Hello-
I am running XP3 and when doing a Loaris Trojan Remover scan I receive the following "Infections" that Loaris picks up each time I run. Loaris indicates it removes the registry infections but each time I re-run they reappear each time I scan with Loaris.
From the scan log:
Loaris Trojan Remover v.1.2.1.8
Report file date: 11/16/2010 2:25:58 PM
Scanning for 460344 virus strains and unwanted programs.
Licensed for: [removed]
Serial number: xxxxx-xxxxx-xxxxx-xxxxx-xxxxx
Windows version: Microsoft Windows XP (version 5.1)
Username: User
Computer name: MARCIA-6X7H850P
Starting the file scan:
Startup collected
BHO plugins collected
Service collected
ActiveX collected
Files collected
Scanning process…
—– .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} —- Registry
Backdoor.Bot
—– .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} —- Registry
Backdoor.Bot
—– S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} —- Registry
Backdoor.Bot
—– S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} —- Registry
Backdoor.Bot
—– _USERS\.DEFAULT\Software\Sysinternals Antivirus —- Registry
Trojan.RogueSysinternalsAntivirus
—– ocuments and Settings\All Users\Dokument\Min musik\ld9.exe —- Registry
Trojan.Win32.Scar
—– .DEFAULT\Software\DefenceCenter —- Registry
Rogue.DefenceCenter
Scan result: 7 detected items
Scan completed in: Scan completed in 7 minute(s) 11 sec.
Files were scanned: 13441
However when I run MBAM (in safe mode and normal), Threatfire, SuperAntiSpyware and my AVG Antivirus scans I do not get these "infections". My scans with all of these applications come up clean.
It is interesting to note that when I enable the MBAM protection module and then try to access my Loaris Trojan Remover application (connected to the interenet) MBAM blocks the connection as a "connection to a potentially malicious website" and will not let the application update and scan.
Has my Loaris Trojan Remover application been compromised and is it trying to access a site that will give me the above "infections" so that I will think that my machine is infected and giving me these as false infections so that I will run out and purchase some antivirus software?
Any assistance with this would be GREATLY appreciated!
I suspect they are false detections and you will be doing yourself a favour to uninstall this product.
Just to be on the safe side, please run the following diagnostic scans and i'll see if there is any malware on your system.
Please download DDS from either of these links
LINK 1 LINK 2
and save it to your desktop.
Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.
————————————————— Please include the contents of the following in your next reply:
DDS.txt Attach.txt.
NEXT
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image] Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
CatByte-
Thank you for the reply and link information about Loaris Trojan Remover which are giving me these infections. My thinking at this point is that they are false positives and I do appreciate you offering to take a look at my system. I have followed your instructions and have attached the Attach.zip, DDS.txt and Gmer.zip log files for your review. (I zipped the Attach log per the instructions and the Gmer log since it seemed large)
Thank you in advance for your guidance and offer of assistance. It is appreciated!
I look forward to hearing from you!
This file, may or may not be present - let me know
submit a file to virustotal for analysis
Use the browse button on that page to navigate to the location of the file to be scanned.
In the right hand panel,
click on the file c:\windows\system32\drivers\qqqqv.sys
then click the open button.
The file will now be displayed in the submit box.
Scroll down a bit and click "send file", wait for the results
If you get a message saying File has already been analyzed: click Reanalyze file now
Once scanned, copy and paste the link to the results page in your next reply.
If the file IS NOT present on your system, then do the following:
On your keyboard, press the Windows logo key and the letter R to open a Run command box
enter the following two commands one at a time, hitting enter after each.
sc stop aypam sc delete aypam
Reboot the machine.
NEXT
Go here to run an online scanner from ESET.
Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.
CatByte-
Thank you for your prompt reply. Followed your instuctions above. I did not have c:\windows\system32\drivers\qqqqv.sys file you mention so I carried out the 2nd part of the instructions you outlined.
The results of my ESET scan is as follows:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=22455555c49231429485ef49553299aa
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-11-20 08:03:53
# local_time=2010-11-20 02:03:53 (-0600, Central Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1024 16777191 100 0 0 0 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=171732
# found=0
# cleaned=0
# scan_time=8733
Looks like this scan did not pick up any infections so my thinking is that I am okay. Would you agree?
I uninstalled my Loaris Trojan Remover application and will not be using this tool going forward.
Just finished my scan so I am anxious to see how my system performs!
Thank you again for your GREAT assistance!
Your system appears to be clean, I think you are better off without that program, MalwareBytes is a better program to run every now and then.
Just need to do some housekeeping
Please do the following:
You can delete the DDS and GMER logs and programs from your desktop.
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.
DownloadTFCto your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Please take a look at this well written article: PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
CatByte-
Thank you once again for the prompt follow-up. It is appreciated. I deleted files/pgms as advised, ran temp files clean-up and windows update and have taken a look at the recommendation articles/websites above.
Thank you again for your time and assistance with this. Your help is most appreciated!
Any assistance with this would be GREATLY appreciated! 
I look forward to hearing from you!
~CB