters, MaxUserPort

5. Remove virus file below:

C: \ vshost.exe [all drives]

C: \ autorun.inf [all drives]

C: \ RECYCLER \ S-1-5-21-9949614401-9544371273-983011715-7040 \ winservices.exe

C: \ Documents and Settings \% username% \ Local Settings \ Temp

A415.tmp [random]

034.exe [random]

Lady_Eats_Her_Shit - www.youtube.com

C: \ WINDOWS \ system32 \ sysmgr.exe

C: \ WINDOWS \ Temp \ 5755.tmp

C: \ windows \ system32 \ crypts.dll

C: \ windows \ system32 \ msvcrt2.dll

6. For optimal cleaning and prevent re-infection, please use the antivirus can detect and eradicate this virus up to date.

You can also download tools in Norman Malware Cleaner http://download.norman.no/public/Norman_Malware_Cleaner.exe

Quoted from www.detikinet.com on 26 March 2009