#1
Member
Profile: Join Date: Aug 2008
Location: Cape Town, South Africa
Posts: 6
Computer Experience:
Win32.agent.gvu Backdoor Trojan Infection
[Added after posting: see my next post below this one - I may have successfully removed the trojan with a system restore!]dss .exe:System Drive C: has 1.14 GiB (less than 15%) free. SP2 (WinNT 5.01.2600)dss .exehttp://www.google.co.za/ig?hl=en http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://favorites.live.com/quickadd.aspx http://*.sloth http://picasaweb.google.com/s/v/16.16/uploader2.cab http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1133946516222 http://messenger.msn.com/download/Ms...Downloader.cab http://www.adobe.com/products/acrobat/nos/gp.cab .bat - TextPad.bat - DefaultIcon - %SystemRoot%\System32\shell32.dll,-153 .bat - TextPad.bat - shell\open\command - "%1" %* .bat - TextPad.bat - shell\edit\command - "C:\Program Files\TextPad 5\TextPad.exe" -s .inf - TextPad.inf - DefaultIcon - %SystemRoot%\System32\shell32.dll,-151 .inf - TextPad.inf - shell\open\command - "C:\Program Files\TextPad 5\TextPad.exe" -s .ini - TextPad.ini - DefaultIcon - %SystemRoot%\System32\shell32.dll,-151 .ini - TextPad.ini - shell\open\command - "C:\Program Files\TextPad 5\TextPad.exe" -s .reg - TextPad.reg - DefaultIcon - %SystemRoot%\regedit.exe,1 .reg - TextPad.reg - shell\open\command - regedit.exe "%1" .reg - TextPad.reg - shell\edit\command - "C:\Program Files\TextPad 5\TextPad.exe" -s .txt - TextPad.txt - DefaultIcon - %SystemRoot%\system32\shell32.dll,-152 .txt - TextPad.txt - shell\open\command - "C:\Program Files\TextPad 5\TextPad.exe" -s PCI \VEN_8086&DEV_2782&SUBSYS_01791028&REV_04\3&172E68DD&0&11PCI \VEN_8086&DEV_2782&SUBSYS_01791028&REV_04\3&172E68DD&0&11
Last edited by ramnagel; 7th August 2008 at 12:53 .
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Aug 2008
Location: Cape Town, South Africa
Posts: 6
Computer Experience:
System Restore may have fixed win32.agent.gvu trojan!
Well, I may have removed win32.agent.gvu myself! I performed a successful system restore on the infected XP machine to two days ago (it was infected yesterday afternoon) and the nagging dialog box has not reappeared on reboot.dss .exe after the system restore:System Drive C: has 0.85 GiB (less than 15%) free. SP2 (WinNT 5.01.2600)dss .exehttp://www.google.co.za/ig?hl=en http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://favorites.live.com/quickadd.aspx http://*.sloth http://picasaweb.google.com/s/v/16.16/uploader2.cab http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1133946516222 http://messenger.msn.com/download/Ms...Downloader.cab http://www.adobe.com/products/acrobat/nos/gp.cab
#3
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,633
Computer Experience:
Hi ramnagelKaspersky WebScanner Yes .The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Archives
Click OK
Now under select a target to scan:
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
Save the file to your desktop.
#4
Member
Profile: Join Date: Aug 2008
Location: Cape Town, South Africa
Posts: 6
Computer Experience:
Kaspersky online scanner license has expired!
Sorry for the late reply but I have been away for a few days, Geri.
Quote:
Originally Posted by
Geri
Hi ramnagel
Welcome to Windowsbbs.
Lets get a on-line scan for a second opinion.
Scanning with
Kaspersky WebScanner
You will be promted to install an ActiveX component from Kaspersky, Click
Yes .
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Archives
Click OK
Now under select a target to scan:
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
Save the file to your desktop.
Please post the Kaspersky results.
Thanks
Geri
#5
Member
Profile: Join Date: Aug 2008
Location: Cape Town, South Africa
Posts: 6
Computer Experience:
Ignore previous post...
Whoa! Belay that previous post. I googled the problem and now seem to be having success. Will post the Kaspersky report once I have it, thanks.
Quote:
Originally Posted by
Geri
Hi ramnagel
Welcome to Windowsbbs.
Lets get a on-line scan for a second opinion.
Scanning with
Kaspersky WebScanner
You will be promted to install an ActiveX component from Kaspersky, Click
Yes .
.
.
.
Please post the Kaspersky results.
Thanks
Geri
#6
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,633
Computer Experience:
Hi ramnagelKaspersky WebScanner Click on “Accept” If your pop –up blocker blocks any windows from opening. Click Run on the window that opens .Windows Vista users you must open the web browser using the Run as Administrator command.The program will launch and then begin downloading the latest definition files:
Under Scan on the left side.Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected. Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file . Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
#7
Member
Profile: Join Date: Aug 2008
Location: Cape Town, South Africa
Posts: 6
Computer Experience:
Kaspersky results
I ran Kaspersky over the weekend and here are the results. Looks like all
Quote:
Originally Posted by
Geri
Hi ramnagel
Kaspersky has changed their on-line scan. So if the one you tried doesn't work then try this one.
Please do an online scan with
Kaspersky WebScanner Click on “Accept” If your pop –up blocker blocks any windows from opening.
Click Run on the window that opens .
Windows Vista users you must open the web browser using the Run as Administrator command.The program will launch and then begin downloading the latest definition files:
Under Scan on the left side.Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected. Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file . Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
Please post the Kaspersky results.
Thanks
Geri
#8
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,633
Computer Experience:
Hi ramnagelhttp://ca.com/us/securityadvisor/vir....aspx?ID=52797
All times are GMT +1. The time now is 07:02 .
It goes, "Kaspersky online scanner license has expired!" I cannot continue from then on. The message appears in a pop-up dialog whose title is "Windows Internet Explorer".
Kaspersky results
