Trojan.Agent/Gen-killfiles

11 years ago

Scan day today. SuperAntiSpyware found this which has now been quarantined and gone. MSE missed it. I have 2 questions:

Trojan.Agent/Gen=killfiles

C:\PROGRAM FILES\1CLICKDOWNLOAD\1CLICKSETTINGSMANAGER.EXE

1) What does this do? All I can get with Google is 4711 ways to get rid of it but not what it does.

2) Looks like it is associated with One Click Download which is an extension in Firefox (13.0.1) now disabled (the extension not FF). Any reason I should not remove it?

Comments (7)

mike_kaiser_gw
11 years ago
You can get more information about your infection at Symantec's Threat Explorer.

Symantec defines a Trojan Horse as:

Trojan horses are impostors. The files claim to be desirable programs, but they are malicious. A very important distinction from true viruses is that they do not replicate themselves, as viruses do. Trojan horses contain a malicious code which, when triggered, causes loss or theft of data. For a Trojan horse to spread, you must invite these programs onto your computer; for example, by opening an email attachment. Trojan horses are also known to create a back door on a computer. The back door gives another user access to a system, and possibly allows confidential or personal information to be compromised. Unlike viruses and worms, Trojan horses neither reproduce by infecting other files, nor do they self-replicate.

A program that claims to be a desirable program but is malicious. A very important distinction from true viruses is that they do not replicate themselves, as viruses do. Trojan horses contain malicious code, which causes loss or theft of data. For a Trojan horse to spread, you must invite these programs onto your computer; for example, by opening an email attachment. Trojan horses are also known to create a backdoor on a computer. The backdoor gives another user access to a system and possibly allows confidential or personal information to be compromised. Unlike viruses and worms, Trojan horses do not reproduce by infecting other files, nor do they self-replicate.
mxyplx
Original Author
11 years ago
Well thanx.

I found that Symantec recommended to turn System Restore off then on; Superantispyware did not. So I did that too just now which wiped out all restore points and any possibility of getting the infection back. At least from that angle. That's easier than trying to just delete the latest point.

It was on the comp less than 24 hrs cause I figured out know how and when it happened. I just flat got faked out trying to download something (film from a book I read several years ago). It must have also installed the extension -now removed- in FF.

So now all my problems are over. :-)
Related Discussions
Gmail: Hacked, spoofed or what?
Q
Comments (18)
Thanks, everyone. Mike, gmail did make me do the code-by-phone thing to change my password. So I must have set that up sometime in the long forgotten past. Once in a while, things go right. Chuggerguy, I'm jealous. France is so much more exotic than Texas. :) Here are the logs: Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.02.06.09 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 Susan :: SMITHCORONA [administrator] 2/6/2013 3:55:25 PM mbam-log-2013-02-06 (15-55-25).txt Scan type: Full scan (C:\:) Scan options enabled: Memory : Startup : Registry : File System : Heuristics/Extra : Heuristics/Shuriken : PUP : PUM Scan options disabled: P2P Objects scanned: 343343 Time elapsed: 10 hour(s), 31 minute(s), 12 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 4 C:\Program Files\TOSHIBA\Amazon\MP3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\Shopping.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\ShoppingD.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\VOD.exe (Trojan.Clicker) -> Quarantined and deleted successfully. (end) SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 02/07/2013 at 09:16 AM Application Version : 5.6.1014 Core Rules Database Version : 9979 Trace Rules Database Version: 7791 Scan type : Complete Scan Total Scan Time : 01:35:17 Operating System Information Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600) Administrator Memory items scanned : 516 Memory threats detected : 0 Registry items scanned : 37287 Registry threats detected : 0 File items scanned : 61768 File threats detected : 325 Adware.Tracking Cookie cdn4.specificclick.net [ C:\DOCUMENTS AND SETTINGS\GLENNA\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JB8JPMNZ ] ...319 cookies clipped... accounts.google.com [ C:\DOCUMENTS AND SETTINGS\SUSAN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ] Trojan.Agent/Gen-Nullo[Short] C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101126.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101127.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101128.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101129.EXE I let MWB and SAS delete all they found. What does Trojan.Agent/Gen-Nullo[Short] do? I've found lots of malware removal sites telling people how to get rid of it, but little information on what it does? Could I have acquired it from clicking on an image?
...See More
Trojan agent-Gen fake alert
Q
Comments (17)
yes you are fine, and yes you can have several browsers with no problem, you can even have more than one type open at the same time if you need to. When you get firefox it will ask if you want to make it your default you can say no and leave your Ie default if you prefer, it will also ask if you want it to import your favorites list from Ie say yes to that and any other things it ask to import and it will then set up your firefox with all the same faves as you have on Ie, will not touch the Ie settings at all will just copy it all over for you. To use firefox once installed all you do is click on the firefox icon on your desktop and it will open up a browser window just like you do with IE. Here are some helpful links Ultimate List of Firefox 3 Tips and Tricks Here is a link that might be useful: firefox guide
...See More
Hacker reading my emails
Q
Comments (22)
oh no what adblock are you using I had a hard time trying to remove an adblock for someone else, it was telling them the same message. We had to use REVO uninstaller to fully remove it. Please tell me exactly what adblock name is. This may be where some of your problem came from. Some of these are nothing but malware masquerading as adblockers. Let me know the name and also what browser are you using this on? I will give you 2 links with detailed instructions on how to use REVO,in case we ill need it, do it as it is given in the video TUTORIAL: Revo Uninstaller Completely Uninstall Programs And More With Revo Uninstaller
...See More
email with infected link
Q
Comments (9)
I haven't run the scans on my colleagues computer yet but decided to try my own first. So the malwarebytes scan came up clean and the SUPERantispyware scan came up with some cookies and 2 trojans? This is the log: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 08/08/2012 at 12:17 PM Application Version : 5.5.1012 Core Rules Database Version : 9025 Trace Rules Database Version: 6837 Scan type : Complete Scan Total Scan Time : 00:25:57 Operating System Information Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601) UAC Off - Administrator Memory items scanned : 626 Memory threats detected : 0 Registry items scanned : 70158 Registry threats detected : 0 File items scanned : 42042 File threats detected : 46 Adware.Tracking Cookie C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\T00N465N.txt [ /overture.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\6Q194JQR.txt [ /zedo.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\XXR6FAXF.txt [ /adserver.adtechus.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\CUMN1ZYF.txt [ /invitemedia.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\VCE5GKCO.txt [ /revsci.net ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\BJ4V2VH2.txt [ /mediaplex.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\F1RU0NHR.txt [ /serving-sys.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\53T8TQ0U.txt [ /ad.yieldmanager.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\1YUML058.txt [ /fastclick.net ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\5Q9647X2.txt [ /ads.weatherzone.com.au ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\TKD3MT1H.txt [ /statcounter.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\S5YBX3GR.txt [ /imrworldwide.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\MHNEW4Y2.txt [ /legolas-media.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\V7LCDHTC.txt [ /apmebf.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\IYCTIIIJ.txt [ /msnportal.112.2o7.net ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\0Y20E032.txt [ /accounts.youtube.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\J2C4UZ0Z.txt [ /accounts.google.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\9AO47PXP.txt [ /bs.serving-sys.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\NSMJ2VJ2.txt [ /adxpose.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\BI9QZVIJ.txt [ /atdmt.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\SB87EQKW.txt [ /casalemedia.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\HPN7KZ2W.txt [ /c.atdmt.com ] C:\Users\Drawing3\AppData\Roaming\Microsoft\Windows\Cookies\UBMIMP3G.txt [ /doubleclick.net ] C:\USERS\DRAWING3\AppData\Roaming\Microsoft\Windows\Cookies\Q2Z2Q5EK.txt [ Cookie:drawing3@www.google.com.au/accounts ] C:\USERS\DRAWING3\Cookies\T00N465N.txt [ Cookie:drawing3@overture.com/ ] C:\USERS\DRAWING3\Cookies\6Q194JQR.txt [ Cookie:drawing3@zedo.com/ ] C:\USERS\DRAWING3\Cookies\CUMN1ZYF.txt [ Cookie:drawing3@invitemedia.com/ ] C:\USERS\DRAWING3\Cookies\VCE5GKCO.txt [ Cookie:drawing3@revsci.net/ ] C:\USERS\DRAWING3\Cookies\BJ4V2VH2.txt [ Cookie:drawing3@mediaplex.com/ ] C:\USERS\DRAWING3\Cookies\F1RU0NHR.txt [ Cookie:drawing3@serving-sys.com/ ] C:\USERS\DRAWING3\Cookies\53T8TQ0U.txt [ Cookie:drawing3@ad.yieldmanager.com/ ] C:\USERS\DRAWING3\Cookies\Q2Z2Q5EK.txt [ Cookie:drawing3@www.google.com.au/accounts ] C:\USERS\DRAWING3\Cookies\1YUML058.txt [ Cookie:drawing3@fastclick.net/ ] C:\USERS\DRAWING3\Cookies\TKD3MT1H.txt [ Cookie:drawing3@statcounter.com/ ] C:\USERS\DRAWING3\Cookies\S5YBX3GR.txt [ Cookie:drawing3@imrworldwide.com/cgi-bin ] C:\USERS\DRAWING3\Cookies\MHNEW4Y2.txt [ Cookie:drawing3@legolas-media.com/ ] C:\USERS\DRAWING3\Cookies\V7LCDHTC.txt [ Cookie:drawing3@apmebf.com/ ] C:\USERS\DRAWING3\Cookies\0Y20E032.txt [ Cookie:drawing3@accounts.youtube.com/accounts ] C:\USERS\DRAWING3\Cookies\J2C4UZ0Z.txt [ Cookie:drawing3@accounts.google.com/ ] C:\USERS\DRAWING3\Cookies\9AO47PXP.txt [ Cookie:drawing3@bs.serving-sys.com/ ] C:\USERS\DRAWING3\Cookies\NSMJ2VJ2.txt [ Cookie:drawing3@adxpose.com/ ] C:\USERS\DRAWING3\Cookies\SB87EQKW.txt [ Cookie:drawing3@casalemedia.com/ ] C:\USERS\DRAWING3\Cookies\HPN7KZ2W.txt [ Cookie:drawing3@c.atdmt.com/ ] C:\USERS\DRAWING3\Cookies\UBMIMP3G.txt [ Cookie:drawing3@doubleclick.net/ ] Trojan.Agent/Gen-Koobface[Bonkers] C:\USERS\DRAWING3\LIESBETH\ROOT\PLANIT\WOODWIZARD\WWIZHRI.EXE C:\USERS\DRAWING3\LIESBETH\ROOT\PLANIT\WOODWIZARD\WWIZSND.EXE ------------------------------------------- It has removed them from the computer now, so all is good? I'll try the free online scanner next as well.
...See More
big_al_41
11 years ago
Hmmm... wonder why MSE didn't catch it ?????????
ravencajun Zone 8b TX
11 years ago
because it is not a virus and many AV programs don't stop those which is why it is so important to have programs like malwarebytes and superantispyware.

But let me caution you about clearing out restore points, we no longer recommend doing that and the reason why is should something drastic happen you now have no restore points to use, even an infected restore point is better than none, plus restore points fall off with time, the old ones drop off as each new one is added. When we do a clean up in the help forums the very very very last step we do when we are absolutely sure there is no trace left of the infection after many many various scans and logs is then clear restore points. But it is not always done.
It was learned the hard way by many that quickly clearing restore points left you with nothing, an infected one can be cleaned but none leaves you with a reinstall more than likely.

so please keep that in mind!
I personally would like you to go to LzD and run some scans and logs to make sure every bit is gone because in most cases there are remains that need to be cleared out.
Analysis and Malware Removal
If you register and post there the team will be happy to help you check
mxyplx
Original Author
11 years ago
Ok. Good point about backup points and I did consider all that before acting. I wasn't to concerned about wiping off all the points because I've only had this comp a short time and everything is backed up or have copies. In fact a lot has not been copied to this new comp yet, maybe never will be. Not much to lose xcpt time if a complete reinstall was required. In 20 years I've only did one restore that I can recall.

Running Super Anti Spy I did their deepest scan which supposesdly cleaned out the registry. I just now searched the registry and found some apparently related entries. Didn't check em out tho.

Will check in at LZD tomorrow.
big_al_41
11 years ago
But Raven, I thought MSE was also a malware checker. Isn't it ??
zep516
11 years ago
Hello,
big al 41

That does not mean it's going to catch everything, it depends on the Anti Virus Definition files, the files you up-Date with. It's impossible for every Anti Virus to keep up with all the Malware.

Anti Virus programs all of them, are insurance policies, not brick walls.

Joe

Trojan.Agent/Gen-killfiles

Comments (7)

mike_kaiser_gw

mxyplx
Original Author

Related Discussions

big_al_41

ravencajun Zone 8b TX

mxyplx
Original Author

big_al_41

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Trojan.Agent/Gen-killfiles

Comments (7)

mike_kaiser_gw

mxyplxOriginal Author

Related Discussions

big_al_41

ravencajun Zone 8b TX

mxyplxOriginal Author

big_al_41

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

mxyplx
Original Author

mxyplx
Original Author