NSTRUE.EXE and FQQE.EXE

[JohnConnolly]

I'm trying to clean up our WinNT Server after a virus infection. I've got rid of the virus but I have two processes running that I'm concerned about. Both are started from Run in the registry:

nstrue.exe - registry name: Pofatch

fqqe.exe - registry name: Norton AntiVirus (not sure I believe this!).

Anyone know what these processes are?

John

 

[steamwiz]

fqqe.exe yes I agree, definately not Norton

Which virus was it ?

I can find no reference whatsoever for either file....

The obvious thing to do here is to remove the run keys - then delete the files.

steam

 

[JohnConnolly]

Hi, it was BAT.Boohoo.Worm. I've already cleaned up the registry and deleted the offending files. The first time I tried they reappeared by magic. Then I found mqfncv.exe and usbmn.exe in \WINNT\system32. These are both self-extracting RAR files and contain fqeb.exe, fqqe.exe, efa.exe and mircfix.exe so I got rid of them and cleaned the registry again. No problems since.