I am running Windows XP SP3, and earlier this week I discovered these malicious processes running: _qbotinj.exe, and experienced errors and symptoms which led me to search the internet for solutions.
I successfully deleted the _qbotinj.exe process, files and parent folders, and decided to install AVG after some people recommended it.
But for some reason I can't even install AVG because it keeps claiming that this "application" cdcdcdcdc2121cdsfdfd.com - Internet Explorer is running, and cannot seem to be terminated (even if I disable IE).
So since I cannot scan using AVG, I am using Symantec Antivirus, which is still detecting a "Trojan Horse" virus in this location:
C:\Documents and Settings\All Users\_qbothome\_qbotinj.exe
Although there is NO folder for _qbothome, no process running for _qbotinj.exe or anything. (since I deleted it days ago)
How can I locate this phantom file that Symantec keeps finding? Does it exist, or have I successfully deleted it? If so, why do I keep getting warnings?
And is it perhaps related to this <hxxp://www.cdcdcdcdc2121cdsfdfd.com/> application that seems to be stuck? Check the whois.sc database for that URL and you can see the dudes name, address, and company that seems to be the source of this wack url.
Although my AVG install wizard is the only place that detects this hidden cdcdcdcdc2121cdsfdfd.com window, I am very worried about its possible relationship to this "Trojan Horse" threat that Symantec Antivirus keeps detecting.
Here is the warning message I receive from my AntiVirus:
Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Trojan Horse
File: C:\Documents and Settings\All Users\_qbothome\_qbotinj.exe
Location: C:\Documents and Settings\All Users\_qbothome
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Saturday, March 28, 2009 8:29:30 AM
Again, I cannot find a folder for _qbothome, or no process running for _qbotinj.exe or anything. (since I deleted it days ago)
Any help or direction is MUCH appreciated.
Thank you kindly, and please let me know if I ought to provide any more info.
Edited by Orange Blossom, 11 February 2013 - 04:26 AM.
Deactivate link. ~ OB