[Closed] "wowfx.dll" virus

The file works now… So i'll download it when I get home.

Keep me posted. Trevuren

When I ran the .exe, The text " A duplicate file name exists, or the file cannot be found." kept looping for a few minutes, and then the program gave the text box "finish!!". It does not seem as if any new files were created or copied to C:\Documents and Settings\mjhin…. The files in C:\QooBox\Quarantine\C\Documents and Settings\mjhin are all still there.

I need to see if you are using the tool properly:

1. Place the CF-DeQuarantine.exe tool in the C:\Qoobox folder.

2. Now locate these files and drag/drop them, one at a time, onto the CF-DeQuarantine.exe file and wait for the "Finish" text box before moving to the next file.

3. Now check and see if they have :

a. Moved
b. Been renamed to lose their .vir extension
c. Have disappeared from the Qoobox

I am hoping for all three


Please get back to me to with a reports on the results.


Trevuren

Ok. So the first thing I did was go to C:\QooBox\Quarantine\C\Documents and Settings\mjhin\Application Data Then, I choose the first file that wasnt currently in C:\Documents and Settings\mjhin\Application Data, which happened to be the folder Apple Computer(C:\QooBox\Quarantine\C\Documents and Settings\mjhin\Application Data\Apple Computer ). Inside this "Apple Computer" file there were two additional files: C:\QooBox\Quarantine\C\Documents and Settings\mjhin\Application Data\Apple Computer \itunes, and \quicktime. I then dragged the folder "qoobox\Apple Computer" to the CF-DeQuarantine.exe. Upon going to C:\Documents and Settings\mjhin\Application Data (the normal documents/settings), Apple Computer showed up as a file :). Unfortunantly, clicking on that file "Apple Computer" yields an empty folder :(. In addition, the qoobox file C:\QooBox\Quarantine\C\Documents and Settings\mjhin\Application Data\Apple Computer was still present, with all its subfolders as well. Please respond with any questions, as I'm not sure how clear that just was.

Did you first follow my instructions provided in Post #34 and post a reply as requested?

Huh? Did you mean something along the lines of: 1. Yes the file was moved. 2. Yes the .vir was removed. 3. No it was not removed from qoobox.

I apologize. I did not include the list of files that I needed you to try and move: The files: C:\QooBox\Quarantine\C\Documents and Settings\mjhin\mit.bat.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\ntuser.dat.LOG.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\ntuser.dat.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\NTUSER.INI.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\trace.log.vir Now use the instructions in Post # 34 and please answer the questions. Trevuren

….I'm sorry if I am frustrating you, but I really don't understand what that means.

I reported back on the results. Twice, in two different fashions.

Unless you are saying there should be a log file? No logfile was created, unless you want me to run HJT again…

Also, perhaps part of the confusion is here

2. Now locate these files and drag/drop them, one at a time, onto the CF-DeQuarantine.exe file and wait for the "Finish" text box before moving to the next file.

I just assumed you meant choose a random file, since you didn't specify.

Check my previous post. I edited it to better fit the circumstances

I ran the following files through de-quarantine one by one. C:\QooBox\Quarantine\C\Documents and Settings\mjhin\mit.bat.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\ntuser.dat.LOG.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\ntuser.dat.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\NTUSER.INI.vir C:\QooBox\Quarantine\C\Documents and Settings\mjhin\trace.log.vir Each was succesfully removed from the qoobox file, moved to the normal C\Doc and settings\mjhin file, and lost the .vir extension.

Excellent!!. Please do not move anything else until I give you the OK.

It appears that we will have to work from the bottom of the Tree structure to the Top instead of being able to move everything all at once. So this is going to be a bit more time consuming.

First, I will need a copy of the Qoobox structure so I can follow along with you and assist you if you run into any difficulties:


1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

@Echo off
dir /s C:\Qoobox > C:\Qootree.txt
Notepad C:\Qootree.txt

3. Save the file to your DESKTOP as "Qootree.bat". Make sure to save it with the quotes. Once saved, the icon to click should look like this on your desktop: [external image: Posted Image]

4. Double click Qootree.bat.

5. A Notepad window will popup containing a lot of information. Please copy/paste the content in your next reply. If you think that it may be difficult to fit all the information into one post, do not hesitate to split it up and use as many as required. Based upon the results, I will develop a strategy to help you move the files.


Trevuren

The qootree.txt file was about 958 kb, so I split it into two files that I could attach.

Here is the second part of the file

OK, I now have 3 people confirming that the renaming and move work on their machines and the entire folder is back where it belongs. However, the copy still remains in the Quarantine folder, but the .vir extensions are gone. We just have to find out why it does not work on yours that way.

Please read all these instructions completely before starting. If anything is not clear, please ask for clarification before proceeding.


Please do the following:

1. DELETE all current copies of CF-DeQuarantine.exe that you have on your machine.

2. Download a fresh copy of CF-DeQuarantine.exe from here: http://download.bleepingcomputer.com/sUBs/…eQuarantine.exe , to your Desktop.

3. Now we need to make sure that All hidden Files are visible:

To enable the viewing of Hidden files follow these steps:

1. Close all programs so that you are at your desktop.
2. Double-click on the My Computer icon.
3. Select the Tools menu and click Folder Options.
4. After the new window appears select the View tab.
5. Put a checkmark in the checkbox labeled Display the contents of system folders.
6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
7. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
8. Remove the checkmark from the checkbox labeled Hide protected operating system files.
9. Press the Apply button and then the OK button and shutdown My Computer.
10. Now your computer is configured to show all hidden files.


4. Now copy/paste a copy of CF-DeQuarantine.exe into the C:\Qoobox folder as before.


5. Now we will try an esy one to start with to see if this works for you. The result we are looking for is that the tool moved the folder in question where it is supposed to go with all its content and without any .vir extensions.

DO NOT PROCEED with any other moves until I have instructed you to do so.

6. After the tool has finished with the folder, perform the above verification and report the results back here.


7. Open Windows Explorer and navigate to:

C:\QooBox\Quarantine\C\Documents and Settings\mjhin\

Expand the tree by clicking on the + sign if it is not already done. In the right side of that Windows, you should see several folders one of which is labeled "COOKIES"

8. Now Drag/Drop the COOKIES folder from the right-hand pane of Windows Explorer into CF-DeQuarantine.exe just like when you moved the files but this time, it is a folder.