http://www.howtogeek.com/forum/ How-To Geek Forums Topic: (Solved) - TROJAN.AGENT VIRUS (how to remove) en Fri, 09 Jan 2009 00:51:45 +0000 http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34788 Tue, 15 Jul 2008 00:19:01 +0000 FMZ 34788@http://www.howtogeek.com/forum/ <p>ScottW, txs for the brief explanation, all looks to be in order no funny/strange .dll's there. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34753 Mon, 14 Jul 2008 18:04:53 +0000 ScottW 34753@http://www.howtogeek.com/forum/ <p>FMZ, autoruns may look a little chaotic at first. Go to the Logon tab and here you will see all of the programs that are set to launch at startup time. They are presented as registry keys, with the programs underneath. Userinit and Shell (explorer.exe) are part of the OS and should not be altered. The keys that end CurrentVersion\Run RunOnce and Programs\Startup are where you will find the startup programs. If you see any leftovers from the infection, such as &lt;jumbled letters&gt;.dll, delete those.</p> <p>As for the rest, you should look them over and be sure that you know what they all are and what they do. If there is something there you don't recognize, google it up and find out what it is. For things that you do recognize, you can decide if you want them to run or not. To try running without these extras, just uncheck them. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34740 Mon, 14 Jul 2008 13:20:59 +0000 Lighthouse 34740@http://www.howtogeek.com/forum/ <p>Thanks ever so much for that FMZ :) </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34738 Mon, 14 Jul 2008 13:12:53 +0000 FMZ 34738@http://www.howtogeek.com/forum/ <p>First I ran SmitFraudFix (for trojan.agent), this removed a good part of the problem, after that I ran FixIEDef.exe by ShadowPuterDude(for IEDefender), this website was suggested by ScottW (<a href='http://www.lavasoftsupport.com.....#38;start='>http://www.lavasoftsupport.com.....#38;start=</a> ) and thats it. A note, all the time I had windows restore shut down. And scanning with PC Tools Spyware Doctor and Norton. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34735 Mon, 14 Jul 2008 12:46:08 +0000 Lighthouse 34735@http://www.howtogeek.com/forum/ <p>Glad about that FMZ. But how did you fix it? </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34734 Mon, 14 Jul 2008 12:44:46 +0000 FMZ 34734@http://www.howtogeek.com/forum/ <p>Txs team, the system is running smooth as ever! One other question, I downloaded Autoruns as ScottW suggested, what do I do next with this program? </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34714 Mon, 14 Jul 2008 08:53:33 +0000 Lighthouse 34714@http://www.howtogeek.com/forum/ <p>Definitely try Superantispyware<br /> <a href='http://filehippo.com/download_superantispyware/'>http://filehippo.com/download_superantispyware/</a><br /> Remember to get the very latest updates after you install it </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34702 Mon, 14 Jul 2008 05:37:28 +0000 ScottW 34702@http://www.howtogeek.com/forum/ <p>FMZ, I'm glad your pop-ups are gone. I would not be satisfied with just unchecking those startup items in msconfig. They need to be completely removed. Use Windows Defender or Autoruns and delete those bogus entries with extreme prejudice! If you need help with that, just ask.</p> <p>Once that's done, then you can consider this incident to be done with. However, it never hurts to get a 2nd, 3rd or 4th opinion. There are lots of free online scanners and they might find leftovers from this infection or another one lying in wait. Finally, see this wiki article for general tips on preventing another infection from even getting on your system:<br /> <a href='http://www.howtogeek.com/wiki/Prevent_Infection_from_Viruses_and_Spyware'>http://www.howtogeek.com/wiki/Prevent_Infection_from_Viruses_and_Spyware</a> </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34697 Mon, 14 Jul 2008 05:09:41 +0000 FMZ 34697@http://www.howtogeek.com/forum/ <p>ScottW,</p> <p>After de-selecting them the pop-ups went away. I ran a full SW Doctor scan and Norton, nothing was found. Is it right to conclude that it is "all set now"? </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34694 Mon, 14 Jul 2008 04:44:55 +0000 ScottW 34694@http://www.howtogeek.com/forum/ <p>Aha! Made up jumbled letter filenames are certainly malware related. This still could be a Vundo variant -- see this article at bleepingcomputer.com:<br /> <a href='http://www.bleepingcomputer.com/forums/topic18610.html'>http://www.bleepingcomputer.com/forums/topic18610.html</a></p> <p>If those RunDLL errors are coming from Windows, you could use Windows Defender or <a href="http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx">autoruns</a> to remove them from the startup list. Reboot and see that they don't come back. Even if this works, you should continue to test with other free scanners and/or post a HJT log. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34693 Mon, 14 Jul 2008 04:41:56 +0000 FMZ 34693@http://www.howtogeek.com/forum/ <p>Cool, txs k9, all 4 that where popping up where listed, I unchecked them. do I need to delete them from there or something?</p> <p>Again, your help is appreciated! </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34691 Mon, 14 Jul 2008 04:33:23 +0000 k9 34691@http://www.howtogeek.com/forum/ <p>Go to msconfig and check your startup items. Probably the trojan had modified the registry to run the dlls you have mentioned on startup. Just uncheck the boxes corresponding to these dlls. Since you got rid of the trojan and the associated dlls, RunDLL is unable to locate these dlls and execute them.</p> <p>You can also use a program called Autoruns to help you deal with it. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34688 Mon, 14 Jul 2008 04:16:44 +0000 FMZ 34688@http://www.howtogeek.com/forum/ <p>All right, I got rid of the Trojan.Agent....bt now I have 4 screens popping up with a message saying:</p> <p>RunDLL<br /> Error loading C:Users\FERRY\AppData\Local\Temp\yayaaXoO.dll<br /> and: nnnmmmMD.dll<br /> and: mrwgsjio.dll</p> <p>all seems to be working well but these screens pop-up after start up. any idea how to fix or remove? </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34686 Mon, 14 Jul 2008 03:20:12 +0000 ScottW 34686@http://www.howtogeek.com/forum/ <p>FMZ, if you can't get or generate a text mode log of the infection report, just look for the name, or variant, of the virus. But, don't worry too much about this virus report -- I'm pretty sure it's a false lead.</p> <p>I googled up that registry key and got lots of hits for Virtumonde, Vundo, or Vundomonde. It may be one of these, but do try another scanner as PalmTrees suggested. If a scanner can't get it, we may need to see the HJT log, as k9 suggests. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34683 Mon, 14 Jul 2008 02:59:50 +0000 FMZ 34683@http://www.howtogeek.com/forum/ <p>Scott,</p> <p>I got a report from SP Doctor, and you are right it is some kind of infection. how do I post the report for your review? </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34679 Mon, 14 Jul 2008 02:46:00 +0000 ScottW 34679@http://www.howtogeek.com/forum/ <p>Did you get this report from Spyware Doctor? Trojan.agent is too vague. There should be a .&lt;variant name&gt; at the end of that. Also, Spyware Doctor is for Spyware, not viruses unless you have the AV version.</p> <p>You probably do have an infection. Some of these spyware scams will create a false positive virus in order to try to get you to pay for a removal product. Here is an example of how such programs work from the support forums at Lavasoft, makers of Ad-Aware:<br /> <a href='http://www.lavasoftsupport.com/index.php?showtopic=13521&#38;pid=74655&#38;mode=threaded&#38;start='>http://www.lavasoftsupport.com/index.php?showtopic=13521&#38;pid=74655&#38;mode=threaded&#38;start=</a> </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34675 Mon, 14 Jul 2008 01:58:53 +0000 k9 34675@http://www.howtogeek.com/forum/ <p>Scan your computer with HiJackThis and paste the log file here. </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34670 Mon, 14 Jul 2008 00:58:46 +0000 PalmTrees 34670@http://www.howtogeek.com/forum/ <p>Try this out. <a href='http://www.superantispyware.com/superantispywarefreevspro.html'>http://www.superantispyware.com/superantispywarefreevspro.html</a> </p> http://www.howtogeek.com/forum/topic/trojanagent-virus-how-to-remove-1#post-34669 Mon, 14 Jul 2008 00:49:38 +0000 FMZ 34669@http://www.howtogeek.com/forum/ <p>Ran Spyware Doctor, detected Trojan.agent virus in HKEY_USERS\S-1-5-21-93465498-330590618-1224202275-1000\Software\Microsoft\rdfa</p> <p>Windows Vista Home Premium</p> <p>Window Restore is disabled</p> <p>Removed and quarantined, deleted.</p> <p>Restarted ran Spyware Doctor again and th Trojan re-appeared, this happens every time i restart.</p> <p>I ran Norton, which does not detect anything.</p> <p>But there is definitely something on the system, especially with IE 7</p> <p>I need advise how to get rid of this.</p> <p>Thanks in advance </p>