how & even CAN i remove this?

I am a Zen customer so dear fellow users can anybody tell me how I can remove a backdoor agrobot which I believe my pc is infested with. Have tried other forums but seems I am asking about unknown beasts?

I do have working anti-virus (F-Prot) and have also tried the full trial version of NOD32 which seems good. Have also of late tried AGV and Avast which both slowed me right down and F-Secure brought me to a total standstill but did obliquely say in its product descriptions that one of its please-pay-for goodies (its AV above a certain version number) could locate and change the file names on robots. Scans with any of these all report the same --- no infections found but not all areas capable of being scanned. Nothing quarantined.

I am guessing but could it be that a remote-controller (turning my pc into a robot) is actually set to delete certain DLL's which are needed to keep my AV running? On the suggestion of F-Prot tekkies I have replaced some dynamic library links which had gone AWOL on my virus signatures. This restored the installation capability of their AV updates but after a week or so the DLL's again succumb. I wonder if the robot has sicked a prog on me that eats these? The updating capability is easily though very tediously made good again by un-installing and then re-installing the F-Prot but strangely this nastiness does not occur with NOD32.....

I suspect the robot is residing in one of those unscanned areas? Some web pages are now blocked by a padlock icon which I imagine is summat to do with Verisign (which I have never asked for but is apparently unremovable & is not being listed as an actual prog). I have tried variations on security settings, internet settings, firewall and --- whatever it may be --- SLL which I suspect may also be involved as hovering over the wretched padlock icon throws up the acronym). I am out of my depth but believe myself compromised. I do not use nor need web-page-blocking for children. Thanx. Bruce +++

Edited by BruceThief37 (Mon 02-Jun-08 17:32:26)

Sounds like a rootkit.

Unfortunately, the best advice is to format the drive and re-install Windows. Don't take a backup - it may be infected. If you have a backup taken before you became infected, you could use that.

You could follow this advice and download and run the revealer program.
http://technet.microsoft.com/en-gb/sysinternals/bb897445.aspx

John.

Agrobot is a trojan worm that will disable your AV and also amend the host file to stop it being able to update... So theres not much point in keep installing other AVs which will only slow your system down further and may cause conflicts.
It also copies itself to random named files which can make it hard to eradicate. It will also be in system restore so you'll need to disable that to get rid completely.

Agrobot's also know as Gaobot by Symantec and the removal instructions are listed here.


Disable System Restore (Windows Me/XP).
Restart the computer in Safe mode or VGA mode.
Restore the Hosts file.
Reverse the changes made to the registry (removing the service and Run keys that the worm added).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Gaobot.gen!poly.




Although you may like to try the Gaobot removal tool here as it will probably be easier for you.

Follow the instructions carefully - so it may be worth either printing off or saving a copy locally... so you can view when in safe mode.


PS what it doesnt say is that it may also be an idea to make sure that your version of windows is up to date since the worm normally enters as a results of an unpatched o/s

-----
One other thought has also just occured - if it has totally messed up your host file, then you may not be able to view the above pages Ive linked to

If so - just holler and Im sure someone will temporarily host them for you so you can download.

Follow Kitz's advise and let me know if you need it hosted elsewhere.

In reply to:

---

Some web pages are now blocked by a padlock icon which I imagine is summat to do with Verisign........

---

If you are using Microsoft Internet Explorer 7, the padlock is only there to advise that the site has a trusted security certificate. You can read more about it here

Is this your only reason for suspecting a virus ? The areas which are incapable of being scanned are usually the areas which Windows uses for its own housekeeping (like for rolling Windows back to a previous date). Even if you do have virus lurking somewhere, a program with a good firewall like NOD32 or Kaspersky Internet Security 7 should prevent the virus from communicating with the outside world.

Bruce, I know you are a "senior citizen", and maybe money is tight, but you should invest �20 to �30 in the most important part of your system - a security package, because if you'd done this when you first had your computer, instead of faffing around with freebies and free trials, you would not be worrying now.

The state of play is this. To Kitz I say a pretty-thankyou so I downloaded and ran Symantec's GAOBOT tool also seemingly known as AGROBOT and it reports GAOBOT is not present but I do believe BACKDOOR AGROBOT is on my puter.......

I downloaded and ran Superantispyware but the first scan failed as a blue StopScreen yet again intervened (I suspect these do not occur when I am off-line). These inform me of a memory problem and a physical dump plus auto reboot, all means nowt to me.

The second scan with the router off I got to 49 minutes, 8564 files scanned, 4 dirty, timer stalled and pc utterly frozen.

My own F-Prot AV tells me there are some areas it cannot scan......perhaps a nasty lurks therein? They also advised me I had some missing DLL's and supplied those needed, inserted via config, and now I can I hold on to the install of downloaded updates instead of that capability being gobbled up after about a week, only re-activateable by un-installing the AV and re-installing. Yes my pc is crook, I am trying to put it right. Yes I probably shot myself in my own foot a way back but am still an OAP whinging invalid.

System Restore got itself turned off and now cannot be accessed except by the administrator it tells me but I am the administrator! Via Properties I found it allegedly to be already turned on, so I re-checked to off, applied, OK'd, re-checked to on, lowered the storage to 800MB, re-applied, OK'd rebooted but still cannot access System restore as I seemingly lack the necessary priviliges.

Windows Search facility is suddenly corrupt. The MS dog wags its tail but no options can be displayed. Have tried the correct forums but am no further forward.

It is not that I am unwilling to spend money on anti-spyware or Registry Cleaner, it is that I don't know who to trust. My problems started when I downloaded antispy from Florida's PCShield who are now the subject of an FBI investigation. My own creditcard firm, just a small one, has two other customers spoofed & generously refunded me my money as PC Shield's refund offer is denied (as indeed its e-mail address etc). I got caught, my own fault

I did run a freebie registry mechanic which told me I had some 750 invalid entries but should I buy same or is that another scam site? Most of these entries begin HK

You wonder why I am shirking a complete windows re-install? Not enough competence 'tis all. Bruce+++

I really think your only option is a re-install. You have so many problems that fixing each one individually would test the ability of anyone, especially people on here trying to do it remotely..

A re-install is not a big deal as long as you have the install disks that came with your PC, driver disks for your hardware, have backed any data that you want to keep to either an external drive or DVD, and have the install media for your applications.

Are we sure it's a virus? Are we sure it's Agrobot? I would think the easiest way of verifying this would be to check the hosts file for suspicious entries.

Maybe it is but, from your post, it's not at all clear why you think it is, and this is a fairly critical point. (You do state that several AV programs and the Agrobot remover have said you're not infected with it.)

When you were trying out the multiple AV programs: did you uninstall each one BEFORE re-installing the next one?

I would not normally suggest this but I would wipe the computer and start again.

Like other have said helping someone with out actually seeing what is going on is very hard, instructions may not been followed etc

Plus if you do find someone willing to help it can be a very long winded procedure and if you are not computer literate then you can cause more problems that you solve and end up very frustrated.