C:\Windows\Temp\213087.exe a variant of Win32/TrojanDownloader.Delf.QPN trojan cleaned by deleting - quarantined
C:\Windows\Temp\767930.exe a variant of Win32/TrojanDownloader.Delf.QRH trojan
Uggh! ... Trojan.Downloader.Win32.Delf.qrh is a very malicious item that is
designed to allow remote access to your computer to largely occupy precious system resource, trace your Internet habits to record/steal your personal information
Print these instructions out so you don't miss a step:
You will need to change
all your passwords, using a known 'clean' machine. Do Not use this infected one to do that!
Next, Copy and paste these lines in Note pad.
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0
Save as
flush.bat to your desktop.
Right click on the flush.bat file to run it as Administrator. Your computer will reboot itself.
Now, download TFC by Old Timer
TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.
This is NOT a Windows problem ... it is a user problem with outdated security! Windows 7 is not infallible to Trojans, viruses and other malware. It's up to the user to pre-arm themselves against such.
After doing the above instructions, you NEED an anti-virus program. Download and install MSE as posted earlier. Once you've done that and updated (run a full scan),
I would like to see a Combofix log.
Download
Combofix from any of the links below, and save it to your
desktop.
<--Important
Link 1
Link 2
Link 3
Click on this link
Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.
- Double click combofix.exe and follow the prompts.
- When finished, it will produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log,
combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.
In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
A guide and tutorial on using ComboFix
IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe
