[RisingSun]

Yes it is removed from your computer.

Check again once that what you did here..

4: Now we need to change the default page of IE though regedit.

Start>Run>Regedit

From the below locations in Regedit chage your default home page to google.com or other.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Just replace the attacker site with google.com or set it to blank page.

Have you modified any other option rather than changing only default page ?

[RisingSun]

Do you use Zone Alarm firewall ??????

[navy]

no

[RisingSun]

Just go through this url... you can resolve the problem

http://support.microsoft.com/kb/320159

friend,, .... even i follow the commands u mentioned, i am able to delete temporarily.

whenever i login into yahoo messenger .. the virus nsl-school is attacking, showing additional link as 'you are effected with virus, use this to clean' along with available, busy, not available,....

please suggest me... ( pvdramesh55@yahoo.com)

[preethisingh]

It worked fine for me.

[sunnyhup]

thank u guys for good info..

[yathish]

Thanku admin and evishy.

[rk_ramakrishnamca]

Thank u very much adminstrator.

Thnaks for the Info
But Still my Home page options are disabled.
Please help me

[Admin]

To enable IE use current- use default -use blank options..

Strat>Run>Regedit

Go to this pleace :

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel] -

Right Click on the Homepage & selecet modify. Replace the 1 with 0.

Thats all. let me know if you need any more help.

[RisingSun]

More about this virus :

Method of propagation:
• No own spreading routine


Aliases:
• Kaspersky: IM-Worm.Win32.Qucan.a
• Eset: Win32/KillAV.NBD
• Bitdefender: Win32.Worm.IM.Sohanat.A

It was previously detected as:
• Worm/Qucan.A


Platforms / OS:
• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003


Side effects:
• Disable security applications
• Downloads malicious files
• Registry modification


Files It tries to download some files:

– The location is the following:
• http://64.26.25.75/**********
It is saved on the local hard drive under: %WINDIR%\svhost.exe Detected as: Tr/Dldr.Qucan.A


– The location is the following:
• http://64.26.25.75/**********
It is saved on the local hard drive under: %WINDIR%\svhost32.exe Furthermore this file gets executed after it was fully downloaded. Detected as: Worm/AutoIt.B


Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "svchost"="%WINDIR%\svhost32.exe"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "Task Manager"="%WINDIR%\svhost32.exe"
• "svchost"="%WINDIR%\svhost.exe"



The following registry keys are changed:

– [HKCU\Software\Yahoo\pager\View\YMSGR_buzz]
Old value:
• "content url"=%user defined settings%
New value:
• "content url"="nsl-school.org"

– [HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast]
Old value:
• "content url"=%user defined settings%
New value:
• "content url"="nsl-school.org"

– [HKCU\Software\Microsoft\Internet Explorer\Main]
Old value:
• "Start Page"=%user defined settings%
New value:
• "Start Page"="nsl-school.org"

Process termination List of processes that are terminated:
• bkav2006.exe; Anti-Trojan.exe; ANTS.exe; apvxdwin.exe; ATCON.exe;
ATUPDATER.exe; ATWATCH.exe; AUPDATE.exe; AUTODOWN.exe; AUTOTRACE.exe;
AUTOUPDATE.exe; Avconsol.exe; AVP.exe; AVP32.exe; avpcc.exe; avpm.exe;
AVPUPD.exe; Avsynmgr.exe; AVWUPD32.exe; AVXQUAR.exe; bdmcon.exe;
bdoesrv.exe; bdss.exe; CMGrdian.exe; drwebupw.exe; GUARD.exe;
iamapp.exe; iamserv.exe; ICLOAD95.exe; ICLOADNT.exe; ICMON.exe;
ICSSUPPNT.exe; ICSUPP95.exe; ICSUPPNT.exe; LUCOMSERVER.exe;
MCAGENT.exe; mcupdate.exe; MINILOG.exe; MOOLIVE.exe; NAVAPW32.exe;
NMAIN.exe; NPROTECT.exe; NSCHED32.exe; NUPGRADE.exe; regedit.exe;
regedt32.exe; RuLaunch.exe; Vshwin32.exe; VsStat.exe; zatutor.exe;
zonealarm.exe

File details Programming language:
The malware program was written in Visual Basic.

[Spoorthi]

so much of info.......

than u very much

hi...!!!

i tried this procedure twice/ but it still didnt work for me...!!

int he internet options > general i am not able to change my hoem page.

and when i run >REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f


a window jsut appears adn fades away...

i am sad......

in my yahoo messeger window under the available/ invisible tab....
all these sites appear.... adn suddenly even thogu i am int he invisible mode.... it changes to the visible mode and that msg is sent to all my friend list....

kindly help
rgrds./
Mhj