Malware - Trojan.agent, alureon, winrscmde
EJF1
Newbie

On about June 1st, 2012 my computer was infected with subject malware.

A flashing notice would appear on the lower part of the screen titled, "Microsoft Windows".

After deleting, it would re-appear.

Running MalwareBytes revealed "trojan.agent" which was called "svchost" located in the Windows folder.

The file kept re-appearing after deletion.

After jumping through a lot of hoops, I discovered that by disconnecting my internet connection, running MalwareBytes, removing the trojan.agent, re-starting my computer and re-connecting to the internet, the "svchost" file was gone from the Windows folder.

It appears to me that there could be malware on the Verizon Server that prevented removal from my computer.

Verizon has successfully isolated itself from the customer which prevents any reporting of issues, therefore I am using this forum, hoping a Verizon agent will read this and investigate.

Ed

0 Likes
Re: Malware - Trojan.agent, alureon, winrscmde
Gerard_Sr
Enthusiast - Level 3

Seriously now, I strongly doubt that there is malware on Verizon's servers.

Having removed lots of malware and Trojans from many computers myself, I can tell you this...

Typically there is an unidentified program in one's computer that will itself connect to the internet and re-download and restart malware. The malware detection programs only see the malware when it's operating or when it is done with this download operation.

You did good by disconnecting from the internet and then running programs to detect and remove the nasty or nasties.

Another step you should have taken is to have cleared your browser cache. In a few cases I had seen a Trojan reinstall itself from a browser cache! It was just about the same, an unidentified program re-installed the malware from the cache rather than the internet.

Cordially,

Gerry

Re: Malware - Trojan.agent, alureon, winrscmde
smith6612
Community Leader
Community Leader

@Gerard_Sr wrote:

Seriously now, I strongly doubt that there is malware on Verizon's servers.

Having removed lots of malware and Trojans from many computers myself, I can tell you this...

Typically there is an unidentified program in one's computer that will itself connect to the internet and re-download and restart malware. The malware detection programs only see the malware when it's operating or when it is done with this download operation.

You did good by disconnecting from the internet and then running programs to detect and remove the nasty or nasties.

Another step you should have taken is to have cleared your browser cache. In a few cases I had seen a Trojan reinstall itself from a browser cache! It was just about the same, an unidentified program re-installed the malware from the cache rather than the internet.

Cordially,

Gerry



To tack onto this: Also check the Java cache. A ton of things love to exploit Java and store themselves in the cache folder for Java, which can get quite rediculous in size. Do that while clearing your browser cache (Control Panel > Other settings > Java, or Control Panel > Programs > Java). I clean out Malware all the time for people, including rootkits and things can be quite a mess on some systems.

But as mentioned, the problem is not from Verizon. Just typical Internet nonsense that we all have to deal with at some point.

Re: Malware - Trojan.agent, alureon, winrscmde
JOSEm441
Specialist - Level 2

Smith 6612 and Gerard_Sr are spot on, another way to go about this is to update malwarebytes and/or your virus protection, then run full scans in safe mode without netwroking (F8 after power on). I would also clear my restore points if you are using windows system protection.