Comments on: Qotr Virus

By: George Slaine

George Slaine — Sun, 19 Mar 2023 20:43:45 +0000

In reply to Jules.

Hi Jules,
yes remove the said objects, without the “csrss” file.

By: George Slaine

George Slaine — Sun, 19 Mar 2023 20:42:03 +0000

In reply to Jules. Hi Jules, you can remove this entry.

By: Jules

Jules — Mon, 06 Mar 2023 04:57:24 +0000

1.) Im in step 6 already and im inside HKEY_CURRENT_USER > software. I have come across unusual long generated file names, for example like “AppX2a031bcqzshqz1kzc03gsje8tkmj2jj4”. Following that are many more of those types of long unusual generated file names staring with the word “App” and then following some more long random letters and numbers.

2.) I went to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run next and i saw a file name “csrss”, type is REG_SZ, is this also a malicious file?

3.) and then lastly i went to HKEY_CURRENT_USER > Software > Microsoft > Internet Explorer > Main. I saw some unusual long names under data something like “2c 00 00 00 00 00 00 00 00 00 00 00 00 83 ff ff 00 83 ff ff ff ff ff ff ff ff ff ff 3b 01 00 00 54 00 00 00 bb 03 00 00 34 02 00 00”. Is this malicious?

By: Jules

Jules — Mon, 06 Mar 2023 04:29:31 +0000

at step 5, im already here on my host file, i opened it with my notepad and there was a text written below the second local host saying: 0. 0. 0. 1 mssplus.mcafee.com. Is this suspicious or malicious at all? if yes what do i do?