- This topic has 18 replies, 6 voices, and was last updated 21 years, 9 months ago by
.
-
Posts
-
Hi,
I recently got an instant message from someone i didn’t know with a link attached. STUPIDLY, I clicked on it. Now, when I send out an IM to a buddy the link is there. There are two of them and I have been trying everything to get rid of them. They are yahoo-tv.tk and yahootv.da.ru. I saw in earlier posts that someone was kind enough to show how to get rid of similar virus’s. These are different links so not sure it would work the same way, also, it is my work com and am a little worried about messing around in the registry. Does anyone know of a program I can get that will wipe them out? Any help would be much appreciated.
Thank youDo you have ANY virus protection? If you don’t a free and safe one is AVG You may also want to try the spyware programs that I’m sure you saw on the other posts you looked through earlier (Ad-Aware and Spybot Search & Destroy are good ones…and you should use both BUT use them at separate times.)
mike make sure you tell everyone you chat with not to click on the links 1st of all. when i went to both of the urls you gave both of them tryed to download a file called 8877.exe Yohoo_Update_Java.Javainstaller i didnt download it to know for sure but i think it might be an exploit on sun java.. as for AVG anti virus its a really got freeware anti virus.. you might wanna also look at getting
ad aware
http://www.lavasoftusa.com/software/adaware/and spybot
http://www.safer-networking.org/en/home/index.html
if thay will let you have them on your work computor. this is a stab in the dark but is the Removal Instructions u was reading from http://www.helpbytes.co.uk/removal.phpYes Mdane those were the removal instructions. Just a little to much for me to try and do at work. I was afraid to completley crash the com. I am going to download those to programs and hopefully that works. I did go and do the first step from those removal instructions. They seemed to get rid of the url’s yesterday, but I would like to make sure they are gone for good. Thanks for the info. Thank you to Oreo as well. I’ll let you know how if and how it works.
How do you mean, “didn’t work”?
Spybot S&D will find things that Ad-aware cannot find, and vice versa. As Oreo said, you should use both, but don’t have them scanning at the same time.
I am willing to go in and try the removal instructions that freddy has been generous enough to provide. I don’t know what to look for though as my virus is a completley different url then the one from the other gentleman so I am not sure which programs I should delete. If anyone can help I would greatly appreciate it. Worse comes to worse I just stop using Yahoo messanger, but would rather try and fix the problem.
Thanks again,
Mikemike the only way i have seen that u can really get rid of what you got is with the instrustions from help bytes.. it is a modified version of that virus. you have the 8877.exe and help bytes is talking about the 8879.exe
Quote:help bytes
msroot.exe, mshosts.exe, msrootocx.exe, 8879.exe
ms*sys.exe (where * is anything, but its NOT msgsys, and its 7 letters long before the .exe.)Okay mdane I appreciate your patience with me. ita just that I don’t know what I should delete and shouldn’t delete. There are a lot of things in the start up menu that have kind of fit the descritipn. there is
wow.exe, cmd.exe, ctfmon.exe, svcs.exe, wnstla.exe, spoolsv.exe svchost.exe lsass.exe wowexec.exe qws3270.exe ntvdm.exe, naldaemn.exe rtvscan.exe, isass.exe, csrss.exe, ctfmon.exe and smss.exeDo any of those look suspicious? Again, thank you for all your help. I am just about at my wits end may just quit using the messanger all thogether.
anything you are unsure of i would google befor removeing to see what it dose this will help you find what each 1 of them dose and help you deside what to remove and not to. just take your time man you will get it. dont give up on yahoo just yet.
-wow.exe- is related to spyware. This is serious violation of your privacy, your system is under security threat.
-cmd.exe- allows access to the Microsoft Windows command prompt, also known as Microsoft DOS. To-date, cmd.exe is a 32-bit command prompt used in Windows NT, 2000, and XP and offers disk and file maintainance functions to your computer as well as network functions. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.
that is a couple of them i googled for you. make sure you google them again just to make sure. there was other info on them 2..
good luck!!wow.exe – http://computercops.biz/startuplist-5219.html (delete)
wnstla.exe – unknown?
qws3270.exe – http://www.ilstu.edu/helpdesk/downloads/win/qws3270plus.phtml(if you arent using it, dont know what it is, delete it)
naldaemn.exe – part of lotus notes(if you dont have lotus notes, can it)Firstly, I would go to start->run->msconfig select the startup tab, and see whats running there, before deleting anything.
Removing things from startup is a great way to find out whats causing your pc to screw up
Okay fellas I googled everything and came up with two that were very suspicious. ctfmon is running where it is suppose to be running but also is found as ctfmon.exe-1686EF20.pf in c:winntpreftech it is a pf file.
The real suspicious one is svhosl.exe. Google had no results matching it. it is found twice in that preftch file with a bunch of numbers and letters after it and also in c:programfilesyahoomessenger. I know that svchost is suppose to be on the system but this one doesn’t seem right. Could this be what I am looking for?????
This is kinda fun…..
i think you are on the right track but to make really sure i would also hit up help bytes forum that way he can update his removal instructions and get his point of view on it also
- You must be logged in to reply to this topic.