how is it possible...

[cammi]

to lose everyone's things in my documents without even deleting anything??!?!?!?!?!?!?!?

btw attached is my startuplist...

 

[Dirk Diggler]

Think you've been hit by the Yaha virus:-
Yaha virus definition

 

[$teve]

cammi.....you should go here and run trends online virus scan.
http://housecall.trendmicro.com/

NOW! and come back here with the result.
good luck

 

[$teve]

there is also a recent thread you might want to look at.

http://forums.techguy.org/t111083/s.html

 

[cammi]

hey guys you're right! the trendmicro scanner thingy has come up with:

about like 10-25 worm_yaha.k's
js_noclose.e

i am going to go onto the symantec website and dl the yaha k remover program. apparently, according to trendmicro, the js_noclose.e is a trojan horse, but is low in damage.

 

[$teve]

after you get rid of yaha you might want to go here www.moosoft.com and download "the cleaner" its a trojan specific scanner that will kill any trojans in your system.
post back and let us know alls well.

 

[TonyKlein]

No sign of a trojan in the Startuplist log, though.

However, you don't seem to be running an antivirus, so I'm not entirely surprised you got infected...

 

[Rollin' Rog]

This would be the yaha worm -- (I finally found something that Tony missed, instead of the other way around )

WinServices = C:\WINDOWS\System32\WinServices.exe

The Symantec Tool should remove it. I don't know whether this worm is getting hungrier, but in the ZoneAlarm thread here it may have eaten Add/Remove programs as well.

 

[TonyKlein]

Originally posted by Rollin' Rog:
This would be the yaha worm -- (I finally found something that Tony missed, instead of the other way around )

I'm afraid I'll have to disappoint you once again...

Dirk Diggler already pointed that out before you did.

Cheers,

 

[Rollin' Rog]

I know, I saw it, but thought you didn't

 

[TonyKlein]

I'm afraid I did....

As cammi already ran a scan at House Call which detected the virus, I considered it case closed.

 

[Davey7549]

Ah....Some healthy competition!
I would join in but you guys are way out of my league. I still play double "AA" ball!

Dave

 

[TonyKlein]

LOL...

It's just because I eat Startuplist logs for breakfast, lunch and dinner...

You tend to recognize things after a while.

 

[dtugg]

Sorry to jump in here, but I have a question about the startup list. I looked at it and seen the "C:\WINDOWS\System32\WinServices.exe"

I now know that seeing this in the startup means yaha virus. The thing I don't know is how you all recognized it.

I mean do you just study up on all the new viruses and what they add to the startup, or what?

Sorry to be a noobie here!!

dtugg

 

[Davey7549]

dtugg
As Tony previously mentioned the more you look at Startups and review them the more you become familiar with what should be in there and what looks suspicious. For instance if you where reviewing allot of peoples startups for diagnostics and thought WinServices.exe looked suspicious you could run a search for it to see if others had reported this. Example through Google: Click Here

You also can review what items people list in startups and for that matter your own by going to several sites such as:

http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
Also
http://www2.whidbey.net/djdenham/Uncheck.htm
also
http://www.pacs-portal.co.uk/startup_content.htm

Lastly in Tonys and Rogs case if I am not being out of line I would say they spend a great deal of time at TSG and other forums helping people straighten out Virus, Trojan and other startup problems which makes them very qualified to spot suspicious items.

Dave