Possible trojan?

[Clevin843]

I think my computer may have been infected with a trojan and i have arun all the scans as in the removal instructions, also i would like to try and clean my system not reformat as it is only used for gaming and schol work.

 

[Rik]

The following line needs to be fixed with HJT by putting a tick in the box next to it then clicking on fix checked.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


The following entries are suspicious so I need you to tell me if you know and trust them or not.

O4 - HKLM\..\Run: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\Run: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe
O4 - HKLM\..\RunServices: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\RunServices: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe



This thread is for the use of Clevin843 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Clevin843]

I've fixed the file as of your instructions. As for those other entries, i've never seen them before so I will do with them as you see fit.

 

[Rik]

I will do some more research into those entries. So far I have found nothing either good or bad about them.



This thread is for the use of Clevin843 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Rik]

After some consultation those entries do look to be bad.


You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

qpexlvms.exe
oxmicuppfrp.exe
qpexlvms.exe
oxmicuppfrp.exe


Close task manager.


Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

qpexlvms.exe
oxmicuppfrp.exe
qpexlvms.exe
oxmicuppfrp.exe

Close the services window.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\Run: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe
O4 - HKLM\..\RunServices: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\RunServices: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe


Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

O4 - HKLM\..\Run: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\Run: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe
O4 - HKLM\..\RunServices: [qpexlvms] C:\WINDOWS\system32\qpexlvms.exe
O4 - HKLM\..\RunServices: [oxmicuppfrp] C:\WINDOWS\system32\oxmicuppfrp.exe


Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log so i can check the result.



This thread is for the use of Clevin843 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Clevin843]

Here is the HJT log. Also the processes were not running when I looked on task manager or the services.msc. The files also weren't found in the system32 file

 

[Rik]

It worked, your HJT log is now clean.

Just to complete the cleaning process i need you to turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Then turn it back on again.

Let me know how your computer is running.

If you should have any other malware problems then post in this thread and i will get onto it right away.




This thread is for the use of Clevin843 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Clevin843]

Thanks so much, there doesnt appear to be any more problems with my computer. Thanks again for all your help.

 

[Rik]

Glad to hear it.

Keep an eye on things and post any problems here.