topic Re: Trojan.Win32.Agent.rju in Norton Internet Security / Norton AntiVirus

Trojan.Win32.Agent.rju

smokeeater — Wed, 18 Jun 2008 16:41:58 GMT

Ok does anyone know how to get rid of Trojan.Win32.Agent.rju

It keeps coming back and creating a new file. It goes in my C:\windows\system and has a number then .exe after it. It has obviously slowed the computer down, I have run a separate virus scan and mid way it closes completely. I also had Ad-Aware running and it closed too.. I have even tried to delete instead of quarantining. It is obviuosly creating it from somewhere else. Any ideas on what to do?

Re: Trojan.Win32.Agent.rju

Floating_Red — Wed, 18 Jun 2008 20:21:42 GMT

Click on this Web Link: http://www.symantec.com/en/uk/security_response/writeup.jsp?docid=2005-042511-1823-99 .

It is advised that you only have one Anti-Virus Software Installed on your computer at any one time and other Programs related to what Anti-Virus Progams do.

Message Edited by Floating_Red on 06-18-2008 09:21 PM

Re: Trojan.Win32.Agent.rju

Stu — Wed, 18 Jun 2008 20:56:04 GMT

Hi Smokeeater

Please submit the file to Symantec

Malware Submission

Re: Trojan.Win32.Agent.rju

pjgeek — Thu, 19 Jun 2008 00:02:38 GMT

I found a pointer in registry :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name: comtf

Type: REG_SZ

Data: C:\DOCUME~1\<current user>\LOCALS~1\Temp\orz.exe

And that file did exist in that Temp directory. Have deleted it and waiting to see what comes of it. It did NOT show up as an infected file, neither did any of the c:\Windows\system#####.exe files that it had dropped in the last two days show up as infected.

After deletion of that file trojan.win32.agent.rju didn't appear to run on reboot. Time will tell.

Just go to that Run key in the registry and get rid of anything suspicious.

Re: Trojan.Win32.Agent.rju

Stu — Thu, 19 Jun 2008 04:13:59 GMT

Please keep us posted