Could you please HELP

Secure said i have Trojan-PSW.win32agent.am

Does it list where it's located?

Hi LDTate, Here is the last entry in the log of f-Secure 1 2005-06-18 19:22:38+03:00 station STATION\John Matthews F-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12 Malicious code found in file C:\WINDOWS\SYSTEM32\DRV2CLTR.DLL. Infection: Trojan-PSW.Win32.Agent.am I have deleted the file DRV2CLTR.DLL a few times before, when i do and reboot the system it just comes back again. F-secure detects the file when i open IE Cheers John P.S. I will not be at my computer until Monday morning 9.00am, I will respond to your post then. Thank you for your help and quick replies, Have a good weekend bye for now John

Serach for DRV2CLTR Delete all found.


Carry out a free online virus scan from the following link. Type in name, for company type anything you like, add email address in relevant boxes.

Kaspersky

Hi LDTate, I did a search of all my drives for DRV2CLTR it found 1 in C:\windows\system32 I then tried to do a scan at Kaspersky, i could not download something to do with active X settings please advise John

Hi LDTate, Sorted the problem at Kaspersky, did the scan, No problems Please advise John I also have 2 folders in the temp folder that will not delete and the folder names keep changing

Then download this program.

http://downloads.subratam.org/DllCompare.exe

Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log…." button.

Post the dll compare log to this thread.

Hi LDTate, I have done as you requested, the log is below * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 1,191 items found: 1,191 files, 0 directories. Total of file sizes: 239,160,894 bytes 228.08 M Administrator Account = True ——————–End log——————— I also did a virus scan last night with F-secure and it found trojan-clicker.win32agent.db - cisvvc.exe trojan-PSW.win32agent.am - drv2cltr which the progran renamed. I did a search for these files and deleted both. I started IE this morning and F-secure popped up with a virus trojan-PSW.win32agent.am again and also there was another dail up connection on the system (dail connectio) which i deleted. thank you John

Another Ewido scan please.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, and run a full scan. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Hello LDTate, I have done a complete reinstall of windows. (A friend on mine did a virus check from a bootable CD even that did not find anything) I would like to thank you for your advice and time. I have advanced alot regarding virus and spyware and from now on will make sure my computer is protected. With respect, John

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

Great job

You're more then welcome.
Glad we were able to help

Peace be with you





If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.