ypager.exe is the executable program for Yahoo Messenger.

Actually it is a Helper app for the Yahoo Messenger...

as the links I posted show...

It is also something being used to tunnel into users computers...

again as the links I posted show

hmmmmmmm

When all else fails, Reformat the HD and Reinstall XP

(I do it every 6 months...)

Got a spare Hard Drive sittin' around?

hmmmmmm I hate reinstalling xp. But in the last 3 months I have done it a grand total of 5 times. woohoo that was fun >

I say reinstall as a last resort. But if you do reinstall make sure you format your disk so it is all nice and fresh. I wouldn't reinstall over this matter though.

But as Travis (or he who has many nicks) says, do not format and reinstall unless YOU REALLY HAVE TO. I have lots of time on my hands so i have no life. Reinstalling tales hours.

yes many names have I. I have gotten to reinstalling windoze in about an hour. Experience helps in this matter. But I wouldn't practice installing windows to get proficient at it, unless you get paid to install windows.

Backup up you C:\ partition to a second hard drive with a program like Drive Image....it takes about 20-30 minutes to restore ...So if I lose the hard drive with the C:\ partition...I can easily restore it or if I lose the hard drive with the backup...I can easily create a new backup

If I lose both...I'm like DavidK...a couple of days to get things back to normal

when you know what goes on the puter and have a stack of cds with the proggys on em. It sure elps. The only problem comes with putting the stuff on cds. It took me a week to get all the stuff onto cds in the correct order. But as I said before I can reinstall windows in an hour with object desktop, office xp, firefox, thunderbird, and several other apps. however, If I install my mp3 collection back on that takes an additional 3 hours due to the slowness of decompressing the rars they are in.

Drive Image 7.0 works flawlessly. My files and software currently come to 30Gb - takes about 25mins to backup or restore, as opposed to installing software and recovering files from CDs which is a two day job . Of course, I do have 320Gb of storage on which to put my backups....

Another advantage of DI 7 is you do your backups in Windows, and can even carry on working

ok, now, whenever i connect to the internet, even if i am not browsing ANY site or not doing anything, i find lot of internet activity. lots of bytes are recd per second, this never used to happen before.
so, i downloaded "Active Ports" program to check my ports. i found some familiar processes like msmsgs.exe, avant.exe (browser), ypager.exe with "Connection Established",
i found even SVCHOST.exe on. i just ran a check on the host it is connected to, it says::
64.124.83.150.akamai.com:http
now what is this site? when i went, it said some sort of Internet business. well, this sort of thing is ruining my surfing.
so, i TERMINATED that instance of SVCHOST.exe to find that the internet activity had reduced... hmm. is this some problem???




Looks to me that the IP Address before the TwoCows domain is a private network IP address behind the RIPE-NET Firewalls...
Passing though TwoCows for some reason...

Most probable that ypager is as suggested a dataminer, or at worse a trojan, an open tunnel into your system with the ypager being a http:proxy...

No... Ypager.exe is the executable for Yahoo Messenger. It is not a helper, it is the program used to launch Yahoo Messenger. The actual Ypager.exe, normally installed in the C:/Program Files/Yahoo!/Messenger/ directory is NOT being used as a tunnel into users' computers. The trojan which sometimes uses the name Ypager.exe installs itself in the Windows System directory and in the registry under a completely different key. That trojan and how to detect it is what the link you provided actually shows. The file location of the Ypager.exe file and more importantly the registry entry are the keys to recognizing the difference.

Yep I stand corrected, ypager is in fact the messenger and it should show up in the process (task_list) list as Ymsgr_tray under NT (NT4, 2000, XP and 2003 )

That is if it is not one that has been modified in some manner, which can be put on ones system from any download and installation of any application off the net if it is modified or created to do so upon installation.

Furthermore, that trojan is almost 2 years old, had a very low infection rate in an extremely limited geographical area if you research a bit more on the link you provided. Before advising someone to remove something from their computer, it might be advisable to do some simple checks to make sure of what you are advising them to remove. When you see hoofprints, don't automatically start looking for zebras.

Furthermore you totally went past my first possibility suggested that it is in fact acting as a data-miner... nice...

Adam if you think that something that is 2, 3, 5 8 years past when it comes to trojan, virus and worms is nothing to worry about then you will learn some seriously hard things over time. As far as Limited geographical are goes that is also something that is on one point something to consider and on another something totally inane. Your speaking of the interenet where Russia is only a matter of moments away from the USA. I could list over 200 sites with such black hat, script kiddy and jerk off apps on them which include that decompile/re-compile of the ypager...

As far as simple checks go and your suggestion that advising Vimal to remove the offending app, clean, reinstall and take better control of his system before advising him to do so. I did some simple checks, I traced the IP address back to the private network which his system was attempting to connect with which is outside the Yahoo network from what can be found without contacting RIPE-NET's admins. (That isn't up to me to do and it is moot when doing what was suggested is done because it should not continue was completed)

Zebra tracks have squat to do with a application attempting to use an unknown or act as it's own http (web) proxy server. If he did not configure it to do so for a specific reason ( if he had done this he would damn well know it, and if it was setup to do this he would have had to have set it up, sp it lends to the application NOT functioning in the normal manner which lends to it being MODIFIED in some manner )

Microsoft compiles information on everyone using msmsgr... I do not see why Yahoo wouldn't do it also...
Remove it, and run a tsr registry monitor such as ad-watch, or some other registry monitor so you know exactly when something is trying to change your registry and if you do not know what it is, or you are not installing anything youcan refuse to let the change happen. Then scan and clean before the fact and total infection...

from the sounds of the traffic you describe I would read this link... Link

If anything resembles the info on that link, disconnect from the net and scan/clean your system, log back on and then change your IM application passwords at least...

good luck


On Vimal's system YPager is in fact passing through as it is or is running through a HTTP:port 80, 8080, 1080 (not sure exactly which because I am not on his system to check it) proxy server. ( Hence the refereces to tunneling, which is exactly what is taking place by description and definition)

Further on in my post to him I described what to do, which was to make sure he cleaned his system of it, ran a check and then logged back into the service. I am sorry I did not hold his hand or paint a glowing green floressent line on the screen with the blow by blow steps in doing this. But I figured anyone able to log onto the net, make use of a message board and read would have be able to put it together without doing that.

Uninstall ypager.exe, clean the registry, clean any left over files off the drive, reboot, make sure that your AV aoftware is open and active, reinstall ypager from a new download off Yahoo. Log banc in and everything that possibly could be wrong should be fine.

Better?


[Message Edited]