Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

AVG 2011 Free detecting Trojan horse Agent_r.XJ but doesn't remove


  • Please log in to reply
1 reply to this topic

#1 germ1578

germ1578

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:47 PM

Posted 29 November 2010 - 12:45 AM

hp mini 311 running windows xp home 2002. AVG free v2011 scan shows 4 pairs of
Trojan horse Agent_r.XJ infections at files:

c:\windows\system32\wuauclt.exe (2444):\memory_001b0000
c:\windows\system32\wuauclt.exe (2444)
c:\windows\system32\svchost.exe (5428):\memory_001a0000
c:\windows\system32\svchost.exe (5428)
c:\windows\system32\csrss.exe (968):\memory_00270000
c:\windows\system32\csrss.exe (968)
c:\windows\explorer.exe (1376):\memory_001a0000
c:\windows\explorer.exe (1376)

The 4 with "memory" reference ae commented on as "Obect is inaccessible."
AVG indicates it removes/heals 4, but 4 are not removed or healed. I reboot
and run the AVG scan again and all 4 pairs are detected again. I've run mbam
and sas and they do not detect these trojans. The machine also exhibits odd
behavior. After booting up WZC is turned off and I am unable to View
Available Wireless Networks. I can restart it from services but it will
eventually get turned of again. I also intermittently lose internet access
and Windows Security Center indicates "Windows Firewall settings cannot be
displayed because the associated service is not running. Do you want to
start Windows Firewall Service Y/N?" If you choose yes windows will try to
start the service but then indicates it cannot. I've found that I can open
a cmd window and enter: netsh winsock reset. This gets my internet access
back and Windows Firewall settings can again be displayed.

BC AdBot (Login to Remove)

 


#2 David NY 19

David NY 19

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:47 PM

Posted 30 December 2010 - 01:20 PM

I got the same virus on 12-28-10. I found this free solution:

http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Fixed the following files that had virus:

C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users