HAPPY

HELP ME PLEASE

MY PC BOOTS AND AUTOMATICALLY LOGS ME ON AND AWAY I GO!

AT THE MOMENT IT FIRES UP TO DESKTOP( STOP SHOUTING! ) and i can veiw photo's etc and browse the net but thats it!
any operation using other applications denies me entry saying i do not have authority.i cannot open anything in the control panel, i cannot open outlook express. i have nio other accounts open so i must be the administrator!

any suggestions as i really do not want to reset to zero with the recovery disk.
i am not authorised to do a system restore!( so it says )
pete

Hanley

Have you tried 'Log Off' and see what available logons it gives you at the front screen?

HAPPY

it just gives me "me" no other accounts

pete

HHxx

How about hitting Ctrl>Alt>Del a couple of times on the login screen and try "administrator" with a blank password.

H

monkeyboy

Watch the boot process and hit F8 (i think) and boot into safe mode. This should then either present you with a login screen or give you enough rights to change your account.

MB

HAPPY

looks like i have
w32.yaha.k@mm virus

it has disabled my norton and fu**ed everything up by the looks of it

BuRR

Solution:

Identifying the Malware Program

Before proceeding to remove this malware, first identify the malware program.

Scan your system with Trend Micro antivirus and NOTE all files detected as WORM_YAHA.K. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's free online virus scanner.

Terminating the Malware Program

This procedure terminates the running malware process from memory. You will need the name(s) of the file(s) detected earlier.

Open Windows Task Manager.
On Windows 9x/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, and click the Processes tab.
In the list of running programs*, locate the malware file or files detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On systems running Windows 9x/ME, Task Manager may not show certain processes. You may use a third party process viewer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.

Resetting the Mouse Configuration

The malware swaps the functions of the left and right mouse buttons as a payload. Follow these instructions to reset your mouse configuration.

Open Control Panel. Click Start>Settings>Control Panel.
Select Mouse, then press Enter.
In the Buttons Tab, pick either Right-handed or Left-handed depending on your original configuration. Click OK.
Close Control Panel.
Addressing Registry Shell Spawning

Registry shell spawning executes the malware when a user tries to run an .EXE file. The following procedures should restore the registry to its original settings.

Click Start>Run.
In the Open input box, type:
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com
Press Enter.
In the left panel, double-click the following: HKEY_CLASSES_ROOT>exefile>shell>open>c ommand
In the right panel, locate the registry entry: Default
Check whether its value is the path and filename of the malware file.
If the value is the malware file, right-click Default and select Modify to change its value.
In the Value data input box, delete the existing value and type the default value: "%1" %*
Close Registry Editor.
Click Start>Run, then type: command /c del %WinDir%\regedit.com
Press Enter.
Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

Open Registry Editor again. To do this, click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries:
"WinServices" = %System%\WinServices.exe
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunServices
In the right panel, locate and delete the entry or entries:
"WinServices" = %System%\WinServices.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 9x and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP.)
Close Registry Editor.
NOTE: If you were not able to terminate the malware process from memory as described in the previous procedure, restart your system.
To Unhide Personal Folder

Enable Show All Files
Open Windows Explorer. Right-click Start then click Explore.
Enable the Show All Files option:
On Windows 9x/NT:
On the View menu, click Options or Folders Options.
Click the View tab.
Select “Show all files,” then click OK.
On Windows 2000/ME/XP:
On the Tools menu, click Folder Options.
Click the View tab.
Select “Show hidden files and folders,” then click OK.
In Windows Explorer, access your usual personal folder, which should be visible by now. The personal folder is usually C:\My Documents.
Right-click the folder and click properties.
In the Attributes section, uncheck Hidden and click OK.
On Windows 9x/NT, repeat the process for all files and folder inside your personal folder.
On Windows ME/2000/XP, select to Apply changes to this folder, subfolder and files.
Close Windows Explorer.

BuRR

I know its late now, but if you got a mail with one of the following headings:

Are you a Soccer Fan ?
Are you beautiful
Are you the BEST
Check it out
Demo KOF 2002
Feel the fragrance of Love
Freak Out
Free Demo Game
Free rAVs Screensavers
Free Screenavers of Love
Free Screensavers
Free Screensavers 4 U
Free Win32 API source
Free XXX
Hardcore Screensavers 4 U
I Love You..
Jenna 4 U
Learn SQL 4 Free
Lovers Corner
Need money ??
One Hacker s Love
One Virus Writer s Story
Patch for Elkern.gen
Patch for Klez.H
Play KOF 2002 4 Free
Project Sample Screensavers
Sample KOF 2002
Sample Playboy
Screensavers from Club Jenna
Sexy Screensavers 4 U
The King of KOF Wanna Brawl ??
Things to note
Visit us
Wanna be a HE-MAN
Wanna be friends ?
Wanna be friends ?
Wanna be like a stone ?
Wanna be my sweetheart ??
Wanna Hack ??
Wanna Rumble ??
We want peace
Whats up
Who is your Valentine
World Tour
WWE Screensavers
XXX Screensavers 4 U

- Tekst van het bericht: [wisselend, een van onderstaande]
OF/OF:

hey,
did u always dreamnt of hacking ur friends hotmail account..
finally i got a hotmail hack from the internet that really works..
ur my best friend thats why sending to u..
check it..just run it..enter victim s address and u will get the pass.

hi,
check the attached love screensaver
and feel the fragrance of true love..

Hi,
check the attached screensaver..
its really wonderfool..
i got it from freescreensavers.com

Hi,
check ur friends circle using the attached friendship screensaver..
check the attached screensaver
and if u like it send it to all those you consider
to be true friends... if it comes back to you then
you will know that you have a circle of friends..

Hi,
check the attached screensaver
and enjoy the world of friendship..

Hi,
are u in a rocking mood...
check the attached scrennsaver and start shaking..

Hi,
Check the attached screensaver..

Hi,
Are you lonely ??..
check the attached screensaver and
forget the pain of loneliness

Hi,
Looking for online pals..
check the attached friend finder software..

Hi,
sending you a screensaver..
checkit and let me know how it is...

Hi,
Check the attached screensaver
and feel the fragrance of true love...

Hey,
I just got this wonderfull screensaver from freescreensaver.com..
Just check it out and let me know how it is..

Hi,? I just came across it.. check out..??

that was probably it.

HAPPY

problen sorted!!!!!!

smart restore in safe mode to dec 24th

when it started up again ran norton update scanned pc and found it

i think that my live update has not been working automatically since going to broadband. it still tries to go through the dialup which is disconnected

still its sorted!!!!!!!

i took the pc to pc world and they told me my only option was to reformat the hard drive!! no mention of a virus at all. i am not really very up on computers but i sussed that out after a few hours of investigating!!

thanks for all your imput guys

pete