====Please help me remove trojan.win32.agent.bck====

[tampabay]

I have this Trojan.Win32.Agent.bck, I can't remove it.
I run Avast at start up, won't remove
I run Avast at Safe mode, won't remove
I run Kaspersky at both safemode and normal mode, won't remove

I followed the instructions on this post, but my HJ report different from that post so it can't help much.
http://forum.networktechs.com/showth...?t=1687&page=2

Please help!
Thanks in advance.

[jholland1964]

First of all, running two anti-virus programs on one machine is a no-no. Though I don't see Avast in your HJT log...where is it?
2nd-an anti-virus program will NOT remove a trojan.
3rd-How do you KNOW you have Trojan.Win32.Agent.bck?
4th you said that you followed instructions on this post

Okay, I think I'm ready to post finally...lol.

Why would you do that? That is a post by another person with a problem. Your logs shouldn't look like the ones there, these are two entirely different computers. Plus the thread you looked through has never been completed, the poster never returned so we have no idea what additional requested logs look like because she didn't post again.
You should NEVER follow the instructions given to another with a problem on another thread. You certainly can and should read other threads for informational purposes but as I said, each and every computer is different, each problem is different.

What you need to do is begin with the steps on this instructional sticky;
READ ME Before Posting A Request For Assistance!

Then, we need you to post all those logs requested back here, we need you to do each and every step as directed and we need to know how you know you have this problem and EXACTLY what symptoms is the computer showing?

[tampabay]

Thanks for quick reply:
Below are my answer to your questions with my question as well.
1/ I only run one at a time. I already uninstalled Avast.
2/ Thanks for the info.
3/ I have Kaspersky installed and it detected that Trojan, but it says can't delete it. see attached.
4/ Followed that post for information purposes and checking to see if anything that I can do to remove it. As I said on first post, it can't help much.

"""What you need to do is begin with the steps on this instructional sticky;
READ ME Before Posting A Request For Assistance!"""
I will follow the instruction above before I post back again. While I follow that instructions, I have questions: Step2 tell me to install some antispyware software... I already have Kaspesky installed. do I need to uninstall Kaspesky? is it okay to install AVG and MS Defender at the same time?

(I am running Win XP Pro)
Thanks,
TB.

[jholland1964]

Ok, Kaspersky is your anti-virus program and there is no problem having an anti-virus program AND anti-spy/ant-malware programs on the same computer. PP has set his sticky up very carefully so as NOT to have programs which would conflict with each other on the same computer so you needn't worry about conflicts.
Be sure to RENAME hijackthis.exe to hjtscan.exe or analyze.exe by RightClicking hijackthis.exe and selecting Rename. This is important! Some of these nasty programs are created to look for hijackthis and hide themselves from the scan. Renaming helps eliminate their ability to hide.

Leave your Kaspersky on the system, it is a good program. You don't need to use their online scanner but if you are able to get a log from your program post it here.
I would recommend though that you do at least two of the OTHER online scans that PP notes and if they give you the option to fix, delete or quarantine anything found then do so...just be sure to save the logs and post them here. If you can't get a log then please note the name and FULL location of everything found and post that here too.
With the AVG Anti-spy scan please tell it to fix everything found. Be sure to save that log too and post it back here.
As far as your attachment, looks to me like you ARE being given the option to DELETE the file...go ahead and do this, or at least see if you can do this.
After you have followed PP's steps AND renamed the HJT scan then please run a NEW HJT scan and post the log here with the others requested.

[tampabay]

After long scan and this and that yesterday. I though it gone, but not.
I followed the instructions, but somehow I can't get the report from AVG scan.

The Kasperky detected the trojan, but can't delete it.

Please take a look at the attached files I have.... In the mean time, let me run the scan again to see if I can get the report.

Thanks.

[jholland1964]

Download and run in SAFE MODE this from our own ~TL

CleanupXP+

Download it to the desktop. Shut Down. Disconnect from the Internet, physically unplug the internet hook up from the computer. Reboot into SAFE MODE and run just the Standard Cleanup with the program, nothing else.
When it is complete, shut down, reconnect the internet plug. Reboot to normal mode and run the Kaspersky and AVG again. See what each shows and of course tell each to fix anything found.
Save the logs and post back here with the new info.

[tampabay]

I followed you instructions.
The AVG scan completed without any detects. Nothing found.
The kaspersky detected and prompt for me to delete like the image I sent on second post "TrojanScreenShot.jpg ".
I did look at the temporary internet folders, they are all cleared now, but if I restart the computer and open the Internet, I will got tons of pop up and Kaspersky start prompting me to delete the trojan/.DLLs.

[tampabay]

See more screenshots on the attached please.

[jholland1964]

Ok, try it again, shut down, disconnect the internet cable. Reboot again in SAFE MODE and run CleanXP+ again. It will run a standard cleanup first of all the temp, Temporary Internet Files, Cookies, History and Recent,
Prefetch and Recycle Bin files on the system. After the standard cleanup, the program will prompt the you to see if a specific file/folder is to be removed.

Please choose Option 1. Remove a File:

This is the file you need to have the program remove; (I want to say here that I had to copy this from your .jpg attachment so I am not certain I have the personal names spelled correctly below, you will have to be certain that the spelling IS correct)

C:\Documents and Settings\jlassiter\Local Settings\Temporary Internet Files\Content.IE5\FNGBQFNR\valera[1]

Run CleanXP+ and then shut down, reconnect the internet cable then reboot into normal mode.

THIS time I would like you to run that online Kaspersky scanner shown in PP's post and save that log and post it here. I am not working with full information here (your screen shots are too small to see the info & because enlarging them blurs them even more) and since you seem to be unable to post a full log and with your onboard Kaspersky I do need to see the full log from the online scanner. This is very important, there is a chance that something else we are not seeing is working here.

[jholland1964]

Important info from ~TL

He should use AnalyzerXP first to see what other unidentified malware files could be in the system before using CleanupXP+.

AnalyzerXP 3.7

Use the program and then post the log here before doing anything else.