How to remove trojan.win32.agent.akk, and "Critical System Error!" warnings.

"Your browser was hijacked by Trojan.Win32.Agent.akk..." Critical System Error popup:


This infection is usually installed by installing a fake codec:


It will serve relentless popups advertising for IEDefender. If you have installed IEDefender, you may have noticed it doesn't easily go away. These instructions should remove that as well. The motive of the infection is to get you to buy IEDefender. Presumably the malware author gets a referral fee for every copy sold. It works like this: Infect your system, display warning popups, install a rogue antispyware application, and then charge you to buy the program that claims to remove the infection they installed.

Trojan.win32.agent.akk Removal Instructions:
ShadowPuterDude has authored an automated tool for removal of Trojan.Win32.LinkReplacer. You can find the download and instructions here.

NOTE: You will need to temporarily disable any programs you have running that will block attempts to edit the registry. As FixIEDef calls REGEDIT to delete registry keys added by Zlob, Trojan.Downloader.Delf, AntiSpyPro, and IE Defender.


1. Download FixIEDef.exe by ShadowPuterDude to the Desktop.
   Note: FixIEDef now supports Non-English Language Systems
   
   
2. Double-click FixIEDef.exe:
   
   
   
3. That will open the About FixIEDef screen. Click OK to continue:
   
   
   
4. Next, press the Scan! button:
   
   
   
5. FixIEDef needs to run as Administrator to perform correctly. This message simply confirms it was able to run with admin privileges. Click OK to continue:
   
   
   
6. Wait for the scan to finish. It shouldn't take very long:
   
   
   
7. After the !!! All Finished !!! message is displayed, click Exit:
   
   
   
8. That's it! You're done, and the infection should be removed.
   
   Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. See: http://www.beyondlogic.org/consulting/proc...processutil.htm
   
   Mirrors: Alternate official download locations for FixIEDef.exe
   
   http://it-mate.co.uk/downloads/fixiedef/fixiedef.exe
   http://hosts-file.net/download/fixiedef/fixiedef.exe
   http://avant.it-mate.co.uk/?c=Download&f=Tools/FixIEDef
   http://archives.mysteryfcm.co.uk/?f=Securi...pyware/FixIEDef

If after running this tool the trojan.win32.agent.akk infection is still present, post a HiJackThis log in the Malware Removal Forum.

=====================================================================
This is a self-help guide. Use at your own risk.

Important Note: If you need assistance, please start a new topic in our Malware Removal Forum. This topic is also open for comments, but not all will receive a reply. Please NO HijackThis logs in this topic.

This post has been edited by Blair: Jan 12 2008, 11:58 AM

Dear Blair,

What a relief you've given me. Oh ... Thank You So Much.
You got me rid of the irritating popup.

Nomadqq

You're more then welcome.
Glad we were able to help

Peace be with you