Help! Win32/Agent.SDG.Gen trojan

Hello,

You may want to first try creating an ESET SysRescue disc and using that to boot from to check the system before trying to format the system.

Regards,

Aryeh Goretsky

 

NOD32 is such a piece of sht. The only time I actually need it to do something, it gives an error trying to remove this type of trojon..

MBR sector of the 6. physical disc... when I press clean, it gives an error. Obviously sending a log/report doesn't help, otherwise there should have been a virus definition pack to prevent this by now.

I honestly think NOD32 is only good for basic viruses at least a year old.

 

I'd suggest submitting a Support Request for help in removing this threat:

go.eset.com/us/support/contact&ref=wsf

 

This is because the MBR needs to be replaced with the original one. The only way how to accomplish this is by running fixmbr from within Windows Recovery Console as per the instructions here. Note that in this case you'll need to run the command with the appropriate device name as explained in the article. Before you do that, we strongly recommend backing up all crucial data just in case something goes wrong.

 

I never did understand why NOD32 is rated so high in antiviruses. It is total garbage. For anyone that has this issue, all they need to do is download TDSSKiller and run it. It fix the problem instantly. End of story. The only time you would ever have a problem is if you have a non-standard boot loader.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

I had no success with anything that ESET NOD32 had to offer. I tried listening to the lame advertisements from Malwarebytes by installing it; which of course was no beter than NOD32.

The advice to use TDSSKiller.exe is unfortunately mixed in with a bunch of BS advice. Hopefully someone else with this virus will see my post and save themselves a bunch of time.

 

It is not that easy as it seems. For legal reasons, companies are not entitled to carry the standard OS boot sectors for the purpose of replacing them when they get rewritten by malware. We are currently investigating if there are some other ways to get around this legally.