QTrax being detected in my disc drive

[Juliet]

We can delete that folder but whatever music might be inside will probably be gone afterwards.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
F:\Music\Qtrax Media Library
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

[montypy88]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Sarah at 2015-04-03 18:05:31 Run:3
Running from C:\Users\Sarah\Desktop
Loaded Profiles: Sarah (Available profiles: Sarah)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
F:\Music\Qtrax Media Library
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
"F:\Music\Qtrax Media Library" => File/Directory not found.
EmptyTemp: => Removed 285 MB temporary data.


The system needed a reboot.

==== End of Fixlog 18:05:57 ====

[Juliet]

See if you can manually find this
F:\Music\ <--
then locate and delete

Qtrax Media Library <--folder

[montypy88]

Nope, I tried that before posting. I tried going to Computer and double-clicking on the empy F:\ drive, and since there was no disc I couldn't open it. I tried searching for F:\Music\ in the computer screen and in the Search bar when you click on the Windows icon.

I tried putting a CD in the disc drive and rescanning my system to see if that gave Spybot something to scan in that drive. Maybe a disc I had in there before triggered the malware warning because IT had Qtrax, but nothing subsequent has?

It worked! I did a scan with a CD in my disc drive and Spybot is no longer detecting Qtrax in my disc drive. My guess would be that it was associated with a file I used to make a mix CD, but since I haven't put a CD in there since then, it couldn't clean it. Thank you for your help! Now how do I get rid of all of this stuff? :P

[Juliet]

It worked! I did a scan with a CD in my disc drive and Spybot is no longer detecting Qtrax in my disc drive. My guess would be that it was associated with a file I used to make a mix CD, but since I haven't put a CD in there since then, it couldn't clean it. Thank you for your help! Now how do I get rid of all of this stuff? :P

Thank you for taking that extra step because I was stumped how to find it since it wasn't related to the operating system files, program, or data files.

Stuff, what stuff?

lol

we will now.

DelFix

• Please download DelFix
  or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  
  
• Click the Run button.

-- This will remove the specialized tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

~~~~~~~~~~~~~~~~

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malwareby quietman7, MVP
  

The following programmes come highly recommended in the security community.

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
• Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• Secuina PSI will scan your computer for vulnerable softwarethat is outdated, and automatically find the latest update for you.
• SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

Want to help others? Join the ClassRoom and learn how.

[montypy88]

Here's the log from DelFix.txt -

# DelFix v10.9 - Logfile created 04/04/2015 at 13:55:57
# Updated 27/02/2015 by Xplode
# Username : Sarah - STELLA
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\Sarah\Desktop\Addition.txt
Deleted : C:\Users\Sarah\Desktop\adwcleaner_4.200.exe
Deleted : C:\Users\Sarah\Desktop\aswMBR.exe
Deleted : C:\Users\Sarah\Desktop\esetsmartinstaller_enu.exe
Deleted : C:\Users\Sarah\Desktop\Fixlog.txt
Deleted : C:\Users\Sarah\Desktop\FRST.txt
Deleted : C:\Users\Sarah\Desktop\FRST64.exe
Deleted : C:\Users\Sarah\Desktop\JRT.exe
Deleted : C:\Users\Sarah\Desktop\JRT.txt
Deleted : C:\Users\Sarah\Desktop\Search.txt
Deleted : C:\Users\Sarah\Desktop\SystemLook.exe
Deleted : C:\Users\Sarah\Desktop\SystemLook.txt
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup ... OK

########## - EOF - ##########

[montypy88]

I am already running AdBlock and have the free version of MalwareBytes, and I'm running MSE as my anti-virus. I also have the Ghostery extension for Chrome and CCleaner. Would you recommend that I keep all of the programs above? Do you think I should download CryptoPrevent, MBAE, Secuina PSI, SpywareBlaster, and WOT? Would you recommend running a different antivirus? I'm positive that the Qtrax came from downloading a song for mix CD for my car, and I typically browse the internet cautiously to prevent this type of thing from occurring, just wondering if you had any tips as I like to learn.

Thank you again for all of your help! I learned a lot of troubleshooting techniques.

[Juliet]

I am already running AdBlock and have the free version of MalwareBytes, and I'm running MSE as my anti-virus. I also have the Ghostery extension for Chrome and CCleaner. Would you recommend that I keep all of the programs above? Do you think I should download CryptoPrevent, MBAE, Secuina PSI, SpywareBlaster, and WOT? Would you recommend running a different antivirus? I'm positive that the Qtrax came from downloading a song for mix CD for my car, and I typically browse the internet cautiously to prevent this type of thing from occurring, just wondering if you had any tips as I like to learn.

Thank you again for all of your help! I learned a lot of troubleshooting techniques.

Sounds like your going good at layered protection now. Keep what you already have installed.
I've seen a few complain about CryptoPrevent but, to that it seems to slow a system down but you got to think about the protection it adds to your computer.
MBAE, Secuina PSI, and WOT <-- yes
SpywareBlaster,<-- do you have any other malicious web site protection on the machine?
NoScript <-- good to have if you run any Java applications or if you visit any sites where java script is used.

[montypy88]

All righty, thanks. In case you need to hear it from me, I consider myself helped! Thank you again!

[Juliet]

Glad we could help.

Since this issue appears resolved ... this Topic is closed.