Please help, virus advice needed

lauhol1980

Hi

I hope you can help. I have just downloaded Avira Antivir and have run my first scan and its has come uo with 2 detections. I have put them into quarantine but not really sure what to do now?!:rolleyes:

The first one says the filename is c:\WINDOWS\system32~.exe and the detection 'Is the TR/Agent.aagk Trojan'

The second says the filename is c:\WINDOWS\system32\btwebcontrol.dll and the detection is 'contains recognition pattern of the DIAL/169704.A dial

Should I delete these? The second one that contains the words btwebcontrol would that be anything to do with the fact my ISP is BT Broadband? Don't want to delete it if its something important!!!

TIA:A

MothballsWallet

Have you updated Avira so it's using the most recent definitions?

If Avira's found a problem with them, the second one sounds like it's a dialer that taps into your computer's dial-up internet access: if you've got broadband, then you should be able to delete the btwebcontrol.dll one without any problems.

I'd run a full scan on the system as well, and delete the first file for definite: there is a C:\WINDOWS\SYSTEM32 directory on my system, but no system32~.exe file that I can see (and I'm using XP).

lauhol1980

I downloaded Avira only this morning.
I'm using Windows XP also.

So you think I'm safe deleting both these files?

Thanks for responding

aliEnRIK

lauhol1980 wrote: »

I downloaded Avira only this morning.
I'm using Windows XP also.

So you think I'm safe deleting both these files?

Thanks for responding

For now just QUARANTINE them
This means they are locked up and can do no harm but are still on your computer should you need them for some reason

MothballsWallet

lauhol1980: aliEnRIK's right - leave them quarantined for now as your system's safe. Make sure Avira's kept up-to-date and run regular scans, just to be safe.

If you do need them, see if Avira can cure the files to remove the threats, or try and find a safe version of the btwebcontrol.dll file on an install CD (if you got one from BT).

Browntoa

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Acan" option is selected.
  • Then click on the Scan button.
• The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

lauhol1980

Malwarebytes' Anti-Malware 1.25
Database version: 1088
Windows 5.1.2600 Service Pack 2
21:19:52 26/08/2008
mbam-log-08-26-2008 (21-19-52).txt
Scan type: Quick Scan
Objects scanned: 44843
Time elapsed: 5 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 10
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\__c00900B.dat (Trojan.Agent) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00900b (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fd4fc0.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00900B.dat (Trojan.Vundo) -> Delete on reboot.

lauhol1980

As a matter of interest, I did a scan using the Malwarebytes Anti-Malware as suggested by Browntoa (see results above) computer seems to be running quicker many thanks, how often should I do this scan to keep on top of things?

Thanks

Browntoa

update it every couple of weeks and scan to keep on top of things

assuming it rebooted when you finished , do a FULL scan when you get time

make sure you have antivirus software (and keep it updated)

Browntoa

you also need to go to www.windowsupdates.com and download all the updates for your PC, you are running SP2 , and its now up to Service Pack 3 (SP3)

run it a couple of times to make sure all the updates get applied as this will shut any security problems down and help stop infections in the first place

lauhol1980

It did reboot when it finished, so will do a full scan tomorrow. I have just installed Avira so will check the malware and anti virus sotware for updates regularly. Want to keep on top of it!!

Many Thanks for your help and advice.