Username: Save?
Password:
Home Forum Links Search Login Register*
    News: Welcome to the TechnoWorldInc! Community!
Recent Updates
[March 06, 2024, 02:45:27 PM]

[March 06, 2024, 02:45:27 PM]

[March 06, 2024, 02:45:27 PM]

[March 06, 2024, 02:45:27 PM]

[February 14, 2024, 02:00:39 PM]

[February 14, 2024, 02:00:39 PM]

[February 14, 2024, 02:00:39 PM]

[February 14, 2024, 02:00:39 PM]

[February 08, 2024, 10:26:18 AM]

[February 08, 2024, 10:26:18 AM]

[February 08, 2024, 10:26:18 AM]

[February 08, 2024, 10:26:18 AM]

[November 27, 2023, 06:32:12 PM]
Subscriptions
Get Latest Tech Updates For Free!
Resources
   Travelikers
   Funistan
   PrettyGalz
   Techlap
   FreeThemes
   Videsta
   Glamistan
   BachatMela
   GlamGalz
   Techzug
   Vidsage
   Funzug
   WorldHostInc
   Funfani
   FilmyMama
   Uploaded.Tech
   MegaPixelShop
   Netens
   Funotic
   FreeJobsInc
   FilesPark
Participate in the fastest growing Technical Encyclopedia! This website is 100% Free. Please register or login using the login box above if you have already registered. You will need to be logged in to reply, make new topics and to access all the areas. Registration is free! Click Here To Register.
+ Techno World Inc - The Best Technical Encyclopedia Online! » Forum » THE TECHNO CLUB [ TECHNOWORLDINC.COM ] » Computer / Technical Issues » Messengers / Chats
 Removing the Yahoo / AOL / MSN Messenger Virus
Pages: [1]   Go Down
  Print  
Author Topic: Removing the Yahoo / AOL / MSN Messenger Virus  (Read 6760 times)
Mark David
Administrator
Super Elite Member
*****



Karma: 185
Offline Offline

Posts: 1624

!!!Techno King!!!

fabulous_designer
View Profile WWW
Removing the Yahoo / AOL / MSN Messenger Virus
« Posted: July 17, 2007, 12:31:52 PM »


Removing the Yahoo / AOL / MSN Messenger Virus

Virus Name: W32 Sohanad.B or W32 Sohanad.C

This is a worm that spreads itself by sending links to your contacts in Yahoo, AOL and Windows Live messengers. It disables the Registry Editor and Task Manager, changes the Internet Explorer (IE) home page and also modifies registry such that you cannot change the homepage address. For more details on this worm, read the TrendMicro virus Information.


Here are simple steps to get this worm removed from your system:

1) Download the attached file below and unzip it using Winzip or Winrar..
[Note: If u cant See the attached file, Please Login with your id]

2) Double click on the downloaded exe file, it will execute to restore from the damage done to registry by the worm.

3) Restart your system.

4) Delete the file svhost32.exe from your Windows folder( If it is present).

5) Delete the file svhost.exe from your Windows folder( If it is present).


And the silly worm's story ends!!!
You can now use the Yahoo messenger peacefully.

By the way, I have a suggestion for you: Use Firefox browser to avoid such worm attacks in future. It is much more secure than the Microsoft Internet Explorer.

Source: TechnoWise

« Last Edit: July 17, 2007, 12:36:28 PM by Mark David » Logged

« Reply #1 Posted: July 29, 2007, 10:28:04 PM »
Mark David
Administrator
Super Elite Member
*****



Karma: 185
Offline Offline

Posts: 1624

!!!Techno King!!!

fabulous_designer
View Profile WWW
Yahoo messenger virus attack - Remove It From Your Affected Computer
« Reply #1 Posted: July 29, 2007, 10:28:04 PM »

This Yahoo messenger virus attack is one of the most powerful Trojan /virus.. If your computer is infected with this virus; It will sends the nsl-school.org url to all of your friend list in yahoo messenger using your ID . So with in few hours many of your friends will get infected with it.

To solve this problem, Just go through the below steps carefully.

What are those links ?:

Nsl-school.org or other (Do not open this url in your browser).

If you are infected with it what is going to happen ?

1: It sets your default IE page to nsl-school.org, you can’t even change it back to other page. If you open IE from your comp some malicious code will automatically executed into your computer.

2: It will disables the Task manager / reg edit. So you can’t kill the Trojan process anymore.

3: Files that are gonaa installed by this virus are svhost.exe , svhost32.exe , internat.exe.

You can find these files in windows/ & temp/ directories.

4: It will sends the secured & protected information to attacker

How to remove this manually from your computer ?

1: Close the IE browser. Log out messenger / Remove Internet Cable.

2: To enable Regedit

Click Start, Run and type this command exactly as given below: (better - Copy and paste)

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

3: To enable task manager : (To kill the process we need to enable task manager)

Click Start, Run and type this command exactly as given below: (better - Copy and paste)

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

4: Now we need to change the default page of IE though regedit.

Start>Run>Regedit

From the below locations in Regedit chage your default home page to google.com or other.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Just replace the attacker site with google.com or set it to blank page.

5: Now we need to kill the process from back end. Press Ctrl + Alt + Del

Kill the process svhost32.exe . ( may be more than one process is running.. check properly)

6: Delete svhost32.exe , svhost.exe files from Windows/ & temp/ directories. Or just search for svhost in your comp.. delete those files.

7: Go to regedit search for svhost and delete all the results you get.
Logged
« Reply #2 Posted: September 08, 2007, 03:34:53 PM »
Hellraiser
TWI Trailblazer
*******



Karma: 3
Offline Offline

Posts: 2476


View Profile
Re: Removing the Yahoo / AOL / MSN Messenger Virus
« Reply #2 Posted: September 08, 2007, 03:34:53 PM »

great info..
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Copyright © 2006-2023 TechnoWorldInc.com. All Rights Reserved. Privacy Policy | Disclaimer
Page created in 0.074 seconds with 24 queries.