Please Help with Spy-Agent.bc

mizeryschild · Jul 17, 2006

I came home from work today to find that my husband had infected my computer with Spy-Agent.bc.

Usually I can clean my computer of the infected files and keep from having to reformat the whole pc, but this time I haven't had any luck.

I did download fixwareout, hijackthis, and hoster, just in case they are needed.
I ran fixwareout and got a report from it, as follows:

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97751E4AA173-1D1B-A0F4-B92A-0D809EAB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C32D07CD8BB-922B-D024-2B6B-F4162150{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}40794D4D6C0A-275A-1364-76F6-3421F505{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0672D4347C9A-287B-8534-2324-307B3FFD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B26A5964DBF4-26DB-4054-7970-9C41C1EA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1trap
...

Microsoft (R) Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names...
C:\WINDOWS\SYSTEM32\IPSEC6.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32
Click to expand...

I followed the tutorial on the meanings of the HijackThis filetypes, found all of the ones that needed to be removed and told it to fix the problems, but my computer is STILL popping up in McAfee (which I rarely use anyway because it rarely picks up on the infected files. Use WebRoot. They're the best. )

It hasn't yet created any problems with running any programs, but the pop-up is just annoying, and what's worse is that I KNOW something is going on with my pc.

The HijackThis file looks like this:

EDIT : Removed inlong HJT log

Any assistance would be helpful -- it would take me hours to get my computer back to where it was before he trashed it...

If you're online right now, try sending a message to mizeryschyld on yahoo. I'm usually online, otherwise, you can e-mail me: Edit: Removed email to prevent email harvesting.

Thanks,
Miz

DavidGP · Jul 17, 2006

Hi and Welcome

Do please run through our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

Click to expand...

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

Log in or Sign up

Please Help with Spy-Agent.bc

mizeryschild Private E-2

Attached Files:

HJT.txt

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member