Left overs from trojan attack: Trojan.downloader-MSNETAX

[blight]

Greetings to such a great community, first time seen but this product is more than worth it just purely from support on the forums...Well i faced the cxxxx.nls problem recently.I will detail quickly what things i did as they may shed light in ways i dont know...(Main question is below here, this may just help later on, Skip if wish)

Turned PC on, noticed first slowed down DL rate then seeing it was sending/recieving when i either on desktop or just google whihc normally doesnt do anymore after loading...Anyway tried a quick sys restore as i recent faced something like that and i was able to restore, this time it didnt work.

AVG detected but could not properly clean the trojans, got SAS, this showed me malware in the form of Memory items/registry/etc after a full scan and deleted all quaratined items, leaving me without access to the net a sys restore to the time before the files were quartined the next morning showed i had a active working connection but of course infected...

This is repeated a few times then i finally start restoring things one by one, enabling and disabling the connection, finally one worked...deleted all the rest, restart into safe mode, replaced the patched ndis file with a clean version from C:\WINDOWS\ServicePackFiles\i386 no more reference to cxxx.nls or remaking itself via the core file ndis.

PC seems to work fine in terms of processes running, usage basic things i perhaps but what i can see its fine, Connection works fine...no more uploading while i am desktop, no more up/download in google or while i am here typing this.

Main Question-

All seems fine, but i know there is there is something left over, perhaps nothing that is up/downloading or able to without the other parts to the trojan but it is there, sas reports it as (side note i know and have hidden.dragon virus on my comp currently, i am not ridding it via SAS as i dont see it as a overt threat, tho any addition info and techniques for staying clean and ridding it would be nice)

Trojan.download-MSNETAX[4 items]

Files

C:\recyclers\s-1-5-21-2025429265-725345543-839522115-500\dd1.dll

C:\WINDOWS\system32\qvgwxpt.dll

C:\WINDOWS\system32\uvglslm.dll

Memory processes

C:\WINDOWS\system32\qvgwxpt.dll

If i quaratine and remove these, no more connection...have we got infomation about this, is it dangerous to keep? keylogging? uploading still perhaps? the connection still uploads a touch very now and again, am i putting others at risk retaining this for the current moment?

Basically. What should i do?

Much appreciation to those who took some time out and read this

[SUPERAntiSpy]

Greetings to such a great community, first time seen but this product is more than worth it just purely from support on the forums...Well i faced the cxxxx.nls problem recently.I will detail quickly what things i did as they may shed light in ways i dont know...(Main question is below here, this may just help later on, Skip if wish)

Turned PC on, noticed first slowed down DL rate then seeing it was sending/recieving when i either on desktop or just google whihc normally doesnt do anymore after loading...Anyway tried a quick sys restore as i recent faced something like that and i was able to restore, this time it didnt work.

AVG detected but could not properly clean the trojans, got SAS, this showed me malware in the form of Memory items/registry/etc after a full scan and deleted all quaratined items, leaving me without access to the net a sys restore to the time before the files were quartined the next morning showed i had a active working connection but of course infected...

This is repeated a few times then i finally start restoring things one by one, enabling and disabling the connection, finally one worked...deleted all the rest, restart into safe mode, replaced the patched ndis file with a clean version from C:\WINDOWS\ServicePackFiles\i386 no more reference to cxxx.nls or remaking itself via the core file ndis.

PC seems to work fine in terms of processes running, usage basic things i perhaps but what i can see its fine, Connection works fine...no more uploading while i am desktop, no more up/download in google or while i am here typing this.

Main Question-

All seems fine, but i know there is there is something left over, perhaps nothing that is up/downloading or able to without the other parts to the trojan but it is there, sas reports it as (side note i know and have hidden.dragon virus on my comp currently, i am not ridding it via SAS as i dont see it as a overt threat, tho any addition info and techniques for staying clean and ridding it would be nice)

Trojan.download-MSNETAX[4 items]

Files

C:\recyclers\s-1-5-21-2025429265-725345543-839522115-500\dd1.dll

C:\WINDOWS\system32\qvgwxpt.dll

C:\WINDOWS\system32\uvglslm.dll

Memory processes

C:\WINDOWS\system32\qvgwxpt.dll

If i quaratine and remove these, no more connection...have we got infomation about this, is it dangerous to keep? keylogging? uploading still perhaps? the connection still uploads a touch very now and again, am i putting others at risk retaining this for the current moment?

Basically. What should i do?

Much appreciation to those who took some time out and read this

If you are left without a net connection, use the LSP repair in our repairs sections - could you send those files to samples AT superantispyware.com and I will see what they are?

[fatdcuk]

The trojan labelled Trojan.download-MSNETAX is the culprit for borking your connection.

Follow SUPERAntiSpy suggestion and then try SAS scan+ removal to see if the culprit and issue's have been resolved.

[blight]

Files will be sent asap

Now i do not need this LSP fix as i have my net connection already up and working, my only problem is this last trace of the trojan. i have already redone my scans a few times, this is now the only thing left...if i remove it via SAS it will bork the connnection, i cant safe mode delete it as its running as a process, nor can i find reference on my comp of any other core files named

C:\WINDOWS\system32\qvgwxpt.dll

C:\WINDOWS\system32\uvglslm.dll

now i have read about this icehack or icesword or soemthing which is a forced delete, is such program good in this instance i can see its merits in others, but in this case?

My real concern is this a dangerous bit of leftover? as you may see my cleaning is a very primitive type, but currently it is satisfactory....

I hope sending these files will clear it up

[blight]

I would also note that i was looking for a LSP thread hahaha, instead i see its a tab on sas, a tab which i dont have.

The main program is called super ad blocker? as thats where i access sas

Files sent under title

SAS forum thread, Zipped trojan request

[blight]

Update, hotmail wont let me send out this .rar as its got a virus inside it and they will not take/send it...possible to do via forums? attachments?

[SUPERAntiSpy]

Update, hotmail wont let me send out this .rar as its got a virus inside it and they will not take/send it...possible to do via forums? attachments?

ftp://ftp.superadblocker.com

Put it in the incoming folder.

[blight]

put it in there, but when i recheck to see if its there, its gone...or is this folder auto send to you right away?

[SUPERAntiSpy]

put it in there, but when i recheck to see if its there, its gone...or is this folder auto send to you right away?

The folder is write only. I will get the files.

[blight]

Thank you, not sure how long these things take, any update? sorry for impatiency

[SUPERAntiSpy]

Thank you, not sure how long these things take, any update? sorry for impatiency

When we have had a chance to analyze the files, I will update the thread.

[SUPERAntiSpy]

We detect and remove those files no problem - you need to download the SUPERAntiSpyware Free Edition and use our LSP/Network Connection repair after the scan and removal.

[blight]

Thank you for your continued work in this field, its great seeing peoples dedication