Worm.Qaz virus infecting Notepad.exe

[Hankysmoo]

I have 2 computers and use mirc, surfing the web, and looking at email thru outlook express extensively on both computers. I have just done complete formats on both comps and on one computer installed Norton2k for win98 and AVP for the other computer with win2000. After about maybe a week or so of usage, i suddenly got a virus named Worm.Qaz, as the virus scanner popped up a msg when I booted up into windows. I dont know exactly where i got it or when but it seems to be on my other computer as well. Infecting notepad.exe. This virus is undisenfectable and all i can do is delete notepad.exe from my computer. Anyone know where this is from or how to protect against it? I am thinking its either from MIRC or Outlook Express, as I dont download from strange sites ever and always make sure to scan all my files b4 executing them. Also, anyone know where i can get a replacement of notepad.exe? thx

 

[sciencewhiz]

here is some info about w32.hllw.qaz.a (aka worm.qaz)

at the bottom is removal instructions, the virus only renames notepad.

 

[Rayvin]

I had something similar happen to my system recently. I rplaced notepad.exe, in the process I found that it had almost doubled the size of my old notepad.exe. Now the problem is... everytime I boot into Win98SE now, I get a message saying that qazwsx.hsq cannot be found, would you like notepad to recreate it? I say no and an empty notepad doc opens which I have to close everytime I start up. Now I can't get rnaapp unstuck. Everytime I try to dialup, I get the handshake the an error 678 - no answer. Ctrl+alt+del and rnaapp is running. It's running at startup also. I've done everything I know to get rid of rnaapp to no avail. I work ISP tech support so I'm familiar with rnaapp, when it is suppose to be running, and what to do to get rid of it, but nothing seems to work. Any ideas?

 

[Racer7201]

I also had it on 2 computers at home.

Rayvin, There may be an entry in the registry that is responsible for the message you're receiving.
Check:
Remove the following registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run as
value StartIE=notepad.exe

 

[Hotpepperz]

Welcome to the club. I got the virus somewhere and noticed that StartIE kept loading even when I would uncheck it from msconfig (check mark would reappear after startup) Check out my post from a few days ago. msconfig-->startIE. Where did it come from? (Operating Sys forum). InnoculateIT (virus prot from CAI) found and said the virus was cleaned however I checked my REG and found the Key was still there and so was note.com. CAI gives a good description of the virus. I have been having numerous problems with blue screens since I got the virus. Im pretty sure the virus caused the problems because my puter was stable until last Saturday when I think I got the virus. Has anyone else been having vxdvmm and vxdvnbt bluescreens also? Rayvin, I have been having modem problems also.

 

[jdmillikin]

Thanks for the tips on how to get rid of this thing, I have had it here for a couple of weeks and didn't know for sure how to handle it. I think it is gone now!!

Jerry