Troj Qdown.l

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by bella, Sep 30, 2004.

  1. bella

    bella Private E-2

    Hi Guys,
    Im new to this, so I dont know if I'm posting to the right area. Recently I found that I was infected by 12 different Trojan Viruses. I came here and I followed the instructions step by step for removing them. However, it said to run trend micro's scan and symantec security check, which i couldnt do from safe mode. I did everything else, and got rid of alot of problems with my computer that i wasnt even aware were an issue before I did those steps.
    My problem now is that I still have 1 of the trojans on here and I cant get it off. Ive looked all over for information on it but cant find any. Its called TROJ QDOWN.L, and they are located in the following files :
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.1\QDOW_AS2.DLL
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.2\QDOW_AS2.DLL
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\QDOW_AS2.DLL
    C:\NULL

    I found this information by running the scan from trend micro. It gives me the option to delete these files, but I havent done that because I'm scared it's going to mess up my computer and I dont want to have to crash it yet again.
    Can someone please help me??

    (yes, i read and followed the instructions from here : http://forums.majorgeeks.com/showthread.php?t=35407) I did everything it said other than running the scans from trend micro and symantec, because i couldnt use my internet from safe mode. I ran them when i went back into normal mode.)
     
  2. Kodo

    Kodo SNATCHSQUATCH

    what OS do you have and are you using dial up ?
     
  3. bella

    bella Private E-2

    I am running Windows ME and I have cable.
     
  4. Kodo

    Kodo SNATCHSQUATCH

    what Anti-virus are you using?
    you want to give this a shot for removing the trojan
    http://www.majorgeeks.com/download4281.html

    also, turn off system restore in ME. Sometimes malware can reinfect your machine from there.
     
  5. bella

    bella Private E-2

    I'm using Norton Pro Edition....I followed all the steps from the sticky thread on how to remove trojans and adware/spyware. I turned off System Restore, showed hidden file types, all that, and I ran all 8 spyware dl's they give you in the exact order it said. I'll give this one a try... I've also gone online and tried to find any info about this particular trojan and only one that seems to know about it is trend micro. Norton isnt aware of it yet, so it's obviously not going to pick it up. *frusterated*
    Thanks for your help.... I'll give it a shot.

    :eek:
     
  6. bella

    bella Private E-2

    ok i tried that a2 thing, but it wants an email address other than hotmail or yahoo and those are the only ones that i have, so i cant use it. Is there anyone out there????????
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please try this:

    RavAntivirus online scan <-- select Auto Clean then click Scan My PC
     
  8. bella

    bella Private E-2

    Ugh ... i ran that scan, and this is the log it gave me:
    :\NULL - TrojanDownloader:Win32/Qdown.L -> Infected
    c:\WINDOWS\Downloaded Program Files\QDow_AS2.dll - TrojanDownloader:Win32/Qdown.L -> Infected
    c:\WINDOWS\Downloaded Program Files\CONFLICT.1\QDOW_AS2.DLL - TrojanDownloader:Win32/Qdown.L -> Infected
    c:\WINDOWS\Downloaded Program Files\CONFLICT.2\QDow_AS2.dll - TrojanDownloader:Win32/Qdown.L -> Infected

    Scanned
    ============================
    Objects: 38697
    Directories: 2622
    Archives: 1276
    Size(Kb): 1752345
    Infected files: 4

    Found
    ============================
    Viruses found: 1
    Suspicious files: 0
    Disinfected files: 0
    Mail files: 76

    so same issue, its finding it, but wont clean it. *sigh*
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you try booting in safe mode and manually deleting:
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.1\QDOW_AS2.DLL
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.2\QDOW_AS2.DLL
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\QDOW_AS2.DLL
    C:\NULL

    If that does not work, post a HijackThis log as a .txt file attachment.
     
  10. bella

    bella Private E-2

    the scan I did at trend micro gives me the option to delete those files, but i was scared it would mess up my comp somehow if i did that....should i delete them from there? or delete them from safe mode?
     
  11. bella

    bella Private E-2

    Also, if I boot in safe mode to delete them, should I also disable system restore? I looked at the location where they are and the creation date is 1-6-1601, there are also 2 other damaged files in there with normal creation dates. Thanks for you help :)
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    System restore should remain disabled until problems are fixed. You should have let TrendMicro delete those files. Please do so.
     
  13. THE_DIRECTOR

    THE_DIRECTOR Private E-2

    syncroad.exe
    winsync.exe
    syncroad.a
    syncroAdX.dll
    ================
    this is a trojan that get into the system thru activex
    it is not only in program filez but in the registery as well
    even TDS-3 couldn't stop and kill the process
    you have to do it manualy
    run regedit
    and search 4 syncroad and delete all the perameters and values and keyes
    it is nasty :mad:
    I had it and I had to start my windowz in safe mode then ran tds-3 but after I killed the process manualy .
    when I found the file I ran east-tec eraser @ guttman mode to stop and freez my pc while I shred and delete that bug
     
  14. THE_DIRECTOR

    THE_DIRECTOR Private E-2

    bella
    don,t use window me
    it sucks :rolleyes:
    it chews on its own resorces
    what that mean is that it uses lots of memory to run itself
    in another word in programing ....say window 2000 takes two lines of c+c+c+
    command to do one task .
    you find that window me takes 8 lines for the same task .
    the best prog. that window made is win 2000
    it is very stable
    win xp is a mix between win 2000 and me .
     
  15. bella

    bella Private E-2

    Thnx for the help guys... in reply to the director, I have no choice on running ME, this comp was given to me when my husband got his new one. I take what I can get ::wink::
     
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome! Are your problems fixed?
     
  17. bella

    bella Private E-2

    yep :) finally all the nasties are gone ... lol for now at least
     
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Cool! Happy to finish another one off! :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds