Win32: Agent-SG[Trj}

[system]

@polonus post:8

Hi crofty59,

Go here and get this adware from your comp: http://www.spywareguide.com/product_show.php?id=30

polonus

Hi polonus i have bookedmarked the web site will check it out .

Cheers crofty59

@Tech post:9

No. The prefetched version is not good.
Where is your avast installed? There should be the ashquick.exe file.
I’ve posted the default folder, where did you install avast?
You have to use two pairs of quotes, like I’ve posted before.

Hi tech
I installed in the default folder. I can find a icon in Avast folder for ashQuick but not ashQuick exe.

I ended up getting it to work, i put in what David had posted. i was putting in the wrong path.

@DavidR post:10

@crofty59
The prefetch is only designed to speed up the loading of files it gives HDD cluster information, etc., it isn’t the original file.

Try this path in the run command, Techs is likely to be incorrect for your setup:
“C:\Program Files\Alwil Software\Avast4\ashQuick.exe” “*MEMORY”, this works on mine

Try this path in the run command, Techs is likely to be incorrect for your setup:
“C:\Program Files\Alwil Software\Avast4\ashQuick.exe” “*MEMORY”, this works on mine

Hi DavidR
Your path you posted worked like a charm. Thanks

Cheers crofty59

@igor post:4

I’m slightly curious, however, how did the Agent-SG signature get there. It is actually possible that it’s a false alarm, but it looks like belonging to a dialer.
Try to run ashQuick.exe “*MEMORY” to see if anything is detected in memory.

Hi igor
Run the scan and this is what i got
File name Process 876, memory block 0x01880000, block size 1814528
Malware name Win32:Agent-SG [Trj]
Malware Type Trogen Horse
VPS version 0642-2 07/11/06

File name Process 876, memory block 0x02B10000 block size 1814528
Malware name Win32:Agent-SG [Trj]
Malware Type Trogen Horse
VPS version 0642-2 07/11/06

I tried posting screen shots but didn’t work
Hopes this help

Cheers crofty59