Horse of troie Win32:Agent-LTS [Trj]

Viruses and worms
1

Bonjour, Hello

My english is very bad, and my problem too

I need you, i have a horse troie

Win32:Agent-LTS [trj]
Cheval de Troie
000777-0, 26/09/2007

Thank you for your aide

I’m very very desolé, for my english write.

Alex

2

What is the specific problem, yes avast detected it and you want to know what to do or something else ?

You could try an on-line translation service (free) if it is easier to write in French and convert to English, not ideal but probably OK.

http://babelfish.altavista.com/
Vous pourriez essayer un service de traduction en ligne (libre) s’il est plus facile d’écrire en français et convertit en anglais, non idéal mais probablement CORRECT.

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections.

What action did you take when avast detected the Trojan ?

3

I, too, am having a problem with this trojan. I’ve tried a lot of things to remove it, including online scans like BitDefender, and while all of these programs identify the issue, none will remove it; they only remove some of the associated files, not the root of the problem itself. Avast! notifies me and asks me what to do, but the thing keeps regenerating because it’s not all being deleted. In addition to trying to get rid of it manually I’ve also tried Rootkit cleaners and CCleaner, among other programs, with no results. I have disabled my restore point and will try once more tonight to get rid of the pesky thing, but I am rapidly coming to my wit’s end (been fiddling with this for the last 10 hours). If I don’t get this cleaned out tomorrow morning I will post an HJT file. Path is:

c:\documents and settings\compaq_owner\local settings\temp\ac8zt2\msmdev.dll

PS - Using Windows XP, btw.

4

Can I suggest that you post this in a new topic rather than hijack this one, that way we can deal with your problem directly and avoid the possible problem of confusion if the original poster comes back with more information.

Also see …sunbelt-software…threatdisplay.aspx?name=Trojan.NewMediaCodec&threatid=149335

5

Hi alexfrench,

Here is a general suggestion of removal for this malware given:
http://forums.thatcomputerguy.us/index.php?showtopic=21702
Use an online translator to read the cleansing instructions in french.
Vundo.fix: http://www.atribune.org/ccount/click.php?id=4
///////////////////////////////////////////////////////////////////
Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

* Double-clique VundoFix.exe afin de le lancer.
* Clique sur le bouton Scan for Vundo.
* Lorsque le scan est complété, clique sur le bouton Remove Vundo.
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK
* Démarre ton PC à nouveau.
* Poste le rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta                  prochaine réponse. D'avance merci.

Note: Il est possible que VundoFix soit confronté à un fichier qu’il ne peut supprimer. Si tel est le cas, l’outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de “clique sur le bouton Scan for Vundo”
////////////////////////////////////////////////////////////

polonus