Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice

how is it possible...

1799 Views 19 Replies 8 Participants Last post by  Davey7549
to lose everyone's things in my documents without even deleting anything??!?!?!?!?!?!?!?

btw attached is my startuplist...


Not open for further replies.
1 - 20 of 20 Posts should go here and run trends online virus scan.

NOW! and come back here with the result.
good luck;)
there is also a recent thread you might want to look at.
hey guys you're right! the trendmicro scanner thingy has come up with:

about like 10-25 worm_yaha.k's

i am going to go onto the symantec website and dl the yaha k remover program. apparently, according to trendmicro, the js_noclose.e is a trojan horse, but is low in damage.
after you get rid of yaha you might want to go here and download "the cleaner" its a trojan specific scanner that will kill any trojans in your system.
post back and let us know alls well.;)
No sign of a trojan in the Startuplist log, though.

However, you don't seem to be running an antivirus, so I'm not entirely surprised you got infected... :rolleyes:
This would be the yaha worm -- (I finally found something that Tony missed, instead of the other way around ;) )

WinServices = C:\WINDOWS\System32\WinServices.exe

The Symantec Tool should remove it. I don't know whether this worm is getting hungrier, but in the ZoneAlarm thread here it may have eaten Add/Remove programs as well.
Originally posted by Rollin' Rog:
This would be the yaha worm -- (I finally found something that Tony missed, instead of the other way around ;) )

I'm afraid I'll have to disappoint you once again... :p

Dirk Diggler already pointed that out before you did.

I'm afraid I did.... :D

As cammi already ran a scan at House Call which detected the virus, I considered it case closed.
Ah....Some healthy competition!:D
I would join in but you guys are way out of my league. I still play double "AA" ball!;) :p

LOL... :D

It's just because I eat Startuplist logs for breakfast, lunch and dinner...

You tend to recognize things after a while.
Sorry to jump in here, but I have a question about the startup list. I looked at it and seen the "C:\WINDOWS\System32\WinServices.exe"

I now know that seeing this in the startup means yaha virus. The thing I don't know is how you all recognized it.

I mean do you just study up on all the new viruses and what they add to the startup, or what?

Sorry to be a noobie here!!

As Tony previously mentioned the more you look at Startups and review them the more you become familiar with what should be in there and what looks suspicious. For instance if you where reviewing allot of peoples startups for diagnostics and thought WinServices.exe looked suspicious you could run a search for it to see if others had reported this. Example through Google: Click Here

You also can review what items people list in startups and for that matter your own by going to several sites such as:

Lastly in Tonys and Rogs case if I am not being out of line I would say they spend a great deal of time at TSG and other forums helping people straighten out Virus, Trojan and other startup problems which makes them very qualified to spot suspicious items.

See less See more
and davey is giving our secrets away:D

soon we will be redudant;)
Redundant!!!!!!:eek: Never Happen!!!!! Someone will conger up another Virus or Application combination to drive us nuts!;)

Its like the rain after its soaks into the ground, maybe hidden from us but it shall return!

Someone will conger up another Virus or Application
now dave thats either a dance you have us doin....or some fishy thing:D
Me Witch Doctor????:eek: Never!:p ;)
Just the lyrics to a tune we have heard a thousand times!

1 - 20 of 20 Posts
Not open for further replies.