Cannot remove/find Trojan from Dell system

Question

Hello all, I am having a problem removing a trojan infection from my friends computer.   Info: Downloader.Generic.EUO qcqsj.exe AVG indentifies location as: C:\WINDOWS\system32\   Windows XP Home, sp1a Dell 2400 - I scanned the system in safe mode with system restore disabled. It found two trojans and removed them completely from the system. I booted back up to Windows normally, and after a few seconds AVG popped up an alert that it had found the above Trojan again.   When I try using the Heal or Remove option provided by AVG, I receive an error that 'This action cannot be completed - Access Denied'. This occurs even when logged on as Administrator.   I tried reinstalling AVG thinking there may have been a problem with it, without success. When browsing to the \system32\ folder, there is no such file that I can see. I also tried searching the registry, msconfig and task manager with no luck.   I also used Trend Micro online scan, but did not pick up that paticular virus and could not find anything online about this virus.   When surfing the Web her grandson received an alert that 'the blackworm virus had been detected'. Before asking, he click the option to install the software to remove it.   Thanks!!! Message Edited by lukep on 03-29-2006 09:58 AM

bamajim · Answer

lukep Go here and download Hijackthishttp://dsvs.org/5/HijackThis.exeSave it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit 'Scan'. When the scan is finished, the 'Scan' button will change into a 'Save Log' button. Press that, save the log, Ctrl-A to Select All, and copy its contents here. At the link belowhttp://forums.us.dell.com/supportforums/board?board.id=si_hijackPlease do not be tempted to 'fix' on your own. Hijackthis is a very powerful tool, if used incorrectly can cause system problemsbamajim

lukep · Answer

Thanks for the reply. I have posted the HJT log to the forum you listed. http://forums.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=31278

Virus & Spyware

Was this post helpful?