Yahoomail ! highly secured by Viruses.........

hdsk.23 · 15-03-2007, 04:09 PM

Yahoo is so badly attacked by the Virus name "W32.Sality.U"
However they detect it but are fail to clean it.
This virus spreads through itsself through mail with with help of attachments and then replicates itself by sending itself to that user contacts list. You will receive mails having attachments with extension .pif then means it is going to be an virus!!!!!!
Why yahoo scans its whole server to clean or delete mails infected mails!!!!!!

Details of the virus What it does n how to clean it are below:

SUMMARY
Discovered: August 8, 2006
Type: Virus
Infection Length: 20,480 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
W32.Sality.U is a virus that spreads by infecting executable files and drops a copy of W32.HLLP.Sality. It is a variant of W32.Sality.S.
Removal: Easy

When W32.Sality.U is executed, it performs the following actions:

1. Drops the following file:

%System%\vcmgcd32.dll (Detected as W32.HLLP.Sality)

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

2. Appends the following lines to the file %Windir%\System.ini:

[MCIDRV_VER]
DEVICE=[RANDOM_NUMBER]

Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

3. Injects this .dll file into all running processes.

4. Resides in memory and infects all portable executable files it finds.

MANUAL REMOVAL:

1. Disable System Restore (Windows Me/XP). [how to]
2. Update the virus definitions.
3. Run a full system scan and delete all infected files.

4. Edit the System.ini file.

a) Click Start > Run.
b) Type the following:
- edit c:\windows\system.ini
and then click OK.

(The MS-DOS Editor opens.)

c) Look for lines similar to the following and delete them:
[MCIDRV_VER]
DEVICE=[RANDOM_NUMBER]

5. Reboot your computer in safe mode. [how to]

6. Run a full scan again to ensure that infected files are gone.

7. In order to make sure that W32.Sality.U is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software.

hdsk.23 · 15-03-2007, 05:42 PM

hah

Yahoo! lover(Indyan) dont get sentimental
this virus is only in Yahoomail!
not in Hotmail, not in Gmail, not in Rediffmail, not in Indiatimes, not in walla.com, not in Inbox.com, not in fastmail, not in aimmail, not in goowymail, not in bigstring.com, not in mywayemail, not in care2email, then why ONLY AND ONLY AND ONLY YAHOO MAIL!

mediator · 15-03-2007, 05:53 PM

Ya i recieved it plenty of times and it can be easily inferred that its a virus!

hdsk.23 · 15-03-2007, 06:02 PM

anyone will also have receive it from your mail id.....
it is so smart

Shasanka_Gogoi · 15-03-2007, 06:03 PM

I used Yahoo previously but nt now!

hdsk.23 · 15-03-2007, 06:12 PM

no this doesn't means stop using Yahoo mail! this is only alert type
as many people directly download the attachment as if it comes from there friends!!!!
One must scan the attachment before downloading....

piyush gupta · 15-03-2007, 06:17 PM

Please specify source

Quote:

Originally Posted by hdsk.23

Yahoo is so badly attacked by the Virus name "W32.Sality.U"

Its not yahoo who is attacked by This virus its your yahoo mail id

Quote:

Originally Posted by hdsk.23

This virus spreads through itsself through mail with with help of attachments and then replicates itself by sending itself to that user contacts list. You will receive mails having attachments with extension .pif then means it is going to be an virus!!!!!!

All .pif are not virus
see here
http://filext.com/detaillist.php?extdetail=PIF

Quote:

Originally Posted by hdsk.23

Why yahoo scans its whole server to clean or delete mails infected mails!!!!!!

Hey its not yahooo server who is infected with this virus

you need to understand diff btw Yahoo server and your mails

Looks like you copy paste this data from some site

PLEASE SPECIFY SOURCE

hdsk.23 · 15-03-2007, 06:27 PM

Quote:

Originally Posted by piyush gupta

Please specify source

Its not yahoo who is attacked by This virus its your yahoo mail id

All .pif are not virus
see here
http://filext.com/detaillist.php?extdetail=PIF

Hey its not yahooo server who is infected with this virus

you need to understand diff btw Yahoo server and your mails

Looks like you copy paste this data from some site

PLEASE SPECIFY SOURCE

see that site first type they define is It is a potentially dangerous file type

and not only my id is infected ok....

SOURCE ARE THE USERS WHO ARE RECEIVING THE MAILS!!!!!

piyush gupta · 15-03-2007, 06:50 PM

Quote:

Originally Posted by hdsk.23

see that site first type they define is It is a potentially dangerous file type

and not only my id is infected ok....

SOURCE ARE THE USERS WHO ARE RECEIVING THE MAILS!!!!!

Maine kab kaha its fully ok file

See rules:
mension source before posting

mediator · 15-03-2007, 08:24 PM

Quote:

Originally Posted by hdsk.23

anyone will also have receive it from your mail id.....
it is so smart

My friends r not so lucky. I have another ID in thats ID's list. So far there's no sign of that virus in that other ID. Neways I guess its just another one of those stupid viruses created by some lamer. So No worries here and no sign of worry from mah friends!

vysakh · 15-03-2007, 08:34 PM

Quote:

Originally Posted by hdsk.23

no this doesn't means stop using Yahoo mail! this is only alert type
as many people directly download the attachment as if it comes from there friends!!!!
One must scan the attachment before downloading....

why are you blaiming yahoo for this ??