Jump to content

Trojan.Agent - unable to locate component, msohjicor.dll not found


Recommended Posts

I need your help!

Upon opening any program the following pop up occurs:

blank.exe - unable to locate component

This application has failed to start because msohjicor.dll was not found. Re-installing the application may fix this problem.

This pop up occurs with every program. I ran AVG to find Trojan.Agent with a successful removal. I then cleaned with Ad-Aware and Spybot.

Afterwards, I ran MalwareBytes Antimalware to find a clean system with the same pop ups. I am at a loss to do. I have the following HJT, MalwareBytes and Combo fix logs.

If anyone could help, I will greatly greatly appreciate it. Thanks!

Logfile of HijackThis v1.99.1

Scan saved at 11:21:18 PM, on 8/25/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wltrysvc.exe

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\dvd43\dvd43_tray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Documents and Settings\default\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\libusbd-nt.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HijackThis\HijackThis.exe

C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java

Link to post
Share on other sites

  • Staff

Hi,

[7] 2004-08-04 19:00 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll

[7] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll

[-] 2009-05-09 17:14 110592 4CF8A3394D7B6D3FA17DE9C2EBF76C92 c:\windows\system32\imm32.dll

This looks like your imm32.dll got patched, which may explain why you get this error, because imm32.dll is injected in almost every process.

I've seen this already a couple of times that malware done this with imm32.dll

To restore it,

Open notepad and copy and paste next present in the quotebox in it:

@ECHO OFF

cd c:\windows\system32

attrib -r -s imm32.dll

ren imm32.dll imm32.vir

copy c:\WINDOWS\ServicePackFiles\i386\imm32.dll c:\windows\system32

Save this as replace.bat , choose to save as *all files and place it on your desktop.

It should look like this: bat.gif

Doubleclick on it. This will rename the bad imm32.dll to imm32.vir and replace a good imm32.dll from another folder.

Let me know if that solved your issue.

Link to post
Share on other sites

  • 2 weeks later...
Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.