Trojan Horse Downloader Agent ATJC

aliEnRIK

The operating system can sometimes get firewalls wrong. Just goto the symbol bottom right and see if its running (It will tell you if its not)

As for the other problem, id follow browntoas advice (And maybe consider ahcanging AVG to either AVIRA or AVAST)

Fire_Fox

I have tried to follow the instructions on the Bleeping Computer link this morning, and made a right pig's ear of it! I really think we are now beyond the realms of my limited capabilities with computers.

The instructions advise shutting down all open windows before installing and to disable all virus checkers/ firewalls. They also say that the programme will need to connect to the internet, and not to touch the computer once the programme has started.

So I downloaded Combofix and shut down the instructions window, but left my mobile (dongle) net connection running. Then struggled to properly disable AVG - disabled the resident shield, not sure if this is just one part or the entire programme??

Disabled the new firewall fine but was pretty nervy cos I still had an open net connection. Then tried to install the Combofix, but immediately got a warning that the virus checker that came with the new firewall (??fire something) had found a Trojan trying to access the computer. :eek: Did not even know I had two virus checkers running, that's how little I understand!

Also at this point the computer popped up windows asking if I wanted to close the open net connection (?no cos Combofix needs to access the net) and another saying I needed to restart my computer. If I do that I won't have an open net connection for Combofix to use! This was not at all the same as the instructions so I am blatently doing it completely wrong.

Have left the computer switched off with no virus checker and no firewall - posting this message from college!

Browntoa

combofix may cause antivirus to flash up a warning so ignore that

the one about closing the internet connection is part of combofix so allow that

combofix may restart the PC at the end to finish the clean

Fire_Fox

Isn't the antivirus supposed to be switched off whilst using Combofix? Am I supposed to have both AVG and Threatfire running on an everyday basis?

The restart message was before Combofix had even installed. It says "some files could not be created. Please close all applications, reboot windows and restart this application."

Combofix is presently in my downloads folder but I always get the above message if I double click on it to install. Do I right click and run as administrator? Is the net connection supposed to be up whilst I disable the firewall and the virus protection? How do I disable AVG - is the resident shield all of it?

Fire_Fox

I have just tried again twice (with the internet connection up, and with it down), and am getting the same message even if I try to run the programme as administrator. When I reboot as instructed, the PC Tools Firewall and Threatfire appear to switch themselves back on (get a really odd message which appears to contradict itself), and Combofix does not magically start doing anything. Basically I am starting from scratch. :mad:

Just discovered that the Windows Firewall has switched itself back on (perhaps because I switched off the PC Tools one?), so now I seem to have two firewalls and two virus protection programmes running! And I don't really have a clue how to manage any of them.

Reluctant_spender

what symptoms are you currently having?

Fire_Fox

Reluctant_spender wrote: »

what symptoms are you currently having?

The original trojan (Downloader Agent ATJC) was found during a routine AVG scan. However for a week previously AVG had not been updating properly. Then I was advised on here to run Malwarebytes which found another trojan (Vundo). Since these two have been eliminated the internet (dial up) seems to be loading quicker and has not gone unresponsive. Then I have downloaded PC Tools firewall, which appears to have come with Threatfire virus protection, again on the advice of this board.

Since then AVG has had one failed scan and one successful one, both the firewalls seem to switch themselves on and off at random, and I am unable to get Combofix to install and run at all. However, I rather think this is more to do with my complete inability to manage all of the programmes than symptomatic of a hidden infection.

From the little I know, I don't think you are supposed to have two virus checkers and two firewalls enabled simultaneously. But I don't actually know how to switch any of them off permanently! Today the PC Tools firewall hasn't given me a single message asking me to OK some process or another. Yesterday it was doing so constantly, but few of the messages made any sense to me so I had no idea what I was agreeing to.

I don't know if that really answered your question, cos I am not sure what are symptoms and what is a bad workman trying to blame his tools! Thanks for your interest.

Browntoa

I think you would be better uninstalling ALL antivirus software from the Pc , then attempting to run Combofix again

also remove any other firewalls apart from the XP built in one

we can replace them once things are clean

Reluctant_spender

I'll go with that - do you have access to another computer?

Fire_Fox

New firewall and all virus protection duly uninstalled and Combofix worked fine. Temporarily enabled the Windows firewall again to come online and type this, but won't do anything else on the net til I have virus protection again.

I will be in work tomorrow so will be online then, and will try to remember to take my laptop in too so can read and action any replies to this thread. Thanks again guys! :T

Log of Combofix in next post.