Welcome Guest ( Log In | Register )

Bump Topic Topic Closed RSS Feed

Outline · [ Standard ] · Linear+

Virus/Malware Most srs virus case in LYN?, Qhost Trojan is just the beginning.

views
     
TSMiracles
post Sep 28 2009, 09:59 PM, updated 17y ago

★ Detective /K ★
******
Senior Member
1,171 posts

Joined: Dec 2006
QUOTE
Just few days ago, I was afk and when I come back, I saw this virus notification. It keep popping up every 2 secs as we are speaking.
I did scanned in safe mode using Malwarebytes' Anti-Malware. Yes, there are 2 detected and cleaned.

But this Qhost trojan keep coming in after reboot. I have no clue. :sigh:

edited : yes, my AVs detected the Qhost Trojan. But after deleting it, it keeps coming back. Very persistent virus.

user posted image
then someone asked me to use HostXpert. And it solved the qhost problem.
Pls refer to my older thread.

http://forum.lowyat.net/topic/1173846


My system restore is disabled after the virus attack. I was not able to turn it on back.
I tried every solutions i can find on Google. They failed.



So, i rescanned my laptop.




MBAM log in safe mode



» Click to show Spoiler - click again to hide... «






The ones in blue, they just keep coming back even though it was quarantined and cleaned. Everytime I scan, those 3 must be present.



------------------------------------------------------




MBAM log in normal mode (scanned mins after rebooting from safe mode)

» Click to show Spoiler - click again to hide... «


Added on September 28, 2009, 10:00 pm------------------------------------------

My Random's System Information Tool

log.txt
» Click to show Spoiler - click again to hide... «




info.txt

post too long. so i attach it here.

[attachmentid=1221008]


After that I did a scan run using Kaspersky Online Scanner.

my log.
[attachmentid=1221014]



And finally, my fresh my HJT log

[attachmentid=1221016]


Someone told me that my pc is infected with serious backdoor and trojans. I need help. sad.gif

This post has been edited by Miracles: Sep 28 2009, 10:10 PM
gyver
post Sep 28 2009, 10:23 PM

Regular
******
Senior Member
1,067 posts

Joined: Mar 2005
Hi again,

It seems you have got a variant of qhost. Somebody just modified the code straint so standard AV can't delete all trojan files.

Please check back my posting about the qhost manual remove. It seems that you have skip a step.

Just do what I did since year 2000 before malware was even given a name. You should do a search by time or sort files in system32 and check the dates. Suspected backdoor files should be the latest dates. Delete all suspected files.

BTW the backdoor bot C:\WINDOWS\system32\secupdat.dat created here, is it the same file name or auto generated with random names everytime after you cleanup. If it is the same just do a search in registry of that entry and delete it.

I hope you are comfortable enough to mess around in system32 and registry files manually smile.gif

This post has been edited by gyver: Sep 28 2009, 10:28 PM
TSMiracles
post Sep 28 2009, 10:44 PM

★ Detective /K ★
******
Senior Member
1,171 posts

Joined: Dec 2006
QUOTE(gyver @ Sep 28 2009, 10:23 PM)
Hi again,

It seems you have got a variant of qhost. Somebody just modified the code straint so standard AV can't delete all trojan files.

Please check back my posting about the qhost manual remove. It seems that you have skip a step.

Just do what I did since year 2000 before malware was even given a name. You should do a search by time or sort files in system32  and check the dates. Suspected backdoor files should be the latest dates. Delete all suspected files.

BTW the backdoor bot C:\WINDOWS\system32\secupdat.dat created here, is it the same file name or auto generated with random names everytime after you cleanup. If it is the same just do a search in registry of that entry and delete it.

I hope you are comfortable enough to mess around in system32 and registry files manually smile.gif
*
rclxub.gif I dont really understand the qhost manual remove. im not good in computers.


C:\WINDOWS\system32\secupdat.dat <-- is it the same file name everything. how do i search in registry?

Backdoorfiles, even they are quarantined, they will come back with random names. sad.gif

This post has been edited by Miracles: Sep 28 2009, 10:50 PM
gyver
post Sep 28 2009, 10:50 PM

Regular
******
Senior Member
1,067 posts

Joined: Mar 2005
I passed to you a link to manually remove this trojan. Anyways just read this and follow the steps given on how to remove

» Click to show Spoiler - click again to hide... «


Access registry edit via running regedit
fenzodahl512
post Sep 29 2009, 02:52 AM


Group Icon
Elite
1,089 posts

Joined: Jun 2008
Please download The Comedian.exe by Rorschach112 to your desktop
  • Please disable all of your antivirus/firewall before doing this step. Please visit HERE if you don't know how..
  • Double click the program to run it. It will only take around several minutes to run.
  • It will do a series of tasks and tell you when each one is finished.
  • You will be prompted to press any key after each step
  • When it is done it will close and exit itself automatically.
  • You can delete The_Comedian.exe once it is finished
STOP! if you can't complete this step.. Tell me more about it..




Please download the OTM by OldTimer
  • Save it to your Desktop.
  • Please double-click OTM.exe to run it. (Vista users, please right click on OTM.exe and select "Run as an Administrator")
  • Copy the codebox contents and paste it to the "Paste List of Files/Folders to Move" window (under the light Yellow bar)

    CODE
    :processes
    explorer.exe

    :services
    minidrv32
    WMISRSV

    :files
    C:\WINDOWS\System32\wbem\wmiclisv.exe
    C:\WINDOWS\system32\asr_?????
    C:\WINDOWS\system32\drivers\minidrv32.sys
    C:\WINDOWS\system32\secupdat.dat
    C:\WINDOWS\system32\wbem\wmisrsv.exe
    G:\CACHE-20194029\data.sys
    C:\WINDOWS\system\winrsc.exe

    :reg
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{747b7149-3898-11de-a900-00c0ee1818cd}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c703f668-8004-11de-a9cf-00c0ee1818cd}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f504c21e-a937-11de-aa55-0021001d2852}]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "G:\CACHE-20194029\data.sys"=-
    "C:\WINDOWS\system\winrsc.exe"=-

    :commands
    [purity]
    [emptytemp]
    [start explorer]
    [reboot]

  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTM\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTM
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please download GMER and unzip it to your Desktop. <<mirror>>
Please rename the random filename or GMER into GAMERS
  • Open the renamed program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.
IMPORTANT: Do NOT run any program while you are doing these scans as it may interfere with the output results



Then run RSIT once again.. Post these logs in your next reply

1. OTM
2. GMER
3. RSIT log.txt

This post has been edited by fenzodahl512: Sep 29 2009, 02:58 AM
TSMiracles
post Sep 30 2009, 09:40 AM

★ Detective /K ★
******
Senior Member
1,171 posts

Joined: Dec 2006
Hey.. Below are the logs that you requested.

OTM
[attachmentid=1223212]


Gmer
[attachmentid=1223215]

RSIT
[attachmentid=1223213]
fenzodahl512
post Sep 30 2009, 11:30 PM


Group Icon
Elite
1,089 posts

Joined: Jun 2008
Ok, run another scan with Malwarebytes'.. Do you still got the same detection? smile.gif
TSMiracles
post Nov 14 2009, 02:29 PM

★ Detective /K ★
******
Senior Member
1,171 posts

Joined: Dec 2006
opps sorry for not noticing. yeap, no more malicious items detected. thankiu so much!
« Next Oldest · Technical Support · Next Newest »
 

Topic ClosedOptions
 

Change to:
| Lo-Fi Version
 0.0229sec    0.94    5 queries    GZIP Disabled
Time is now: 14th December 2025 - 08:09 AM
All Rights Reserved © 2002- 2025 Vijandren Ramadass (~unite against racism~)
Removal Request
Powered by Invision Power Board © 2025  IPS, Inc.