# YoYo boot sector virus - again !!



## jerry62 (Jan 29, 2006)

YoYo / Y&#8734;Y&#8734; ... I've now received this a second time, about 2 years later (actually my screen msg is always just Y&#8734;Y). It's great if using ghost does remove the problem, as one has posted. However, I obviously can't find the source. My AV must not be finding it. It must be on a secondary (older) drive in my system, that is not being used to boot the Operating System. My boot drive is different than before, and I can't imagine it being 'unclean'. It doesn't have much on it. Assuming this is certainly a virus and not related to some other system issue (same computer), I have no idea where the problem is living, although my hunch is that its source is residing on my secondary drive, if indeed a virus is causing the problem. I run daily AV tests against all drives.

This time, I received an error trying to perform a Windows Update... I believe the genuine validation advantage (or whatever) test failed. So, I figured I would reboot to clean up what was in memory. After reboot, Y&#8734;Y is there. I'd say it was a month since I last rebooted this system. I don't recall running any programs in particular from my older drive (which I did boot from long long ago, although this was not the drive that had the previous problem... but who knows, could still be related since it was in that same system as a secondary drive as well). I use Grisoft's AVG antivirus (freeware), which has been very reliable for the most part, even handling some problems that Symantec was slower in finding (in years past). I have been doing daily scans on the system in question. Anybody else have an idea on finding the source ? Quite disturbing. I think there might be some time-release thing going on, where it is delayed or something.

Then again, from related posts all around the web, indeed there could be some faulty hardware related. This is an older HP Pavillion system that has an Intel motherboard. I don't know, but I will try ghost to fix the problem for the short term solution. Will be replacing this system soon anyway, but wouldn't want the problems to follow if I keep/reuse the same drives.


----------



## jerry62 (Jan 29, 2006)

Although this has (Y&#8734;Y&#8734; virus) been referenced with YOYO.1271, or YOYO.mp.1271, or YOYO.1271-B, or YOYO-1271-C, I'm not sure that any of those are actually this same virus. I have never seen any complete documentation on this specific virus. At any rate, recommendations on how to properly scan the MBR when the drive is slaved are welcome.


----------



## jerry62 (Jan 29, 2006)

Well, ghost doesn't seem to handle the drive properly... it won't let me create an image for it. So, it looks like I have to back everything up again.


----------



## jerry62 (Jan 29, 2006)

One person stated that ghosting a drive with the YoYo / Y8Y8 / Y∞Y∞ will clear up the problem. I've tried this, and can't even get Ghost to image the drive, so I don't believe this is a valid solution, unless you can do this after running some other tasks prior. What those would be is not clear, but perhaps the original person who posted this (AJTComputing) could respond...

http://forums.techguy.org/malware-removal-hijackthis-logs/633241-yoyo-boot-sector-virus.html

Also: Still no detection of virus with AV, and BIOS is not related to the problem from what I can tell.


----------



## jerry62 (Jan 29, 2006)

Still no luck finding the source of the problem. Very bothersome, as if it is a virus, I definitely want to know what file, or website, etc., is causing the problem.


----------

