Discussion in 'Virus & Other Malware Removal' started by hannah6961, Jan 14, 2006.
I have a trojan qhost virus that I can't delete or quarantine. I've tried the fix on symantec - said it couldn't find any virus so it didn't fix it. I scanned for viruses again and it is still there. What should I do?
What trojan is found and what location?
O4 - HKLM\..\Run: [SAUpdate] "C:\Program Files\Comcast\BBClient\Programs\SAUpdate.exe"
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0614] "C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\4X8L67K7\WinFixer2005ScannerInstall.exe"
I'm having trouble getting the computer to run in safe mode. After I highlight "safe mode" I then have a choice of what to operate - windows xp or windows recovery. I selected windows xp and then had to choose whether I was the administrator or owner. I selected owner. then it takes me to a black screen that says "safe mode" in the corners. What am I doing wrong?
If you cannot get into safe mode & get a black screen that says "safe mode" in all 4 corners and no desktop appears then try this.
It appears that the code in the Vundo trojan is so badly written, that many users cant go into safe mode because "explorer.exe" is occupied trying to execute these codes and occupies 100% of the CPU capacity.
When you come to the point where the black screen appears and the text "safe mode" is displayed in the corners,open the taskmanager (Ctrl+Alt+Del) and find "explorer.exe . Click on it in the list and click "Terminate". This will probably take several minutes.
Once Explorer is terminated, navigating with the mouse will be easy, however you will have a desktop without icons.
Now, remember where you installed the "VundoFix" . Open the taskmanager again, and click "File>Run" in the toolbar. Type in the filepath to the VundoFix in the scrollbar and hit enter.
C:\Documents and Settings\YOUR USERNAME\Desktop\VundoFix\KillVundo.bat . Replace "your username" with your actual one.
Then click "ok" and if everything work as planned, you will now be able to run the VundoFix and go on with the procedure I already posted.
Since you during this operation cant navigate via Explorer, its important that you print those instructions, both the ones here and the entire cleaning procedure for the Vundo.
below is the HiJackThis log. I've had a hellish few hours. Right after I completed the ActiveScan and saved the summary my computer shut down and I had to go through system recovery to get it back. In short, I'm a little hesitant to do the scan again and paste the summary here. I can tell you that I did not have the option of deleting files listed in the summary.