Upon starting one of our computers this morning, Avast detected that a malware dropper, Win32:Agent-MJG, had infected a few of our startup programs. While running a boot-time scan, it found more similarly infected files throughout the drive, including several in the Windows/ and System Volume Information/ directories.
I moved all 29 infected files to the chest as suggested. Everything now appears to be working fine, and a subsequent scan revealed no more infected files. Hurray!
So, I guess my question is: now what?
Sorry for the ignorance, but where do I go from here? As long as everything continues to function properly, should I just assume that the issue has been resolved? Are there any further steps I should take?
Any suggestions or feedback is appreciated. Thanks!
Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on.
Use AVG Antispyware; SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Excellent. Thanks for your help. Everything seems to be in order.
I’ve included the HijackThis log below.
Thanks again!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:13:46 PM, on 11/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Your JAVA is way out of date and could be exploited.
Ensure you have the latest version of JRE (JAVA Runtime Environment) because older versions can be vulnerable to malware. First remove All Older Versions From Add/Remove Programs.
You don’t appear to have an active firewall, what is your firewall ?
FIX in HJT
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
Suspect/Unknown (do you know it ?):
C:\blwin32\blw110.exe
Upload the file to VirusTotal - Multi engine on-line virus scanner and report the findings here. If multiple detections on VT send the sample to virus@avast.com zipped and password protected with the password in email body and undetected malware in the subject.
A google search on the above file name returns zero hits
OK, run hijackthis again, just the scan element not creation of log, once this is done close any open windows other than HJT.
Look for the entries I said to fix and tick the box to the left of the entry.
Now click the Fix Selected button at the bottom of the window.
That should make a back-up of the changes made and remove these entries from the registry.
I see what he is getting at as they appear to be associated with a trojan, Downloader.Agent.awf, probably something already dealt with by avast. So if ‘you’ didn’t add these to your trusted zone, which I doubt, add these entries to the ones you fix.
Dell puts a definite Adware, and possibly spyware program on their
computers called "My Way" ; there is Info in the Dell Support Forums
about removing this at :
http://www.dellcommunity.com/supportforums/board/message?board.id=si_virus&message.id=42328 .
I recommend you do so .
P.S. And you should seriously consider "replacing" the increasingly vulnerable
Adobe Reader with the slimmer Foxit Reader; I did so some months ago .
Hi “Travel” :