[RisingSun]

You can't change the home page through INternet option.. you have to change it through Regedit. Fallow this step..

4: Now we need to change the default page of IE though regedit.

Start>Run>Regedit

From the below locations in Regedit chage your default home page to google.com or other.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Just replace the attacker site with google.com or set it to blank page.

[RisingSun]

99.999999999% It works for any computer that is infected with this dirty virus.

[RisingSun]

Originally Posted by mhj

hi...!!!

i tried this procedure twice/ but it still didnt work for me...!!

int he internet options > general i am not able to change my hoem page.

and when i run >REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f


a window jsut appears adn fades away...

i am sad......

in my yahoo messeger window under the available/ invisible tab....
all these sites appear.... adn suddenly even thogu i am int he invisible mode.... it changes to the visible mode and that msg is sent to all my friend list....

kindly help
rgrds./
Mhj

Yes A window just appears & fades a way.. after this you can enter Regedit..

Originally Posted by RisingSun

Kill the process by statrting the comp in safe mode.

I tried to end those processes in safe mode but my computer just restarts 60sec after I try to end them. And as soon as I end one process the one I ended before restarts and so on. There are 3 svchost.exe processes and I can't end all of them at the same time. Please advice. Thank you.

[RisingSun]

ooooops do not kill svchost.exe. You have to kill svhost32.exe .

Got my point ? svchost.exe is a system file.. if you kill tht process it will shutdown the PC in 1 minute. To avoid shutdown go to RUN & type Shutdown -A .

[sudeepdube]

We were able to enable regestry n the task manager. There is a process called SVCHOST.EXE runing. Is this to be deleted too?? And when we r trying to delete this process (there are 3 such process running) the system starts shutting down automatically in 1 minute.
We changed the homepage but when the system restarts (The page gets changed to google by modifying the registry, but the field is disabled in the IE properties) the nfl-homepage is agan set as default.
Please help!!! Its Exam time here....
The Thanx is pending till the problem is finally resolved....pls pls pls HELP!!!!!

[RisingSun]

1 : Do not kill SVCHOST.EXE process. U need to kill only svhost32.exe process.

2:To enable IE use current- use default -use blank options..

Strat>Run>Regedit

Go to this pleace :

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel] -

Right Click on the Homepage & selecet modify. Replace the 1 with 0.

Thats all. let me know if you need any more help.

Go through the above steps.. it will be fine.

[farnoud]

use firefox! this virus uses IE bug to download and exec itself.

[invincible]

thanks everybody

got rid of tht stuff,watever tht was


so indeed this virus was beneficial, becoz i found this community
looking fwd to learn more frm this community...

thanks

[invincible]

Originally Posted by FRIEND

friend,, .... even i follow the commands u mentioned, i am able to delete temporarily.

whenever i login into yahoo messenger .. the virus nsl-school is attacking, showing additional link as 'you are effected with virus, use this to clean' along with available, busy, not available,....

please suggest me... ( pvdramesh55@yahoo.com)

Hi FRIEND, u can change tht message

goto messenger/my status...
(here u can see the message being displayed, the virus & all)
simply click to NEW STATUS MESSAGE.

give 5-7 new status messgs & ur virus messages will disappear

To all, u shud also delete the archive od ur yahoo messenger( y take chancs)

Originally Posted by evishy

There is a very bad virus attack on Yahoo Messenger where it will take control of your messenger and without your knowledge sends some messages with a website links which contains the virus, to your friends list, remind you without YOUR KNOWLEDGE so be careful, try to do the following things to remove if your are effected.

Start Menu >> Run

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

copy & paste in run & press enter

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

copy & paste in run & press enter

& delete the files svhost32.exe from ur comp & temp folder after killing the process

Regards
Evishy

Dear Evishy
i did exactly what you said
But didnt work out
i get the below message:

damn, she is so cute :x nsl-school.org?id=miss_world :x:x:x:x:x
plz help me
my email:
megamotors@gmail.com
thank you for ur help

[Francis Vimal]

Thanks for this wonderful advice.

Hi
When I try to open Regedit, I receive below msg and It won't open:
" Registry editing has been disabled by your administrator"
Please tell me what to do to stop this.

[RisingSun]

Go through this step properly..

2: To enable Regedit

Click Start, Run and type this command exactly as given below: (better - Copy and paste)

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Thanks alot for all your valuable information. I have completely removed thisvirus from my machine with all the information provided by Admin.

Thanks
Sankalp Bajpai