Over from SWI

Nod is giving me a Win32/Agent.AC trojan found on C:\windows\System32\ctlgm.dll

is this a false positive or what ?

 

Oops, forgot to cross link.

http://www.spywareinfoforum.com/index.php?showtopic=4251&st=0&#entry17904

 

Thank you, I have already seen that, but can't seem to clean it.

Any suggestions ?

 

if you want to go IRC, I'm on irc.dixiesys.net 6667 #privacy.

 

FYI

I am used to "Cleaning" Machines, and have done most of this machine already.

there is much more info in the link I posted, not just Hijack logs, but a written history of the problem.

So system restore is already turned off for example.

tyvm again...

Paul.

 

Are you able to scan that drive by "Slaving" it off a clean virus free PC?

This solution works really well.

Hope this helps...

Cheers

 

LOL, well not really, my partner has just gone off to work so she can do a little overtime, it's 6.15am here in the land of Oz, so I'm going to head back to bed for another couple of hours

Cheers

 

In addition to my above suggestion that we use, yesterday we tried for the first time a Barts PE boot CD with Nod installed, it worked like a charm

More on Barts PE in this thread:

https://www.wilderssecurity.com/showthread.php?t=33765

Hope this helps...

Let us know how you go.

Cheers

 

Ok, here goes a few replies in one.

1. Can't "slave" the drive off, in a laptop.

2. I have a bootable Bart's PE disk aleady (Great Tool !) but don't know how to use plugins, read your links, however a little detailed instruction on using a plugin would be both gratefully accepted and a great time saver...

3. I don't know if it is clear, but the nod scan under safe mode returns the system all clean, rather than not being able to remove the file.
The file is created during normal boot up.
What is doing this I don't know, but IT is not being detected by anything !

bed time now...

cya in a 4 hours or so.

thnx for all the help btw peoples

 

If this is the one which Kaspersky detects as Backdoor.Agent.ac, then please try this free removal tool

 

Since the trojan changes rights of its files, you may not see it on the disk with NTFS file system and also hides itself from the list of running processes. Please drop an email to support@nod32.com for removal instructions.

 

Oh, forgot to post, have emailed as suggested.

 

Have the same problem as Paul on win32/agent.ac trojan. Need help!

Thanks

Clete

 

yeah that is what i always do, put the hard drive in a designated virus scanner PC, Scan it with /AH and clean it that way.

But because i clean on average a couple of PC's with viruses every day, i don't have days to figure out ways to clean, so if i can't clean i often delete, if it is part of a system file or something i will repair/replace the windows system files. or whatever other program the virus attached to, it is quicker and works fine in the end.

 

I tried Marco's solution, but did not find the "="path_to-Trojan" language, so I re-exported the windows registery file as detailed in step 6. and rebooted. No improvement.

I also downloaded a demo copy of pccillian to check to see if it found the trojan too and sure enough, I got a message telling me that I have a trojan AC in "system32kdbpfng.dll".

I am open for any ideas out there - right now I either have the trojan and need help getting rid of it, or I am getting false positives in NOD32, which are also very frustrating.

This has been going on now for about a week, so I am looking for a genius to help solve this! I am happy to delete files as long as I have clear directions for how to rebuild them. If I knew how to rebuild the operating system, I might be inclinded to wipe everything out and start over. My knowledge is somewhat limited, so I am reluctant to take any major steps if I don't have to. Are there any other products that can help me solve this?

I appreciate any help that I can get. This one is a real mystery!

Clete

 

Hi Clete,
I suggest you drop an email to support@nod32.com along with the registry file exported as well as information about the operating and file system you use (FAT32 or NTFS).

 

I just came across the same infection. Nod32 detected the virus but couldn't do anything about it. I spent some time on this.

The file infected on the machine I was working on was kbdnn.dll. I searched the registry and found a key that was used in invoking it.

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
WINDOWS NT\WINDOWS\AppInit_DLL

I couldn't delete the key without it generating back so I had to rename the windows folder to windows2. I then deleted the key and renamed the folder back to windows. The key no longer came back.

Now the file was still there and was unable to be deleted. The file permissions were messed up. I had to take ownership of the file, add myself to the permission list & give myself full control. I then removed the readonly attribute and deleted the file. Upon reboot. The virus seemed to be history.

Please note:
1) You must turn off the system restore feature otherwise your work will
have been in vain.

2) You can recreate the registry key after your done, but I didn't find anything on the internet that suggested that it was useful, in fact it seemed to be a key that virus's like to piggy back to.

Hope this helps...