Win32/Spy.ProAgent.20 trojan

Does anyone know how to remove the Win32/Spy.ProAgent.20 trojan? I've tried deleting the files associated with it but it keeps coming back. NOD32 can't seem to clear it and I can't find any more information on it.

 

Have you tried booting in "Safe Mode" and running a "Clean" (scan)? Just make sure Nod32 is tweaked to the maximum as per this thread.

Hope tnis helps...

Let us know how you go.

Cheers

 

Looks like its all clear now after scanning in safe mode.

Thanks very much

 

Good
Happy to hear that.

 

Good to see.

My pleasure.

Cheers

 

Looks like its back again today. Must have an exe file somewhere that's making it regenerate. Does anyone know more about this?

 

Where exactly is the file that is infected, can you please post a log file of a scan, it may simply be within system restore.

Cheers

 

With beta 2.50, NOD32 should tell you what application the file was created by.

 

At the moment its coming up with

C:\WINDOWS\qservice.exe - Win32/Spy.ProAgent.20 trojan
C:\WINDOWS\system32\lncom.exe - Win32/Spy.ProAgent.20 trojan

 

qservice.exe is a porn dialer and from the looks of it here, You will need to download and run “Hijack This” found here and post your log at one of the forums found at A-SAP.

The two bigger forums for HijackThis log processing, (meaning they process more log threads each day than most others) are: SpywareInfo.com and CastleCops.com. Be sure to read their posting policy in the links at their log review forum sections prior to posting.

Once your system is clean I would suggest that you take a look here: Why did I get infected in the first place? Also, for further information on security and how to make your system that much stronger, see here, as well there are discussions here and even more here.

Hope this helps...

Let us know how you go.

Cheers

 

I downloaded HiJack This and removed qservice.exe

I've rebooted a few times and done full scans and its all gone now.
Thanks so much for your help Blackspear, I really appreciate it.

 

Good to see Mike, and my pleasure. You might like to take a look through a couple of those links I provided to see if you can add a layer or 2 to you defences so you don't end up in the same boat again.

Cheers