Verizon Wireless Trojan Horse

[NJ]

If you receive an email that appears to be from Verizon Wireless, don't click on anything. I got a Trojan horse from one yesterday, which opens a backdoor on your computer for all kinds of information theft.

It was a stupid mistake on my part to open the email. Don't open emails when you are distracted. Danger signs I ignored: 1) the return address was not Verizon, 2) why would Verizon send a zip file, when I could go to my online account? 3) why was I stupid enough to click on an exe from an email.

The trojan was released yesterday. Symantec doesn't have anything about it on their site, that I can tell. The AVG site is hopeless for getting answers. Does anyone know of a fix?

[Uncle Dog]

I got a Trojan horse... yesterday, which opens a backdoor on your computer... The trojan was released yesterday.

How did you detect it? How do you know what it does?

[NJ]

I realized it was a virus or trojan horse the minute I clicked on the icon. Well, after I clicked, but I can't remember why. I had about 3 things I was trying to do at the same time, but noticed that it really sucked up my processor speed.

After a few minutes, my AVG detected it too. There was one full install, which I had AVG isolate, and several partial installs, which AVG can't take care of because it can't find certain files. When I start the computer, it keeps looking for that piece. When the computer starts it has an error message:

RUNDLL
Error loading ifmq.kqo
The specified module could not be found.

I'm not sure whether I stopped the exe from loading or whether AVG left some stuff from the full install removal.

Anyway, it only shows it now on a full computer scan, but I've disabled my wireless to keep the backdoor shut. Bet I didn't disable it soon enough for some issues, though!

This will make another handout for my students - don't mind their getting a good laugh at the fact that even their web development instructor makes stupid mistakes!

[innominds]

I do have Kaspersky protection so I'm pretty confident about it.

[SemAdvance]

Download and run

HijackThis - Trend Micro USA

Great tool I absolutely love.....

[NJ]

Download and run

HijackThis - Trend Micro USA

Great tool I absolutely love.....

Thanks for the information! I had seen that program available from Tech Support Guys Forum, but didn't know whether it was legit. The last time I picked up an infection (go.google.com) one of the sites I went to in my research actually carried an infection. So, I've been rather leery of trusting even unknown support sites. Virus Alert: Go.Google.com

[deepsand]

There was one full install, which I had AVG isolate, and several partial installs, which AVG can't take care of because it can't find certain files. When I start the computer, it keeps looking for that piece. When the computer starts it has an error message:

RUNDLL
Error loading ifmq.kqo
The specified module could not be found.

If you're not comfortable with manually editing the Registry Hive, I would suggest that you :

• Install Spybot Search & Destroy, and use the Advanced Mode to give you access to the Startup calls, where you can delete any malware entries found there; and, then,
• Install a Registry cleaner, one that allows you the final word as to what changes are made, such as Registry First Aid (the free trial version will suffice), and let it find & remove any orphaned entries in other areas of the Reg. Hive.

The above can be downloaded from The home of Spybot-S&D! and Registry First Aid - Award Winning Windows Registry Repair , respectively.

[edhan]

You can run msconfig and check on the services & startup as most trojans and spyware will include them in there. Simply un-check those that looks suspicious or unknown. Not to worry if you un-check those that are needed as you can come back again to check them back if you have made a mistake.

I am using Nod32 that is quite reliable in terms of protection.

[deepsand]

SS&D goes well beyond the capabilities of msconfig, which provides only for toggling between run and -run once states, by also providing for the deletion of unwanted entries, the blacklisting of such, so as to prevent their reappearance, along with providing information re. both benign and malignant entries reported in the StartUpList maintained by Sysinfo.org .

[deepsand]

RUNDLL
Error loading ifmq.kqo
The specified module could not be found.

Also, check both the Registry Hive's "Run Once" entries and the Startup Folder for .reg files, which are frequently used by malware which randomly renames itself after boot, as a means of knowing which file name to load at the next boot.