Author Topic: Qhost trojan, Important !!! info  (Read 668 times)

Offline Roscoroo

  • Plutonium Member
  • *******
  • Posts: 8424
      • http://www.roscoroo.com/
Qhost trojan, Important !!! info
« on: October 04, 2003, 12:24:09 AM »
this bug comes in thru active X scriptings and there is no AV fix for it it exploites IE and OE . go to this site for further info....

http://www.technewsworld.com/perl/story/31756.html
Roscoroo ,
"Of course at Uncle Teds restaurant , you have the option to shoot them yourself"  Ted Nugent
(=Ghosts=Scenariroo's  Patch donation

Offline BaneX

  • Zinc Member
  • *
  • Posts: 24
Qhost trojan, Important !!! info
« Reply #1 on: October 04, 2003, 12:30:35 AM »
This is what Tumor was running into in another thread.  I posted a url with some things you can try to fix the issue, but it's nto a definite.

shrpshtr

Offline Roscoroo

  • Plutonium Member
  • *******
  • Posts: 8424
      • http://www.roscoroo.com/
Qhost trojan, Important !!! info
« Reply #2 on: October 04, 2003, 12:52:05 AM »
I had a feeling thats what may have been going on w/ Tumor's pc

Had to start a warning thread though ....Micro trend has a deleation process for it but it looks like nooooooooo fun thats for shure.
« Last Edit: October 04, 2003, 12:54:51 AM by Roscoroo »
Roscoroo ,
"Of course at Uncle Teds restaurant , you have the option to shoot them yourself"  Ted Nugent
(=Ghosts=Scenariroo's  Patch donation

Offline BaneX

  • Zinc Member
  • *
  • Posts: 24
Qhost trojan, Important !!! info
« Reply #3 on: October 04, 2003, 12:56:53 AM »
Yeah the whole process involves a registry hack and is pretty involved.  Annoying little trojan to say the least.

shrpshtr

Offline BB Gun

  • Copper Member
  • **
  • Posts: 289
Qhost trojan, Important !!! info
« Reply #4 on: October 04, 2003, 03:50:32 AM »
So, if you use a popup killer, you are probably safe?

Sure sounds like it to me...

*pats google toolbar*

BB
Win7x64/ECS PH-55A Black / Corei7 860 / 8GB Gskill F3-10666CL8D-4GBHK / Westy L2410NM / Radeon 5770 / Corsair 650TX / LG DVD / WD 640 Black AALS / WD 1TB&2TB GRN
My Pics
My daughter

Offline Roscoroo

  • Plutonium Member
  • *******
  • Posts: 8424
      • http://www.roscoroo.com/
Qhost trojan, Important !!! info
« Reply #5 on: October 04, 2003, 10:33:49 AM »
actually your not safe with a popup stopper for this one... its part of the unsigned active X scripting ... (that fancy flashy junk on webpages ect)  disable all your active X controls except for the signed ones (place those on prompt)

pop up stoppers stop unwanted pages from opening /instant downloads/that stupid porn virus/and other maliciuos stuff.

It does not stop active X or other java script virus's.
Roscoroo ,
"Of course at Uncle Teds restaurant , you have the option to shoot them yourself"  Ted Nugent
(=Ghosts=Scenariroo's  Patch donation

Offline 214thCavalier

  • Silver Member
  • ****
  • Posts: 1929
Qhost trojan, Important !!! info
« Reply #6 on: October 04, 2003, 02:48:03 PM »
Check Windows update 2 new releases today.

Offline GRUNHERZ

  • Plutonium Member
  • *******
  • Posts: 13413
Qhost trojan, Important !!! info
« Reply #7 on: October 04, 2003, 08:39:53 PM »
What releases? I seem to have this problem too.

Offline Maverick

  • Plutonium Member
  • *******
  • Posts: 13921
Qhost trojan, Important !!! info
« Reply #8 on: October 04, 2003, 10:28:04 PM »
Does this involve resetting your home page every time you shut down yout PC as well??

I have looked for the cookie or whatever that did this but am ready to format again at this point. That will be the second time this week alone. :(
DEFINITION OF A VETERAN
A Veteran - whether active duty, retired, national guard or reserve - is someone who, at one point in their life, wrote a check made payable to "The United States of America", for an amount of "up to and including my life."
Author Unknown

Offline Roscoroo

  • Plutonium Member
  • *******
  • Posts: 8424
      • http://www.roscoroo.com/
Qhost trojan, Important !!! info
« Reply #9 on: October 05, 2003, 12:10:13 AM »
Quote
Originally posted by Maverick
Does this involve resetting your home page every time you shut down yout PC as well??

I have looked for the cookie or whatever that did this but am ready to format again at this point. That will be the second time this week alone. :(


you have common spyware/ pornbot junk in your regestry

Deleate all your cookies/temp files...

then go to start/run/ msconfig /startup ......

look for the offending programs that shouldnt be there disable them . do not restart ..   write down the program thats causing this  " as example   C:/windows/ startup/spammypornbot.exe  "

go to start /find/ files,folders   type in  the offending exe search then delete these nasty things.

your favorites list should be full of this junk too... deleate those in there also . do a disk cleanup again  ..reset your browser to Msn or what ever...

then restart

this is one way to get rid of this ....

anouther way is to go to add/ remove programs and remove  it that way ... but sometimes its not always there, and if it is it doesnt get it all .


I cant guarrentee that this is your problem but this is a common cause of browser homepage getting changed ...

If you install a popup stopper  and configure your active X to trusted sites only / prompt
along with turning off java scripting  it will ussually stop this from happening .  this also prevents the Qhost trojan from getting you.

I went and looked at MS updates for IE today and i havent seen a correct patch for this .... (I only checked for win 98se) my XP is on my pc at work...
Roscoroo ,
"Of course at Uncle Teds restaurant , you have the option to shoot them yourself"  Ted Nugent
(=Ghosts=Scenariroo's  Patch donation

Offline B17Skull12

  • Gold Member
  • *****
  • Posts: 3839
Qhost trojan, Important !!! info
« Reply #10 on: October 05, 2003, 02:48:27 AM »
skuzzy might want to sticky this for a while.
II/JG3 DGS II

Offline 214thCavalier

  • Silver Member
  • ****
  • Posts: 1929
Qhost trojan, Important !!! info
« Reply #11 on: October 05, 2003, 04:30:42 AM »

Offline Roscoroo

  • Plutonium Member
  • *******
  • Posts: 8424
      • http://www.roscoroo.com/
Qhost trojan, Important !!! info
« Reply #12 on: October 05, 2003, 12:48:31 PM »
the update isnt really much of a update i notice ... for 98 - nt it telling us to install a firewall .....

For XP it has a long list do this do that ... and a update for XP
Roscoroo ,
"Of course at Uncle Teds restaurant , you have the option to shoot them yourself"  Ted Nugent
(=Ghosts=Scenariroo's  Patch donation