msconfig-->startIE. Where did it come from?

[Hotpepperz]

I have been having some major problems with bluescreens ever since I installed a Lexar jumpshot USB camera card reader. I uninstalled it and got the latest drivers, but I still have a persistant problem with hangups and non shutdowns. The only thing I have noticed is that notepad is running in memory when I ctrl, alt del. Huh? So I checked out msconfig and I have a persistant check at "startIE C:\windows\notepad.exe qazwsx.hsq" . What is qazwsx.hsq and why wont it go away? How can I get it out of msconfig startup tab? My bluescreens are fatal exeption errors with VXD VMM and VXD VNBT. Any one got a clue? I HAD a stable (for Windows 98se anyway) system until now.

 

[rocmonster]

Okay, it looks like you picked up a trojan called the Qaz Worm (W32.HLLW.Qaz.A)

Go here for more info.. You will also get information on how to remove it.

and here for more general info on trojans.

 

[rocmonster]

just a bump because this trojan is recent and in the wild.

 

[Hotpepperz]

Roc, Gooooood Call. I installed InoculateIT virus scan and it didn't catch it until I got the latest download. Inoculate said it got rid of it but I still had HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\startIE="notepad.exe qaxwsx.hsq" in my registry. I deleted it and note.com from my computer. I guess it is gone. We'll see if it comes back. I can't understand how it got on my computer. I am extreamly cautious about files or email attachments I get from the internet.

Thanx again,
Hotpepperz

 

[rocmonster]

Hotpepperz,

Good to see you took steps to remove it. From the info I've read, you could have gotten it from an e-mail attachment or a proggy you downloaded from what may have seemed like a "clean" site. Did you get any e-mail attachments lately, someone you know may be (unknowningly) spreading it via e-mail. As for notepad.exe, I guess you could extract a new copy from your win98 set up cd.

🙂