|
Posted by on August 18, 2006, 11:56 am
If you were Registered and logged in, you could reply and use other advanced thread options
Can anyone suggest what I should do to rid my computer of this Trojan?
Here is the log entry from AOL spyware Prevention. (Note, that no
other AV device including Norton, Spybot or Ad-Aware seems to notice
it.) I have even got Symentec's Q-host extraction tool, which doesn't
even recognise this menace. All help gratefully received.
Dat Date: July 28, 2006 5:21:16 PM
Pest Detected on August 18, 2006 at 3:41:41 PM
Pest ID: 453094956
Name: Trojan.Win32.Qhost.df
Location: Key "hkey_local_machine
\software\microsoft\windows\currentversion\ruins"
PVT: 4294967295
Scan Finished on August 18, 2006 at 3:41:45 PM
I am running Win XP Home + SP2.
Thanks a lot.
Robert.
|
|
Posted by =?Utf-8?B?RW5nZWw=?= on August 18, 2006, 1:35 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Hello Robert,
http://www.ccleaner.com/downloadbuilds.asp
Note, When you install Ccleaner, uncheck the Yahoo toolbar option.
Note, in Options, Advanced, uncheck - Only delete files in Windows folders
older than 48 hours.
Note: uncheck Windows Defender in the applications.
Open Ccleaner and press "Windows" "Aplications" and Run Cleaner from the
menu choose 'Issues' and then press scan for issues, Repair any fºund.
Run twice Ccleaner, the same as above,until you get “0 bytes to be removed”.
Scan your computer now online and clean it for free!
http://www.ewido.net/en
Kaspersky
http://www.kaspersky.com/virusscanner
Install (freeware) and run:
http://www.superantispyware.com/
http://www.f-secure.com/blacklight
Good luck
--
"robertpatton41@aol.com" wrote:
> Can anyone suggest what I should do to rid my computer of this Trojan?
> Here is the log entry from AOL spyware Prevention. (Note, that no
> other AV device including Norton, Spybot or Ad-Aware seems to notice
> it.) I have even got Symentec's Q-host extraction tool, which doesn't
> even recognise this menace. All help gratefully received.
>
> Dat Date: July 28, 2006 5:21:16 PM
>
> Pest Detected on August 18, 2006 at 3:41:41 PM
> Pest ID: 453094956
> Name: Trojan.Win32.Qhost.df
> Location: Key "hkey_local_machine
> \software\microsoft\windows\currentversion\ruins"
> PVT: 4294967295
>
> Scan Finished on August 18, 2006 at 3:41:45 PM
>
> I am running Win XP Home + SP2.
>
> Thanks a lot.
>
> Robert.
>
>
|
|
Posted by =?Utf-8?B?UGFuZGFfbWFu?= on August 19, 2006, 4:10 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Can anyone suggest what I should do to rid my computer of this Trojan?
> Here is the log entry from AOL spyware Prevention. (Note, that no
> other AV device including Norton, Spybot or Ad-Aware seems to notice
> it.) I have even got Symentec's Q-host extraction tool, which doesn't
> even recognise this menace. All help gratefully received.
>
> Dat Date: July 28, 2006 5:21:16 PM
>
> Pest Detected on August 18, 2006 at 3:41:41 PM
> Pest ID: 453094956
> Name: Trojan.Win32.Qhost.df
> Location: Key "hkey_local_machine
> \software\microsoft\windows\currentversion\ruins"
> PVT: 4294967295
>
> Scan Finished on August 18, 2006 at 3:41:45 PM
>
> I am running Win XP Home + SP2.
>
> Thanks a lot.
>
> Robert.
>
>
You should not have a reg key ...currentversion\ruins but "run" , instead
Can you open Windows Registry edit and check some entries:
Start-Run-type
regedit.exe
and press ENTER
Carefully navigate to
hkey_local_machine
> \software\microsoft\windows\currentversion\run
and post what you see there , all the programs
Then , downlaod David's Multi_AV and run it or
go through the removal procedure here
http://pandaman.my.contact.bg
http://www.ik-cs.com/multi-av.htm
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
--
Panda_man
Bronze level Contributor
|
|
Posted by David H. Lipman on August 19, 2006, 7:01 pm
If you were Registered and logged in, you could reply and use other advanced thread options
| Can anyone suggest what I should do to rid my computer of this Trojan?
| Here is the log entry from AOL spyware Prevention. (Note, that no
| other AV device including Norton, Spybot or Ad-Aware seems to notice
| it.) I have even got Symentec's Q-host extraction tool, which doesn't
| even recognise this menace. All help gratefully received.
|
| Dat Date: July 28, 2006 5:21:16 PM
|
| Pest Detected on August 18, 2006 at 3:41:41 PM
| Pest ID: 453094956
| Name: Trojan.Win32.Qhost.df
| Location: Key "hkey_local_machine
| \software\microsoft\windows\currentversion\ruins"
| PVT: 4294967295
|
| Scan Finished on August 18, 2006 at 3:41:45 PM
|
| I am running Win XP Home + SP2.
|
| Thanks a lot.
|
| Robert.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.
You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm
Additional Instructions:
http://pcdid.com/Multi_AV.htm
* * * Please report back your results * * *
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
|
|
Posted by Robert on August 20, 2006, 4:41 pm
If you were Registered and logged in, you could reply and use other advanced thread options
work through them. I am a little timid of touching the Registry, but
have managed to find the programs, as Panda Man requested, listed under
HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run.
(It appears as "run" in the Registry, and not as "ruins" as shown in
the log in my first post.)
The problem is that although I can highlight the desired program names
in the LH column of the RH pane, I have not yet found a way to copy
these to the Clipboard, so as to post them here as requested. There
seems to be no command available to do this. Can you offer any help on
this, please? I am totally new to the Registry.
Many thanks,
|
| Similar Threads | Posted | | Trojan.Win32.Qhost.df | December 19, 2005, 3:47 am |
| Win32:Trojan-gen. | June 5, 2007, 3:24 pm |
| Help with Trojan.Win32.BHO.hhy? | November 11, 2008, 9:58 am |
| Win32.WinAd.T trojan | July 12, 2005, 8:04 pm |
| WIN32.TROJAN.RUNNER | August 2, 2006, 10:19 pm |
| trojan win32.inject.au | February 2, 2007, 10:10 am |
| Trojan:Win32/Stration.dr | August 31, 2007, 5:46 am |
| Trojan Win32/Kvol.H | December 1, 2007, 10:18 am |
| trojan.win32.agent.xud | August 11, 2008, 4:18 pm |
| Trojan downloader.win32.small.cv | August 19, 2005, 4:59 pm |
|
XML site map