Comments
QAZ Trojan is the trojan
believed to have infected Microsoft. When analyzing the file we found references
to move notepad.exe to note.com and name the trojan itself to notepad.exe.
However, upon actual testing our version of the QAZ Trojan, it did not
replace the notepad.exe. So, if you have a note.com file it probably is
your real notepad.exe. Once the QAZ Trojan has infected one computer it
looks for other shared hard drives and attempts to infect them. It then
emails to a Russian address and waits for a connection.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Rember the value (file
path) of the startIE
key in the registry located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and then remove the startIE key. Which can
be done with regedit or any other registry editing program.
-
Reboot the computer or
close the file listed in the startIE registry
key.
-
Delete the trojan file
listed in the startIE registry key.
|
