I go to my Yahoo home page and my virus protection states that a trojan program is trying to be loaded.

Question

Just today (8/6/2008) I went to my Yahoo Home Page and for some unknown reason I'm getting a message from my virsu software that a trojan program is trying to load on my computer. Is anyone else having this issue? I have these two programs on my system. One is called fengxing.exe and the other is thunder.exe.

Thanks!
Bruce Marcoux

Additional Details

Here's the message that I'm getting:

McAfee has automatically blocked and quarantined an infected file on your computer.
You can restore quarantined files from the Restore pane in SecurityCenter.

About this Trojan
Detected: Exploit-YIM.CYFT (Trojan)
Quarantined From: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PHAW0OPG\yahoo[1].htm

Trojans appear as legitimate programs but can damage valuable files, disrupt performance, and allow unauthorized access to your computer.

The file yahoo.htm has the following properties:

http://www.plgou.com/csrss/yahoo.htm

Is this correct?

Okay, so it looks like the folks at Yahoo finally figured the issue out because now I can go to my home page and not get the message. Has anyone else seen this?

You should run the System Configuration Editor (you'll find this in C:\WINDOWS\pchealth\helpctr\binaries\msc… and select the startup tab. Check to see if there's anything funky in there that shouldn't be.
Also, check Programs>Startup to see if there's anything in there that shouldn't be as well.

It should read 'C:\WINDOWS\pchealth\helpctr\binaries\ms…

The program is 'msconfig.exe'.

Answer 1

Best Answer - Chosen by Voters

Finally I found a way to get this Trojan out of my way.

The mmchost.dll is an LSP provider (Layered Service Provider) which means that every winsock user application will load the mcchost.dll. mcchost is like a proxy that retrieve any winsock operation (createsocket,connect,listen,recv,send) and able to change the behavior of the operation.

Here is what you will have to do to safely remove it : Download http://www.download.com/LSPFix/3000-2085_4-10417026.html?hhTest=1

This application can remove LSP providers. When running the LSPFix application you will see that mmchost.dll is on the "Keep" list. all you have to do is to check the checkbox "I know what I'm doing" and move mmchost.dll to the Remove list. Press finish and that's it.

Go to windows\system32 and delete/rename the mmchost.dll to make sure nothing refer to it anymore.

Hope that is working for you all, enjoy.

Answer 2

Yes, I am getting it also. I contacted Tech Support and tried to tell them about it, but they tried to tell me I got it somewhere else. My home page is Yahoo, and it came up as soon as I got on the internet. Freakin' Yahoo, anything for a buck nowadays.

I got a message from Windows that my system files had been updated by an unknown, unsigned program. So I reinstalled the Windows files and now I am having to reset all my defaults and properties. I am running Windows 2000 with Explorer 5, I guess the developer didn't think anyone would be using those versions, which is how I found it. Now when I go to Yahoo it tries to install the stuff, I cancel out, and eventually a window pops up for Fengxing but it has no content. I force it to close. I am avoiding the Yahoo! home pages and am using Firefox if I have to read my mail.

My laptop went right through it with no notices, it has XP and Explorer 6 on it. I assume it is infected now.

Thanks to the previous answer, I went into my \Win32\System directory, found the Fengxing.exe file and deleted it.

Answer 3

This virus/trojan is currently making its away around the net. I strongly advise you to remove the link you have at the bottom of your "Additional Details" to prevent other people from clicking and being infected.

I checked the page with my local AV as well as a corporate proxy av. Both reports the site is trying to download a trojan to your system.

The virus is also known by other file names as follows:
sss.exe, beauty.exe, sl.exe, fengxing.exe, thunder.exe

Answer 4

I'm having a huge problem with this now -- I deleted fengxing.exe and all the files in the system32 folder that looked to be associated with it (by date/time), then also just decided to uninstall Yahoo browser services, installer, etc from Remove Programs, etc. -- and now I cannot launch System Restore, my Antivirus, etc. nor can I connect to the internet.

Answer 5

If your virus protection (that you didn't specify) is blocking a trojan from loading, then that's good.

You might consider running a scan and seeing if your virus protection can delete the infection from your computer so that it won't try to load every time you open your browser.

Answer 6

I've have ran the LSPFix and deleted the mmchost.dll file, however, my computer still does not seem to working properly. Still cannot connect to the internet, cannot search for related programs, cannot open other programs like excel. Is anyone else still having problems?

Answer 7

Restart your PC in safe mode with networking
http://www.pchell.com/support/safemode.s…

Download, install and run a full scan with Malwarebytes
http://www.malwarebytes.org

Run a full scan with Micro Trend House Call
http://housecall.trendmicro.com/

After the scans, restart the PC and update your anti-virus, remember to only have one anti-virus installed on your PC

Answer 8

we have had this break out at our company as well. anyone who goes to yahoo has caught it. Does anyone know what the payload is. we have tracked down all the above files and deleted them. also found them in the temp folder for the user and deleted them as well. Also deleted them from the prefetch. But yet they come back after every reboot
anyone have a proven fix?
JB

Answer 9

You need to delete fengxing.exe and thunder.exe because every program that ends with .exe is a virus that can modify your personal settings.So delete them then scan to see if they are gone because it may be too late.

Answer 10

I have/had the same problem. Interesting that my Virus scan did not find this one. If anyone comes up with the steps needed to get rid of this bugger please update it here. I have tried deleting it but it seems to "reappear" when I reboot

Answer 11

My internet connection also died after deleting mmchost.dll. Connectivity returns when I restore it, but it appears to be infected. Working in firefox is not a problem, but sss.exe reappears whenever I start IE.

Answer 12

Yup, I had the same issue this morning too. But my corporate AV didn't not block it. Now i have the Fengxing file I'm trying to clean up.

But yes, it all started when I went to my Yahoo home page.

Answer 13

I would log off and run a virus scan.

Answer 14

Thank you Zucki! Your solution fixed my problems.

Answer 15

zucki, that seems to have worked thanks.

Answer 16

I got the same thing today. When I booted up, I got 3 windows appearing from fengxing.exe and then 620.exe. Unfortunately there's not alot of info on this trojan. I ran TrendMicro and it didn't even detect anything. Our IT guy deleted everything by hand and now my PC seems to be fine again.

I think this trojan is related to a Funshion app I had. I had a Funshion exe file even though it didn't appear in Add/Remove Programs. Funshion is rated red by SiteAdvisor. Funshion is a Chinese company so there's that connection too.

But then again I also use Yahoo as my home page so it still could have been that.