I was searching online some answer to fix a pb that I have with my camera, when I became infected with Trojan-Keylogger.Win32.Agent. Unfortunately, I was tricked and I click the “Enable Protection” button on the pop-up windows. After that my computer becomes to be frizzed.

The original message was:
Windows Security Alert
Name: Trojan-Keylogger.Win32.Agent.
Risk Level: High
Description: Agent.arpt is a Spyware program that records keystrokes takes screen shot of the computer.

My computer is a Compaq Desktop with windows XP. Running Avg 8.5 and SuperAntispyware.

Efforts: I started it in a safe mode and do all the following actions:
1) I have turned off System Restore
2) Avg Scan ran – Nothing found.
3) SuperAntiSpyware, First scan found 1 item “Rogue.XP AntiSpyware 2009”. Second scan, 29 items were found, including “Rogue.XPDeluxeProtector and Rogue.SystemSecurity”. All were quarantined and deleted by me. Third scan ran which came back clean.
First Log:
UPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 06/13/2009 at 00:00 AM
Application Version : 4.26.1002
Core Rules Database Version : 3927
Trace Rules Database Version: 1871

Scan type : Complete Scan
Total Scan Time : 01:35:36

Memory items scanned : 228
Memory threats detected : 0
Registry items scanned : 5487
Registry threats detected : 1
File items scanned : 23790
File threats detected : 0

Rogue.XP AntiSpyware 2009 HKU\S-1-5-21-3352189345-227156992-886978096-500\Control Panel\don't load#wscui.cpl [ No ]

Second Scan:
UPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 06/13/2009 at 04:27 PM
Application Version : 4.26.1004
Core Rules Database Version : 3938
Trace Rules Database Version: 1881

Scan type : Complete Scan
Total Scan Time : 00:37:02

Memory items scanned : 261
Memory threats detected : 0
Registry items scanned : 5459
Registry threats detected : 0
File items scanned : 23872
File threats detected : 29

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@media6degrees[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@toseeka[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@shopica[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@kaspersky.122.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@www.toseeka[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@overture[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@msnservices.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@208.122.40[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@www.shopica[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@couponmountain[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@adultfriendfinder[2].txt

Rogue.XPDeluxeProtector
C:\Documents and Settings\Administrator\XP DELUXE PROTECTOR\xpdeluxe.exe
C:\Documents and Settings\Administrator\XP DELUXE PROTECTOR

Rogue.SystemSecurity
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\13360464\13360464.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\93370456\93370456.EXE

Trace.Known Threat Sources
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VLPPC7HX\shopica_logo_bott[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RQUA53SP\footer_dots[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\NELX527G\shopica_logo_top[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VLPPC7HX\style[1].css
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VLPPC7HX\search[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZKYGN584\async_ads_rs[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZKYGN584\js[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VLPPC7HX\favicon[2].ico
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZKYGN584\async_ads_rs[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RQUA53SP\sp[1].gif

4) Installed and run CClean. I run both clean and registry options.
5) Installed and Malware Bytes, I couldn’t run full scan, ever I tried it, after run more than 1 hour it finished abruptly. I run a quick scan and it found 14 items. All were quarantined and deleted (by me).
Second quick scan came back clean (I continue unable to run a full scan).

First Log:
Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 5.1.2600 Service Pack 2
6/13/2009 8:56:19 PM
mbam-log-2009-06-13 (20-55-49).txt

Scan type: Quick Scan
Objects scanned: 84768
Time elapsed: 16 minute(s), 44 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 5
Folders Infected: 1
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (userinit.exe) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.



Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.Data) -> No action taken.

Files Infected:
c:\windows\system32\lowsec\local.ds (Stolen.Data) -> No action taken.
c:\windows\system32\lowsec\user.ds (Stolen.Data) -> No action taken.
C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) -> No action taken.


After previos steps, I reboot in normal mode in order to see if malware has gone, but the pop up is still showing when I logged on.
Then:
5) Installed and run spyBot S&D. It found 2 items:
Win32.Agent.pz: [SBI $8980C6CD] Settings (Registry value, fixed)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Network\UID

Zlob.Downloader.vcd: [SBI $D8DF6192] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin


6) Installed spyware blaster 4.1.


After steps 5 and 6, I reboot again but nothing continues Windows Security Alert is still popping up as described with the Trojan-keylogger agen.arpt warning. But also my computer started to restarted alone after 1 or 2 minutes. I can not do anything more in normal mode.

7) In safe mode I downloaded and ran Malicious Software Removal Tool from MS however; but again I am unable to run a full scan (it finished after 1 and a half hour and said it has found a serious error and abort). I run a quick scan and it did not detect anything.

My situation now is Windows Security Alert is still popping up as described. Computer restarts 1 minute after I logged on it. I do not what more can I do. Please help me, any suggestions other than formatting the HD and reloading the OS would be greatly appreciated. OS comes pre-installed with the computer that means I do not have disk to reloading the system.



Thanks a lot, really i need help with this.
dzdc2001

Re: Trojan-Keylogger.Win32.Agent- I can't rem

Hi Crush .. thanks a lot for you help.

But i have a pb, as I reported previously... when I logged on in normal mode, computer immediately restarts alone (it is like a loop, restart and restart over and over) i can't do anything to download programs that you indicated me. In safe network mode, IE opened but aborts as soon as i try to access some page.

What can i do? It is same option if I download the program in other computer and install it in a safe mode?
Thks.

Re: Trojan-Keylogger.Win32.Agent- I can't rem

Hi Crush:
Thanks a lot. Finally I could download combofix. Just to let you know, in order to have access to my computer without it restarted, as soon as I logged on and the trojan pop-up windows appeared, using task manager I finished in Applications tabs "Windows security alert" and in Process I finished "defender.exe" and "searchprotection.exe". I'm not pretty sure if that help, but I was able to download the combofix and run it. Attached to this msg is the log. Combofix found some rootkit activity on several files SKYNETxxxxx. Now, trojan-pop up has finished and my computer is not restarting alone. Do I have to do something else?

Thks, Dzdc2001.

Re: Trojan-Keylogger.Win32.Agent- I can't rem

Hi Crush:
Thank you again for all your help and time, really I appreciated it. The work that all of you do with people like me is terrific.

I run Panda active scan. I had to run twice. First was quick, second was full (it took a lot of time), attached are both logs. It found some issues with NirCmd.A, but I think it is a false positive, because issues are related to flash disinfector. Should I do something with this files?.
Can I delete the files reported as suspicious?.

Also, I run CClener as you indicated me.

Could you advised me what I have to let running in my computer?. I feel unsecured about AVG, I did not detect nothing about this pb. (I use free version, Is it a better free anti-virus?)

Thanks. I’ll be waiting your final advice and I think this issue is fixed.

Re: Trojan-Keylogger.Win32.Agent- I can't rem

Hi, Crush:
Just a small issue. I run OTC, I do not why, but combofix icon disappear from my desktop, when I run combofix / u, it says there is no application. Is that fine?


I do not have more doubts; I think this can be moved to fixed threads. Thanks again.
DZ