Member Avatar for kriskarrera

Hi,
I have a trojan on my computer at: C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\6JYZY5CX\DLL2_0001[1].BIN

It's called: The Trojan horse TR/Scagent.DLL.C

My Antivir software found it but cannot delete it or even put it in quarantine.
I searched for "Scagent" on here but there was no results.

I've run Ad-aware, spybot, CW shredder..... but with no luck.

Does anyone know how to get rid of this evil little thing?

  • 3 Contributors
  • 4 Replies
  • 229 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by kenji1

Dani AI

Generated

Short, practical summary for the thread: the detection TR/Scagent.DLL.C is part of a persistent trojan family that commonly installs as a Windows service (often named "Security Agent" / scagent.exe) and drops IE/HTTP filter DLLs (examples seen as httpfilter.dll / digfilt.dll). That combination explains why an on‑access scanner reports the file but cannot delete it — the malware registers a service and loads DLLs into running processes. (systemlookup.com)

Steps to try in order (work from a clean, offline environment — unplug network first): stop and disable the malicious service, remove its registration, then delete the files and any IE filter/CLSID entries. Use Services (services.msc) or the Service Control utility, then delete the service (or use HijackThis -> Misc Tools -> Delete an NT Service if preferred). Example commands (run elevated command prompt): 

sc stop scagent
sc delete scagent
ipconfig /flushdns

After service removal, remove associated DLLs and O18 filter entries and clear Temporary Internet Files; then reboot to Safe Mode and re‑scan. Sources show the scagent family is removed this way in many cases. (geekstogo.com)

Tools and fallbacks: use Sysinternals Autoruns to find and disable leftover startup/Run/Service/IE entries, and Process Explorer to locate which process holds a file handle so it can be closed (or the handle freed) before deletion. Run up‑to‑date on‑demand scanners (Malwarebytes/AdwCleaner, ESET Online Scanner) and, if the files remain locked or the infection persists, boot a clean rescue environment (for example Kaspersky Rescue Disk) to remove files offline. (learn.microsoft.com)

If these steps fail or many system components are damaged, a full clean reinstall is the safest route — back up personal data first, change passwords from a clean device, and restore only after reinstall and full patching. Note: already tried Safe Mode and standard cleaners; ’s CWShredder/temp cleanup is a useful early step but this family often needs the service/key removal + offline scanning described above; ’s pointer to an AV removal doc echoes the same idea of using vendor tools. (dell.com)

If desired, post an updated HijackThis/Autoruns snapshot (remove any personal paths) after trying the service deletion so the remaining startup entries can be identified precisely.

Recommended Answers

All 4 Replies

Member Avatar for kriskarrera

It occured to me to log in on SAFE mode and delete it, which I did, but now it's still here!

here's my hijackthis log:
Logfile of HijackThis v1.98.0
Scan saved at 16:02:33, on 8/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\scagent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\simple1.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AVPersonal\GUARDGUI.EXE
C:\Documents and Settings\Kriskarrera\My Documents\My Pictures\Utilitys for copying to CD\Hijackthis version 1.98\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-gb\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetsrv\services.exe
O4 - HKLM\..\Run: [ist service uninstall x] C:\WINDOWS\simple1.exe /u
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetsrv\services.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AEA3B5F-ADCF-4D63-82F8-EB3F08A3B516}: NameServer =

Member Avatar for kriskarrera

:sad: Can no-one help?

Member Avatar for crunchie

Download CWShredder from here & run it. Select the fix button & it will fix everything related to CoolWebSearch that is stored in it's database. Close ALL windows, including Iinternet Explorer, before running CWShredder. Reboot.

To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.

Clear out your Temporary internet files and other temp files.
Go to Start > Settings > Control Panel >Internet Options.
Under the General tab click the Delete temporary internet files,
delete all Offline content as well. Clear out Cookies.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

This one too if Win2K or XP.
C:\Documents and Settings\username\Local Settings\Temp\

Empty the Recycle Bin.

Reboot after doing this & post another log please.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.