Jump to content

svchost.exe infected with Trojan.Agent

madhukirant
 Share

Recommended Posts

madhukirant

madhukirant

Posted
Posted

Hi,

I have been running Malwarebytes and the log shows that the svchost.exe is infected with Trojen.Agent. I have gone through other threads on the same topic, installed Rogue Killer and I am pasting the log below.

-------------------------------------------------------------------------

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Administrator [Admin rights]

Mode : Scan -- Date : 11/09/2012 06:11:42

¤¤¤ Bad processes : 1 ¤¤¤

[RESIDUE] vsnpstd3.exe -- C:\Windows\vsnpstd3.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 16 ¤¤¤

[RUN][sUSP PATH] HKLM\[...]\Run : snpstd3 (C:\Windows\vsnpstd3.exe) -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500UA.job : C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500Core.job : C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-1000UA.job : C:\Users\Vedams\AppData\Local\Google\Update\GoogleUpdate.exe -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-1000Core.job : C:\Users\Vedams\AppData\Local\Google\Update\GoogleUpdate.exe -> FOUND

[TASK][sUSP PATH] FacebookUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500UA.job : C:\Users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe -> FOUND

[TASK][sUSP PATH] FacebookUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500Core.job : C:\Users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe -> FOUND

[TASK][sUSP PATH] FacebookUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500Core : C:\Users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver -> FOUND

[TASK][sUSP PATH] FacebookUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500UA : C:\Users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-1000Core : C:\Users\Vedams\AppData\Local\Google\Update\GoogleUpdate.exe /c -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-1000UA : C:\Users\Vedams\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500Core : C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe /c -> FOUND

[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3121477776-3642710602-820457797-500UA : C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3200BEKT-75PVMT0 +++++

--- User ---

[MBR] 0b8ff671868e2b743912685235496262

[bSP] 27af825d46db21ea131918b06313aed4 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 163855 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 335781888 | Size: 71000 Mo

3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 481189888 | Size: 70288 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_11092012_02d0611.txt >>

RKreport[1]_S_11092012_02d0611.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Before we proceed further, please uninstall or disable uTorrent and any other peer-to-peer filesharing app.

Continued use of filesharing or ill-advised downloads will surely re-infect your system.

Risks of File-Sharing Technology.

P2P file sharing: Know the risks

It's also against the forums policy concerning P2P programs:

http://forums.malwar...showtopic=97700

~~~~~~~~~~~~~~~~~~~~~~~~

Next............

Please create a new system restore point before running Malwarebytes Anti-Malware.

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Nothing showed in the scan from RogueKiller either......please do this:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.