W32.Yaha.B@mm нь W32.Yaha@mm вирусын нэг тєрєл бєгєєд хоорондын ялгаа нь vлдээдэг
файлдаа юм. W32.Yaha@mm нь C:\Recycled\Msscra.exe болон C:\Recycled\Msmdm.exe
файлуудыг vлдээдэг бол W32.Yaha.B@mm нь ямар нэг нэртэй 2 файлыг C:\Recycled
директорт vлдээдэг. Уг worm нь Windows Address Book дахь бvх хаяг руу єєрийгєє
илгээдэг байна.

Tєрєл: Worm
Хэмжээ: 23,320 байт
Хор хохирол учруулах зэрэг: 2
Захианы subject нь: "Enjoy this friendship-joke Screen Saver!!!!"

эсвэл "Fw: Enjoy this friendship-joke Screen Saver!!!!"
эсвэл "Have a nice day!!!!"
Файлын нэр: friends.scr

W32.Yaha.B@mm нь идэвхижсэн бол дараах vйдлvvдийг хийдэг:
Windows address book дэхь бvх хаягууд руу єєрийгєє илгээхээс гадна хаягын жагсаалт
бvхий address book файлыг C:\Windows\<дурын 5 тэмдэгт>< дурын 5 тэмдэгт
>.dll файл руу хуулдаг.

Registry файлын HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
хэсэгт дараах єєрчлєлтийг хийснээр ямар нэгэн executable файл ажиллахад вирус
идэвхижин ажиллахаар болгодог:

" %1 %*" гэсэн стандарт (default) утгыг c:\recycled\<random 5
letter file name>" %1 %*" болгож єєрчилдєг.

Мєн Internet Explorer программ ажиллуулахад эхэлж ордог vндсэн хуудсыг дараах
сайтуудын аль нэгээр болгож єєрчилдєг:

Хэрхэн арилгах вэ?
W32.Yaha.B@mm worm илэрсэн бvх файлуудыг устгах, Registry файлд оруулсан
єєрчлєлтийг эргэж засах, мєн Internet Explorer программийн vндсэн хуудсыг єєрчлєх

Анхаар: Хэрвээ таны компьютер дээр уг worm идэвхижсэн бол NAV программийн
LiveUpdate-г ажиллуулахаасаа ємнє эсвэл татаж авсан хамгийн сvvлийн vеийн єєрчлєлтийг
ажилуулахаасаа ємнє Registry файл дахь єєрчлєлтийг засаарай.

1. NAV программийн хамгийн сvvлийн vеийн єєрчлєлтийг татаж авсан эсэх
2. Бvх файлуудыг шалгахаар тохируулагдсан эсэхийг шалгах.
3. Full system scan командыг ажиллуулж системийг бvхэлд нь шалгах.
4. W32.Yaha.B@mm илэрсэн бvх файлуудыг устгах.

Registry файлыг засах:

– Regedit.exe файлыг Regedit.com нэртэйгээр хуулах:
Worm нь Registry файлд єєрчлєлт оруулахдаа .exe єргєтгэлтэй файлуудыг засч чадахааргvй
болгодог тул файлыг засахын тулд .com єргєтгєлтэй болгох шаардлагатай.

1. Vvнийг хийхийн тулд дараах vйлдлvvдийг гvйцэтгэнэ:

  • Windows 95/98 системтэй бол:
    Start товчыг дарж Programs-г сонгон MS-DOS Prompt-г дарна.
  • Windows Me системтэй бол:
    Start товчыг дарж Programs-г сонгон Accessories -руу орж MS-DOS Prompt-г дарна.
  • Windows NT/2000/XP системтэй бол:
    1. Start товчыг дарж Run командыг сонгоно.
    2. command гэж бичээд Enter дарна.
    3. MS-DOS-н цонх гарч ирэхэд дараах командыг бичиж єгєєд Enter дарна: cd \winnt

2. MS-DOSн мєрнєєс дараах командыг бичээд Enter дарна:
copy regedit.exe regedit.com

3. Мєн дараах командыг бичээд Enter дарна:
start regedit.com

Registry файл нээгдсэний дараа дараах vйлдлийг хийж єєрчлєлтийг засна:

Анхаар: Системийн registry файлд ямар нэгэн єєрчлєлт оруулахаасаа ємнє
нэг хувийг нь хадгалж авч байна уу.
Буруу бичилт, єєрчлєлт хийснээс шалтгаалан файлууд эвдрэх, устах аюултайгаас
гадна систем ажиллахгvй болдог.

1. HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command гэсэн хэсгийг
<<=== NOTE: This is the key that you need to modify.
2. Дэлгэцийн баруун талд харагдах (Default) гэсэн утгыг 2 дарна.
3. Байгаа утгыг устгаад "%1" %* гэж бичнэ. (хашилт-процентын тэмдэг-нэгийн
тоо-хашилт-хоосон зай-процентын тэмдэг-од.)
4. Дээрх хэсэгт байгаа бvх утгыг устгасан эсэхээ сайн шалгаарай. Шинээр утга
оруулахдаа эхэнд нь хоосон зай vлдээсэн бол "Windows cannot find .exe"
эсвэл "Cannot locate C:\ <path and file name>." гэсэн алдаа
5. Registry Editor программаас гарах.

Internet Explorer программийн vндсэн хуудсыг солих:
1. Microsoft Internet Explorer программийг ажиллуулах.
2. Tool цэснээс Internet Options командыг сонго.
3. General цонхон дахь Home Page хэсгийн Address гэсний ард вэбийн хаягыг бичиж
єгєєд OK товчыг дарна. Internet Exporer программийг ажиллуулахад шууд энэ хаяг
руу орж байхаар тохируулагдах юм.



Date: September 27th, 2007 | Categories: Вирус | By: | Comments: 3,059

3,059 Responses to W32.Yaha.B@mm

    Pretty element of content. I simply stumbled upon your web site and in accession capital to say that I acquire in fact loved account your blog posts. Anyway I will be subscribing in your feeds or even I achievement you get right of entry to consistently quickly.|

    It’s amazing designed for me to have a web page, which is good in support of my knowledge. thanks admin|

    I enjoy looking through an article that will make people think. Also, thanks for allowing me to comment!

    Sexual depression, like sexual indulgence, is no different from physical health. It is a bad thing to go back and forth between depression and indulgence. Click:oral sex.

    This paragraph gives clear idea designed for the new users of blogging, that in fact how to do blogging.|

    I’m excited to discover this page. I wanted to thank you for your time for this fantastic read!! I definitely appreciated every part of it and I have you saved as a favorite to look at new stuff on your website.

    Wow that was strange. I just wrote an extremely long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyway, just wanted to say wonderful blog!|

    Thank you, I have just been looking for information about this subject for a while and yours is the best I’ve found out so far. However, what in regards to the conclusion? Are you sure about the supply?|

    Only when a woman burns up to orgasm can she satisfy a man and feel the value of love. Click:Being fucked.

    I think other web site proprietors should take this website as an model, very clean and fantastic user friendly style and design, as well as the content. You are an expert in this topic!

    Great info. Lucky me I found your site by chance (stumbleupon). I have saved it for later!

    Very nice article, just what I wanted to find.|

    You’re so cool! I do not believe I have read a single thing like that before. So great to discover another person with some original thoughts on this issue. Really.. thank you for starting this up. This website is something that’s needed on the internet, someone with some originality!

    Hello! I simply wish to offer you a huge thumbs up for your excellent info you have here on this post. I’ll be coming back to your blog for more soon.

    Way cool! Some extremely valid points! I appreciate you penning this write-up and the rest of the website is also very good.

    Hi there, i read your blog occasionally and i own a similar one and i was just curious if you get a lot of spam responses? If so how do you reduce it, any plugin or anything you can recommend? I get so much lately it’s driving me crazy so any assistance is very much appreciated.

    Pretty section of content. I just stumbled upon your site and in accession capital to assert that I get actually enjoyed account your blog posts. Any way I will be subscribing to your augment and even I achievement you access consistently rapidly.

    This website certainly has all the information I needed about this subject and didnít know who to ask.

    Hey! I know this is somewhat off topic but I was wondering if you knew where I could find a captcha plugin for my comment form? I’m using the same blog platform as yours and I’m having trouble finding one? Thanks a lot!|

    I really like it when individuals come together and share opinions. Great site, stick with it!

    I got what you intend, thanks for putting up. Woh I am glad to find this website through google

    I’m really enjoying the theme/design of your site. Do you ever run into any web browser compatibility problems? A handful of my blog visitors have complained about my site not working correctly in Explorer but looks great in Chrome. Do you have any ideas to help fix this problem?|

    Very quickly this website will be famous amid all blog visitors, due to it’s pleasant posts|

    LOL thanks Norstad! Hope the community is working out for you?

    Peculiar article, just what I needed.|

    It only takes one time for a girl to change from a virgin to a woman, and it takes time and practice for a boy to change from a virgin to a man! Click:oral sex.

    Excellent article. I will be facing some of these issues as well..|

    Your style is really unique compared to other people I have read stuff from. Many thanks for posting when you have the opportunity, Guess I’ll just book mark this web site.

    Only when a woman burns up to orgasm can she satisfy a man and feel the value of love. Click:Being fucked.

    I think other site proprietors should take this website as an model, very clean and wonderful user genial style and design, as well as the content. You’re an expert in this topic!

    You’re so cool! I do not suppose I’ve truly read anything like that before. So nice to discover another person with a few genuine thoughts on this subject. Seriously.. many thanks for starting this up. This site is something that’s needed on the web, someone with some originality!

    Hello.This article was extremely fascinating, especially since I was browsing for thoughts on this issue last Sunday.

    This page certainly has all the information and facts I wanted about this subject and didn’t know who to ask.

    patek philippe geneve fake are probably the planet’s several hard watch doc of the trademark.

    Excellent article. I absolutely appreciate this website. Keep it up!

    May I simply just say what a relief to uncover someone who really understands what they’re talking about online. You actually realize how to bring an issue to light and make it important. More and more people have to read this and understand this side of the story. It’s surprising you’re not more popular given that you definitely have the gift.|

    Howdy! I just would like to offer you a huge thumbs up for the great info you’ve got right here on this post. I will be returning to your blog for more soon.

    replica hubolt before anything else produced absolute watch does the job.

    Hello to all, since I am truly keen of reading this webpage’s post to be updated daily. It consists of pleasant data.|

    A motivating discussion is definitely worth comment. I do believe that you ought to write more about this topic, it might not be a taboo matter but usually people don’t speak about such issues. To the next! Kind regards!!

    I was suggested this blog by means of my cousin. I’m now not sure whether this submit is written via him as no one else realize such specific about my difficulty. You are amazing! Thank you!

    When I originally commented I clicked the -Notify me when new feedback are added- checkbox and now each time a remark is added I get four emails with the identical comment. Is there any manner you’ll be able to remove me from that service? Thanks!

    Have you ever considered writing an e-book or guest authoring on other blogs? I have a blog based on the same subjects you discuss and would love to have you share some stories/information. I know my visitors would value your work. If you’re even remotely interested, feel free to send me an e mail.|

    Hey there! I’ve been following your blog for a while now and finally got the courage to go ahead and give you a shout out from Lubbock Tx! Just wanted to mention keep up the fantastic work!|

    Having read this I believed it was extremely enlightening. I appreciate you spending some time and energy to put this article together. I once again find myself personally spending a lot of time both reading and leaving comments. But so what, it was still worthwhile!

    A fascinating discussion is worth comment. There’s no doubt that that you need to publish more about this topic, it may not be a taboo matter but usually people don’t talk about these subjects. To the next! Kind regards!!

    You need to be a part of a contest for one of the finest sites on the internet. I most certainly will recommend this blog!

    I agree with your opinion. From now on I will always support you.

    Hello there, I do think your website may be having internet browser compatibility problems. Whenever I look at your site in Safari, it looks fine but when opening in I.E., it has some overlapping issues. I merely wanted to give you a quick heads up! Aside from that, great site!

Leave a Reply