I don’t think that’s possible

Unfortunately, I am being told my instructions are not fixing the new combinations. This is a pain, as my instructions are the closest you’ll find on the net, yet don’t help.

I cannot infect myself, because all the links are again dead, it doesn’t take long for ISPs to notice the traffic or receive reports.

If no virus scanner has worked for you, there is a few things that you can do to help me see the full picture.

1) We can try and stop the virus by stopping it at startup. Do this, open regedit. Navigate down the left to:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun

Click on the word run if you didn’t already. Go to Registry>>Export Registry file…. Save it somewhere appropriate, such as your desktop, as sample1.reg.

I don’t know the specific rules regarding you posting the output here, or me recommending you email it to me. But you could paste it here by opening the .reg file in notepad (right click the file, click open with… and select notepad). Edit>>select all, edit>>copy. Then paste it in a new reply, right click, select paste.

2) A hijack this report. If you have hijack this, run it, and send me the report, these reports are very long and meaningless if you don’t understand it. DONT let hijack this fix anything, most it finds are safe things, so DONT let it do anything to them. If you want to email it to me, save it as sample2.txt.

3) Press ctrl+alt+del. Go onto the processes tab. take an screen cap of it. Press and hold alt on your keyboard, then press print screen, or ptr scr or however its spelt. Go to microsoft paint, edit>>paste, then save it, any format will do so long as the text is legible.

From these 3 things, I should be able to determine the bad files, processes etc… and tell you what to delete and end.

The latest instructions have several file names, in all steps where I say search for, or look in regedit, or look in process list, that applies to all the file names listed. Leaving just one file will leave the infection.

/goto username
/join roomname

simply type those in the same place you type your text. Replace username with the Yahoo! Username(“Yahoo! ID”) of the person you wish to go to, replace roomname with the Yahoo! Room you wish to join.

They changed the way the infection worked.

I have recently updated the instructions to include a whole new amount of file names.

There is an order to do the things in, and that’s my order.

If a program is in memory, you may well delete it from the startup, you may even delete it’s file on disk, but at shutdown it will re materialise, because they are clever. So things must be taken out of memory, then deleted and removed. You only have to leave one part of it in memory, and it re creates its self. There may be more filenames, but I really can’t be sure of these, there is no info on the net regarding the infection, and nothing has detected it so far.

I recommend looking in msconfig (start, run, type msconfig) then click startup. Look at the commands, if you are not sure of some of them, paste them here and I can take a look. The ones I added recently where 8879.exe msroot msrootup and msrootocx. These are the ones installed by those urls mentioned by goforit, other URLs exist also.

I thought that when you existed messenger the stealth settings all reset to defaults, so it wouldn’t matter anyway??

You need to click the key on the left hand side, it could have any code. Make sure the right details are on the right, then press the delete button the keyboard to make sure it goes. It certainly worked in other versions of messenger, you are talking about the Yahoo! Messenger item in the tools menu yes?

Try here:

http://www.geocities.com/wnkt/PlayingMusic.html

On my XP system it could be removed from add/remove, on my 98 system, it’s not in add/remove.

It can be manually removed from the registry:

HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerExtensions{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}

Deletion of that key will result in it going off the tools menu. The code in the { } is likely to be different, so just do down the list of them, and look on the right for the one that has the ButtonText as Yahoo! Messenger