TechSpot

Update.exe & Downloader.Generic3.QFH killing me

By great.white.08
Dec 25, 2007
  1. Can anybody help?

    I have !update.exe & Downloader.Generic3.QFH on my machine.

    I am not even sure if they are the same malware or not.

    I have Googled it and I have read up on it, including the posts here, but I cannot get rid of it for the life of me.

    This is the first virus I have gotten that I couldn't take care of.

    I am running the most current versions of AVG Free Edition, Spybot Search & Destroy, Ad-Aware, & Spyware Blaster. NOTHING!

    I have looked at my running processes, and I do not have any processes running that resembles anything in the information I have read.

    PLEASE HELP!!!

    I can run HJT and post the logs. I haven't done anything with Combofix yet.

    Can anyone help?
     
  2. Rik

    Rik Banned Posts: 3,814

    Hi great.white.08 and welcome to TechSpot. :wave:


    You need to have a read of this - If your system is infected. Read this before deciding whether to CLEAN or REFORMAT.

    Then if you should wish to proceed with cleaning your system you need to go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, Combofix, and AVG Antispyware logs as ATTACHMENTS into this thread, only after doing the above.
    We also need to know the result of Panda Antirootkit.


    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. great.white.08

    great.white.08 TS Rookie Topic Starter

    OK. Here is the HJT Log - Others to follow.
     
  4. Rik

    Rik Banned Posts: 3,814

    Is the HJT log file from before running combofix or after? If it's frome before then i will need a fresh one when you post the combofix log.



    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. great.white.08

    great.white.08 TS Rookie Topic Starter

    The HJT log is before the ComboFix scan. I will run ComboFix and re-scan with HJT.

    BTW...I changed the name of HJT to Crusty.exe. Should I have?
     
  6. Rik

    Rik Banned Posts: 3,814

    Yes, it's there in the instructions....

    It is because some malware can spot HJT running and hide from it if it isnt renamed.



    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. great.white.08

    great.white.08 TS Rookie Topic Starter

    OK....

    Attached are the ComboFix log & HJT log after ComboFix scan.....
     
  8. Rik

    Rik Banned Posts: 3,814

    So where are the avg log and the panda antirootkit result?

    We need all the logs asked for in the instructions in order to fully diagnose and cure a malware problem.


    Quoted from step 11.
    "DO NOT remove any UNKNOWN ROOTKITS at this stage. Instead, let me know the results.

    Let me know the results in your reply."

    And quoted from the end of step 15.
    "Once you`ve finished these instructions, you should have 3 log files. HJT, Combofix and AVG Antispyware logs. They are the only logs we need, unless otherwise requested."




    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. great.white.08

    great.white.08 TS Rookie Topic Starter

    Sorry...

    AVG AntiSpy is running right now.

    Where is the Panda AntiRootKit log created? I have ran that scan a few times now & cannot find it's log.

    Jeff
     
  10. Rik

    Rik Banned Posts: 3,814

    I will quote it again.

    Quoted from step 11.
    "DO NOT remove any UNKNOWN ROOTKITS at this stage. Instead, let me know the results.

    Let me know the results in your reply."


    It asks for the results, not a log, as panda antiroot kit doesn't produce a log.




    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. great.white.08

    great.white.08 TS Rookie Topic Starter

    OK -

    Panda Rootkit Scan - No Results (See attached screenshot)

    Also attaching AVG Spyeware Scan, HJT, & ComboFix logs.

    Jeff
     
  12. Rik

    Rik Banned Posts: 3,814

    Your avg log says no action taken. All the threats need to be deleted.

    There is a link to my pictorial guide within the instructions that you went through. Its here - http://www.techspot.com/vb/showthread.php?p=387464#post387464



    This thread is for the use of great.white.08 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. great.white.08

    great.white.08 TS Rookie Topic Starter

    Rik -

    It says no action taken because I selected to delete the file after reboot. I figured I had a better chance of deleting it before it got loaded into memory.

    I will re-scan using the AVG Spyware client and see what it comes up with.

    It may be a day or so before I post the scan log.

    Jeff
     
  14. Rik

    Rik Banned Posts: 3,814

    Someone else will have to look at your logs, im quiting TS.
     
  15. Tedster

    Tedster Techspot old timer..... Posts: 6,000   +15

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...