Trojan.agent.sd6! removal?

[Eaglesfan27]

My computer has apparently been infected with this trojan virus that pctools spyware doctor identifies, but has not successfully removed with 3 full scans. Anyone have any suggestions, safe programs to remove it? It keeps opening up windows to try to get me to buy perfect defender 09, and it has been shutting other browsing windows.

[hoopsguy]

I've had good luck with this tool for two different Trojans in the past month.

Malwarebytes.org

[Alan T]

I don't have access to PCtool virus data, but that virus looks like one of the many different members of the FakeAlert family.

Unfortunately each variation of that trojan has different infected spots, so it is tough to say which specific places you need to manually fix.

My best suggestion (and it is a lousy one), is to either:

1) escalate this issue with your current anti-virus software vendor since if their client is not currently cleaning this correctly, then you might have a subtly different variation and might need you to provide them data to fix it

2) Find a different piece of Antivirus software from another vendor and see if it both detects and cleans it correctly.

As much as I wish this was direct science, unfortunately with the various variations of trojans out there it sometimes is hit or miss to which vendors have seen which virus.

[Alan T]

Dola.. is this the popup you are getting?

[Eaglesfan27]

No, that is not the one I'm getting. I'm getting a windows firewall error message, and it says my computer is infected with win32.netsky.Q. Then, no matter what button I click it redrects me to a site to buy Perfect Defender 09.

[Eaglesfan27]

With Spyware Doctor, I'm now trying a full scan with my computer in safe mode (after deleting all temporary internet files) since their tech support said to do that if stll infected. That will take about 2 hours.

[hoopsguy]

Originally Posted by Eaglesfan27

No, that is not the one I'm getting. I'm getting a windows firewall error message, and it says my computer is infected with win32.netsky.Q. Then, no matter what button I click it redrects me to a site to buy Perfect Defender 09.

Sounds very similar to the first Trojan I was dealing with on my father's PC last month. More and more of these trojans are disabling access to AV sites and hobbling automatic updates - taking away tools that you would need to fight the issue.

My father's PC had Windows Defender on it and I tried SpyBot initially to get rid of it. Neither one of them were able to remove it, so I went software I linked earlier. I was a little suspicious because I had never heard of it but it worked like a charm. Took a little over an hour to run the full scan (in normal mode, not safe mode) and I was able to put the issue to bed. You'll need to download both the app and the rules, which should get you definitions that are current within the last 7-10 days.

Anyway, hopefully this helps in the event that your current software doesn't eradicate the trojan.

[Eaglesfan27]

Thanks, hoopsguy. If this last scan doesn't work, I'm going to try the site you linked.

[MizzouRah]

superantispyware.com
malwarebytes.org

That's the two I use... both free.

[Eaglesfan27]

Hmmm. The scan didn't even detect any problems this time (it has detected an issue every other time.) I'm going to try malwarebytes.org now. Thanks for the advice Hoopsguy and MizzouRah.

[DaddyTorgo]

safe mode & malwarebytes worked for me to clean up that horribly infected work PC the other day

[kingfc22]

Originally Posted by MizzouRah

malwarebytes.org

This software totally works!!! I've been trying to remove a vundo trojan for the past week and a half and this thing just kicked the crap out of it after I read this thread!!!

Woohoo!

[DaddyTorgo]

king - funny - vundo was what i had that it totally kicked the crap out of too

[Eaglesfan27]

I think malwarebytes.org took care of my problem as well. The only reason I'm not 100% positive is that it said it was going to delete some of the files after I rebooted, and I never saw any further messages that it actually did so. However, all 7 objects were listed as successfully quarantined by the program. Furthermore, the quick scan (I did a full scan the first time) found zero infections. I haven't had any pop-ups for about 15 minutes since I re-booted, and I was getting them every 5 or so minutes before, so I think my computer is clean now. Thanks for the suggestion, guys!

[Alan T]

Originally Posted by Eaglesfan27

I think malwarebytes.org took care of my problem as well. The only reason I'm not 100% positive is that it said it was going to delete some of the files after I rebooted, and I never saw any further messages that it actually did so. However, all 7 objects were listed as successfully quarantined by the program. Furthermore, the quick scan (I did a full scan the first time) found zero infections. I haven't had any pop-ups for about 15 minutes since I re-booted, and I was getting them every 5 or so minutes before, so I think my computer is clean now. Thanks for the suggestion, guys!

The trojan probably had those 7 files locked in memory while the OS was running. It likely cleaned those files out before Windows came back up which is why you probably didn't get any notification that they were infected.

Glad to hear you had your problem taken care of!

[hoopsguy]

Eagles, always good to help USC fans snuff out trojans

[Drake]

What cracks me up about this thread is that (unlike the rest of us) if a known serial killer/psychopath walked into Eaglesfan27's office for therapy, he wouldn't have used an exclamation point in the title. (Okay, he wouldn't have actually posted a thread about that because of confidentiality stuff, but you can imagine him being cool and collected dealing with someone with serious mental health issues and a violent history.)

But a PC virus crosses the "Notify the Message Board!" crisis threshold.

It's always interesting to me the crises people face that trigger their personal exclamation point response.

[Dr. Sak]

Originally Posted by Eaglesfan27

My computer has apparently been infected with this trojan virus that pctools spyware doctor identifies, but has not successfully removed with 3 full scans. Anyone have any suggestions, safe programs to remove it? It keeps opening up windows to try to get me to buy perfect defender 09, and it has been shutting other browsing windows.

Anyone else find the irony in a Trojan fan getting a Trojan virus?

I hope you get it fixed.

[Eaglesfan27]

Originally Posted by Drake

What cracks me up about this thread is that (unlike the rest of us) if a known serial killer/psychopath walked into Eaglesfan27's office for therapy, he wouldn't have used an exclamation point in the title. (Okay, he wouldn't have actually posted a thread about that because of confidentiality stuff, but you can imagine him being cool and collected dealing with someone with serious mental health issues and a violent history.)

But a PC virus crosses the "Notify the Message Board!" crisis threshold.

It's always interesting to me the crises people face that trigger their personal exclamation point response.

That exclamation point was actually part of the name of the virus, at least according to Spyware Doctor.

[Eaglesfan27]

Originally Posted by Dr. Sak

Anyone else find the irony in a Trojan fan getting a Trojan virus?

I hope you get it fixed.

I found this ironic as well, but was too annoyed to appreciate it at the time. No signs of infection since I ran the malwarebytes.org program

[Mizzou B-ball fan]

Just a heads up. If you haven't put WinPatrol on your computer already, do it. It's free software and it informs the user anytime there's an attempt to alter the registry or install software. The beauty of that is the variants of viruses don't get through any better than the original. Saves the user from a lot of problems.

[bulletsponge]

help me!!! i cantet to the Malwarebytes site to dl it, i got this damn thing on my computer thats screwing me over. i think its that thing AlanT was talking about up top.when i do a search for malwarebytes it keeps redirecting my to a malware search instead of the malware site even when i type it in

it wont let me go to that malware site that was linked above, and when i search for maleware i takes me to some shoping site

[cuervo72]

10. Qc5 Bg4
11. Bg5? Trojan.agent.sd6!

[Alan T]

Originally Posted by bulletsponge

help me!!! i cantet to the Malwarebytes site to dl it, i got this damn thing on my computer thats screwing me over. i think its that thing AlanT was talking about up top. it keeps redirecting my to a malware search instead of the malwre site even when i type it in

it wont let me go to that malware site that was linked above, and when i search for maleware i takes me to some shoping site

Try a different browser. There is a chance that whatever has infected you is only hijacking one browser. Check your DNS servers to make sure it isn't hijacking your DNS server entries to point you to different servers. Also check your hosts file in uhh.. windows/system32/drivers/etc/hosts I think off the top of my head to make sure it did not add a bunch of entries there.

If none of those work, and you simply can't get to sites on the internet, you might have to get onto a different computer and see if you can download a cleanup boot disk that sometimes various virus companies have available to their customers. It will allow you to temporarily boot up on a clean disk to clean up your system (not booting into windows).

Other than that.. ugh.. I'm not a computer guy, I am a network guy so not sure what I would recommend, but at some point a system gets so messed up I personally would just nuke it and rebuild it rather than try to clean it out.

[DaddyTorgo]

Originally Posted by bulletsponge

help me!!! i cantet to the Malwarebytes site to dl it, i got this damn thing on my computer thats screwing me over. i think its that thing AlanT was talking about up top. it keeps redirecting my to a malware search instead of the malwre site even when i type it in

it wont let me go to that malware site that was linked above, and when i search for maleware i takes me to some shoping site

PM me your email address and i will email the setup.exe to you. i have it on my desktop right now.

[gottimd]

Originally Posted by Eaglesfan27

No, that is not the one I'm getting. I'm getting a windows firewall error message, and it says my computer is infected with win32.netsky.Q. Then, no matter what button I click it redrects me to a site to buy Perfect Defender 09.

This was the virus I got. I found where it lives. Its in application data/Google and its name is mjkdpl.dll and there is an .exe file there as well. I renamed them to something like "sadfsdfasdf" which made them unusable, rebooted my computer and deleted them.

[bulletsponge]

ok sending email to daddy

i searched my windows/system/driver/ect.. but found nothing strange. i hope i can get daddys dl to work cause Alans 2nd solution sounds very complicated for a guy like me

[Eaglesfan27]

Originally Posted by gottimd

This was the virus I got. I found where it lives. Its in application data/Google and its name is mjkdpl.dll and there is an .exe file there as well. I renamed them to something like "sadfsdfasdf" which made them unusable, rebooted my computer and deleted them.

That is exactly where it found mine and was the exact same name.

[bulletsponge]

um is the dl called Malware anti-malware?

[hoopsguy]

Bullet, I would go to another computer - heck, get one at Kinko's with Internet access if that is what you have to do.

1.) Download the malwarebytes setup
2.) Download the updated rules
3.) Save these to a USB key
4.) Install them on your computer - have not seen a trojan yet that prevents you from installing the AV software

That should get you current enough to be able to deal with the issue (I think).

[Alan T]

Originally Posted by hoopsguy

4.) Install them on your computer - have not seen a trojan yet that prevents you from installing the AV software

There are some that disable or prevent AV from being installed, but yeah what you listed was a better way of saying what I tried to give as one of my options above. I just was a bit more wordy and less clear with my instructions!

[bulletsponge]

i got the setup, but for some reason i cant install it. its stoping before its done

[hoopsguy]

Might want to see if Gottimd's suggestion (post #26) works for you then - rename the files, restart, then see if you can install the software to remove it.

Another option might be to try a System Restore, if you have that feature enabled. But I know a few viruses that screw up these settings, so that may not be a viable option (if it is even enabled).

[bulletsponge]

the setup seems to be freezing, and whn i ctl/alt/dlt i get a "invalid floating point operation" error

[DaddyTorgo]

install in safe mode?

[bulletsponge]

how do i do that? install in safe mode?

[Maple Leafs]

I had one of the Perfect Defender trojans last week (trojan.Zlob.G). I was able to kill it with these steps:

This solution works for the latest Trojan.Zlog.G popup problem where no internet connection works and repeated fake warnings to 'activate' Defender anti-virus program.

No use running any ant-virus/soyware programs, they don't seem to detect this latest Trojan. Only manual removal works perfect:

Start in safe mode (press F8 at startup)
Delete following:

kjzna1562565.exe
spcffwl.dll
T-Scan (entire folder)

their location would be C:\Documents and Settings\{username}\Application Data\Google\

Source: Spyware Removal News: Remove Trojan.Zlob.G fake alert - Trojan.Zlob.G Removal Help

Two notes:
- The .dll had a different name in my system, but deleting it still worked
- If you don't see that Google folder, make sure you have hidden folders set to display

[Alan T]

Originally Posted by Maple Leafs

I had one of the Perfect Defender trojans last week (trojan.Zlob.G). I was able to kill it with these steps:



Source: Spyware Removal News: Remove Trojan.Zlob.G fake alert - Trojan.Zlob.G Removal Help

Two notes:
- The .dll had a different name in my system, but deleting it still worked
- If you don't see that Google folder, make sure you have hidden folders set to display

As far as I am aware, different variations of this trojan family will have different random character named .dll files loaded into memory. So it might not be the exact same file name, but something similar in the sense that it likely will look like random characters.

[bulletsponge]

ok i think i gto rid of it, not 100% sure though

i fould the file folder of it, renamed the 2 files in it to "trash" then i restart my computer. after i restart i come back and i can dump the files into trash bin, and i went to documents and setting area and dumped the file that was there too.

but i still have a problem. all pics and smileys dont show up. its like the graphics to pages wont load. i can still hit the "reply" button, but the graphic to it doesnt show. also when im typing occasionally the ill get bumped from the page but not leave it. cant really explain it to well, but its like i unclick the page yet stay on the page so i have to reclick it. thats why my spelling was so bad on this page in earlier posts.

for instance when i was typing this post a few times i like my mouse clicked a different spot so i stoped typing. and i just had 2 pop ups to advertisments.

[DaddyTorgo]

hmmm - did you get the malwarebytes thing to run bullet?

[bulletsponge]

no i havnt, i dl it but it wont run

i mean i dl it and installed, but it wont run afterwards

[bulletsponge]

and no links work. like the one to mylware one above. hotlinks i think

[bulletsponge]

i got the pics to work by checking over my internet options. i think maybe the one that allows the links is in there too

[bulletsponge]

ok maybe its just that hyperlink to mylware

[bulletsponge]

ok all searches get redirected

[DaddyTorgo]

gahhh

can you startup in safe mode? (reboot and hit f8 while windows is loading up) and then run malwarebytes program?

[bulletsponge]

ok ill try that

[Eaglesfan27]

S.O.B!! My work computer was just infected the exact same way. Work's antivirus program said an intruder was trying to attack my computer or something like that.. then the screen flashed, the computer rebooted, and now I'm getting the exact same pop-ups as I got on my home computer! Is it possible that FOFC is somehow spreading the virus? That is the only site I've been browsing today.

edit: I'm going to try to get to malwarebytes.org now, it was very difficult to get anywhere for the last 10 minutes.

[kingfc22]

Originally Posted by Eaglesfan27

Is it possible that FOFC is somehow spreading the virus? That is the only site I've been browsing today.

I think there may be something to this since this is the site I was on when I got my vundo trojan.

[bulletsponge]

ok i couldnt run windows in safe mode, i didnt understand what to do when i was there, just a black screen with the words safe mode here and there. maybe my brother will know what to do, but he wont be here for another few weeks