Y! Messenger viruses

This code can save up some time if you get infected with a Yahoo Messenger virus that spreads by spam messages.

Y! Messenger viruses take advantage of the program's vulnerabilities that come with Java script and VBS. You can be infected simply by clicking a link to a picture (.JPG). When the page presenting that picture loads, java scripting run's a VBS (visual basic script - works on any Windows machine) that rewrites data on your harddisk.
After you get infected, the virus starts sending mass messages to all contacts in your list asking them to follow a link, like in the example bellow. The messages vary, being generated randomly from different keywords from the virus's database.
Some of the most dangerous malware also knows to crash the most popular antivirus and firewall software, so they become useless.

** Please note that this code applies to most of the messenger viruses, NOT to all of them. The best way is to use anti-spam and anti-virus software. The code bellow can be executed by saving it into a file with .bat extension (batch file). To do this, open Notepad, paste the code exactly as it is and then choose Save As from the File menu in the editor. Save it with the filename yvirusremoval.bat for example on your hard drive.

The best thing would be to restart your computer in safe mode and then run the batch file. After doing this, it would also be a good idea to reinstall Yahoo Messenger.
The REM statements are comments explaining what the code does, read them please.

echo Disinfecting (stopping possibly infected services, deleting infected files, deleting
echo temporary files that could be infected, rewriting some registry entries like Internet
echo Explorer home page..) Please wait.
@taskkill /f /im svchost32.exe > nul
@taskkill /f /im svhost32.exe > nul
REM These two lines stop svchost32.exe and svhost32.exe services that are usually infected
@erase /F /Q %windir%\svchost32.exe > nul
@erase /F /Q %windir%\svhost32.exe > nul
@erase /F /Q %windir%\prefetch\*
@erase /Q /F "%userprofile%\Local Settings\Temp\svchost32.exe" > nul
@erase /Q /F "%userprofile%\Local Settings\Temp\svhost32.exe" > nul
@erase /Q /F "%userprofile%\Local Settings\Temporary Internet Files\*" > nul
REM The last 7 lines deleted svchost32.exe and svhost32.exe from windows directory and temporary directory; last line deleted all the Temporary Internet Files content
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Task Manager" /f > nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Window Title" /d "Internet Explorer" /f > nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.google.com" /f > nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs" /v "url1" /d "http://www.google.com" /f > nul
REM Last 4 lines change some registry entries, modifying Internet Explorer parameters, like home page (changes to google.com), typed history and default title bar.
echo Done !

Subscribe now via RSS feed and get all the new tutorials