There is a Trojan.Qoologic on my computer. I know the exact file path
c:\windows\system32\orhaatd.dll
but when I go to delete it, ms search can't find it, and ms dos command prompt says that the file cannot be found when I try and delete it there...
so, help, how do I delete this retarted file?
![]() |
|
|||||||
| Windows XP/2000 - I can find it... my computer can't... posted in the Operating Systems forums; There is a Trojan.Qoologic on my computer. I know the exact file path c:\windows\system32\orhaatd.dll but when I go to delete it, ms search can't find it, and ms dos command ... |
|
|
|
#1 |
|
Bronze Member
![]() Join Date: Aug 2006
Posts: 20
|
|
|
|
|
| Advertisement - Register to Remove | |
|
|
|
#2 |
|
Bronze Member
![]() Join Date: Aug 2006
Posts: 20
|
yea I'll do it in a sec, and thanks...
if it helps, I already ran BitDefender Pro, AdAware, and Spybot: Search and Destroy and it came out clean. |
|
|
|
|
|
#3 |
|
Bronze Member
![]() Join Date: Aug 2006
Posts: 20
|
hey thanks, don't waste your time on me that malware thing deleted it thanks a bunch!
|
|
|
|
|
|
#4 |
|
Elite Member
![]() Join Date: Jun 2005
Location: Netherlands
Posts: 9,025
|
Hya Ktulu.
What app said that it was Qoologic? It doesn't look like Qoologic to me, and Ewido wouldn't be able to fix it if it was. To be sure I would indeed post the HijackThis and Ewido log anyway, and incase it really is Qoologic then run this aswell: Please download Qoofix by RubbeR DuckY from http://www.malwarebytes.org/Qoofix.zip
__________________
- PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - |
|
|
|
|
|
#5 |
|
Bronze Member
![]() Join Date: Aug 2006
Posts: 20
|
OK once again my ignorance shows
![]() sorry this took so long... yeah Ewido found the file, and the scan cured it... only until I restarted my computer... Qoofix deleted them, now I'm not having any trouble... except I have SurfSideKick and Apropos.... they won't go away... here's my HiJackThis log: Logfile of HijackThis v1.99.1 Scan saved at 12:45:54 AM, on 8/29/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Dassault Systemes\B08\intel_a\code\bin\CATSysDemon.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\RioMSC.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\MoodLogic\Service\Updater.exe C:\Program Files\Browser MOUSE\mouse32a.exe C:\WINDOWS\system32\lexpps.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\AIM\aim.exe C:\Program Files\Ventrilo\Ventrilo.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\MIKE\Desktop\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing) O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - C:\PROGRA~1\PRINTV~1\PRINTH~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [lhgwwir] c:\windows\system32\lhgwwir.exe O4 - HKLM\..\Run: [MoodLogic Updater] C:\Program Files\MoodLogic\Service\Updater.exe O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe O4 - HKLM\..\Run: [qpyrjskA] C:\WINDOWS\qpyrjskA.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\CheckS02.exe O4 - HKLM\..\Run: [necexkb] C:\WINDOWS\system32\kayzcb.exe r O4 - HKLM\..\Run: [Mchrbb] C:\Program Files\Ourvc\Yucccw.exe O4 - HKLM\..\Run: [xij] C:\WINDOWS\xij.exe O4 - HKLM\..\Run: [dykgxkczuzv] C:\WINDOWS\System32\lhgwwir.exe O4 - HKLM\..\Run: [w0e987df.dll] RUNDLL32.EXE w0e987df.dll,I2 000ebe2d00e987df O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ftexc] C:\WINDOWS\system32\mptft.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Pvn] C:\WINDOWS\system32\d?dplay.exe O4 - HKCU\..\Run: [EQTraffic] "C:\Program Files\EQTraffic\EQTraffic.exe" O4 - HKCU\..\Run: [Csan] "C:\DOCUME~1\MIKE\MYDOCU~1\FNTS~1\arpa.exe" -vt yazr O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [blaadm] C:\WINDOWS\system32\blaadm.exe O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZRxdm185XXUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.ht m (file missing) (HKCU) O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O15 - Trusted Zone: *.elitemediagroup.net O15 - Trusted Zone: *.media-motor.net O15 - Trusted Zone: *.mmohsix.com O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - AppInit_DLLs: repairs303169584.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Backbone Service (BBDemon) - Dassault Systemes - C:\Program Files\Dassault Systemes\B08\intel_a\code\bin\CATSysDemon.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe (file missing) O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing) O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe thanks again. |
|
|
|
|
|
#6 |
|
Bronze Member
![]() Join Date: Aug 2006
Posts: 20
|
oh and it probably won't help now that the files are gone.. but here's an older Ewido log from before I ran Qoofix:
--------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 6:58:22 PM 8/26/2006 + Scan result: HKLM\SOFTWARE\Envolo -> Adware.Apropos : Error during cleaning. C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Surf SideKick -> Adware.SurfSide : Cleaned with backup (quarantined). HKLM\SOFTWARE\SurfSideKick3 -> Adware.SurfSide : Error during cleaning. HKU\S-1-5-21-515967899-2025429265-725345543-1006\Software\SurfSideKick3 -> Adware.SurfSide : Cleaned with backup (quarantined). HKU\S-1-5-21-515967899-2025429265-725345543-1006\Software\SurfSideKick3\Internet Explorer -> Adware.SurfSide : Cleaned with backup (quarantined). [1000] C:\WINDOWS\System32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [112] C:\WINDOWS\System32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1204] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1232] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1820] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1832] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1884] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [1908] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [2036] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [2672] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [2916] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [3160] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [3436] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [3460] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [3840] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [480] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [536] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [584] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [596] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [760] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [820] C:\WINDOWS\system32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [888] C:\WINDOWS\System32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). [940] C:\WINDOWS\System32\repairs303169584.dll -> Adware.Surfside : Cleaned with backup (quarantined). C:\WINDOWS\system32\__delete_on_reboot__o_r_h_a_a_ t_d_._d_l_l_ -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\WINDOWS\system32\niwdu.dat -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). [1704] C:\WINDOWS\system32\orhaatd.dll -> Downloader.Qoologic.bj : Error during cleaning. [2800] C:\WINDOWS\system32\orhaatd.dll -> Downloader.Qoologic.bj : Error during cleaning. [3676] C:\WINDOWS\system32\orhaatd.dll -> Downloader.Qoologic.bj : Error during cleaning. [3796] C:\WINDOWS\system32\orhaatd.dll -> Downloader.Qoologic.bj : Error during cleaning. [3924] C:\WINDOWS\system32\orhaatd.dll -> Downloader.Qoologic.bj : Error during cleaning. ::Report end |
|
|
|
|
|
#7 |
|
Tech Member
![]() Join Date: Jul 2006
Location: Western Australia
Posts: 6,068 PC Experience: Elite PC Guru
|
just a side note, the reason you wouldn't have found the file in windows or dos is because it was hidden.
to find hidden files in dos you need to dir filename.extension -a the -a switch is to show all files
__________________
|
|
|
|
![]() |
| Bookmarks |
| Tags |
| computer, find |
| Thread Tools | |
| Display Modes | |
|
|






























Linear Mode

