Trojan.Qforager

Discussion in 'malware problems & news' started by Randy_Bell, Jan 27, 2003.

Thread Status:
Not open for further replies.
  1. Randy_Bell

    Randy_Bell Registered Member

    Joined:
    May 24, 2002
    Posts:
    3,004
    Location:
    Santa Clara, CA
    Symantec Security Response - Trojan.Qforager

    Trojan.Qforager is a Trojan horse that attempts to steal the password for the QQ instant messenger program and email it to the hacker.

    Type: Trojan Horse
    Infection Length: 214,016 bytes
    Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
    Systems Not Affected: Windows 3.x, Macintosh, OS/2, UNIX, Linux

    technical details

    When Trojan.Qforager is executed, it does the following:


    • 1. Adds the value:

      AudioHQ <path to the trojan>

      to the registry key:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

      so that the Trojan runs each time you start Windows.

      2. Attempts to steals the password for the QQ instant messenger program and email it to the hacker.

    removal instructions

    These instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


    • 1. Update the virus definitions.
      2. Run a full system scan and delete all the files detected as Trojan.Qforager.
      3. Delete the value AudioHQ

      from the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    2. Scanning for and deleting the infected files


    3. Deleting the value from the registry

    CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.


    • 1. Click Start, and then click Run. (The Run dialog box appears.)
      2. Type regedit, and then click OK. (The Registry Editor opens.)
      3. Navigate to the key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      4. In the right pane, delete the value AudioHQ.

      5. Exit the Registry Editor.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.