Trojan horse.... and windows reinstall

[JurasicJet]

Hey guys... you have been such great help in the past I thought I would try this forum again, since I haven't had much help anywhere else. This might be a little lengthy.

I had a trojan horse or hijacker that was installed on my computer a few days ago (it was the wwwcoolweb one, or some variant I think).
I had downloaded a zip file, scanned it with avast which said it was clean, but when I opened it all hell broke loose. Apparently anti-virus cannot detect malicous programs when they are zipped.

Anyhow.. I ended up reformatting my hard drive because it was completely out of control, and I did not want to hook up to the internet (I unplugged the DSL cable as soon as I saw what was going on) becuase I was not sure what type of info was going out on the internet.

I have MS XP Pro SP 2, which I tried to re-install (clean install). However, it hung when a number of files would not load. So.. I installed my plain old XP Home (no SP2 in that one). It loaded fine. Then I tried to install Pro (upgrade option, which worked great before) and it hung again. If I ignored the files (press ESC) it would load and everything appears to be running normally.... EXCEPT Windows will not do automatic update. Hmmmm.
Here is the list of files that Pro will not load...
Agt0406.dll
Agt040b.dll
agt0410.dll
agt0414.dll
agt0416.dll
agt041d.dll
agt0c0a.dll
afgins.dll

agentctl.dll
agentdp2.dll
agentdpv.dll
agentmpx.dll
agentpsh.dll
agentsr.dll
agentsve.dll

advapi31.dll
ahui.exe
afd.sys
agentanm.dll

Also, I get a dialog box during Pro install that says agtscrpt.js_ not found, even though i can see it on the Pro disk.

Any thoughts?
I am/have run CWShredder, Spybot, Ad-Aware and Avast and they all come back clean after the format.

Is there a way to install these dll files into the system32 folder, or am I asking for trouble. If so, what is a SAFE dll website.

Like I said, the computer seems to be running normally and I have had no compatability issues, other than the update portion. I found that a number of these files are related to the WIN_10.cab file, but that doesn't tell me much (im not a programmer ;)

Sorry for the long post but any help you guys can give me I would appreciate :D

I may not get back to you right away becaue we are going out of town for the rest of the day.... thanks.

Jet

[BipolarBill]

My first thought is to tell you to stick with Home. You don't need Pro.

There are no CAB files in XP setup and I've never heard of most of the DLL files you are describing.

Is this a genuine undamaged XP Pro CD or a copy?

[JurasicJet]

Thanks Bipolar for your reply. I am thinking about doing a recover mode on the Home version and see what happens.

LOL.. the second part... let me say it is undamaged. It has been used previously and worked like a charm. Thats why this thing is so baffling to me.

[Rocketmech]

Apparently anti-virus cannot detect malicous programs when they are zipped.

Not true , most AV's can scan inside the archive , but some cannot do anything with it until you unpack it. If you unpack an archive to a directory manually it should not execute any file unless you open it. You must have executed (opened) a self extracting archive which unloaded its payload . You need to make sure your AV is configured for scanning inside archives and use better discretion who or where you download from .

FWIW , you can make a slipstreamed XP Home SP2 CD for next time or for repair ...
http://www.simplyguides.net/guides/using_autostreamer/using_autostreamer.html


Also, I forgot to add ... test your ram and hard drive Tech Tools (http://www.sysopt.com/forum/showthread.php?t=173743)

[BipolarBill]

I'll never figure out why people feel that they need XP Pro. Is it the "cool" factor? It's not worth paying for and it's certainly not worth pirating.

[bonz_dragon]

I'll never figure out why people feel that they need XP Pro. Is it the "cool" factor? It's not worth paying for and it's certainly not worth pirating.
Still late to the show and still using W2K and Win98se. Though I'll upgrade someday, maybe!

[mireland]

I'll never figure out why people feel that they need XP Pro. Is it the "cool" factor? It's not worth paying for and it's certainly not worth pirating.


xp pro really is meant for computer/network geeks such as myself..LOL! :D

[Sterling_Aug]

Hey Mire: I resemble that remark!

[JurasicJet]

Thanks everyone for the replies. Some good information as usual from this site.

If you unpack an archive to a directory manually it should not execute any file unless you open it. You must have executed (opened) a self extracting archive which unloaded its payload

Rocketmech... Yeah, I opened it directly . I missed the step about unpacking to a directory. Also.. the streamlining link looks very cool and I am definitely going to give that a try. THank you!

Jet

[crapyking]

Seems like everbodys computer w/ home version of XP gets all bogged down w/ junk. I reinstall the XP pro & customers are much happier. If anybody does a clen install & formats the hard drive I don't see how there can be a trace of any virus. install avg free ,SP2 (oh yes), & adaware se & they should be set! Oh yea -MERRY XMAS

[BipolarBill]

If you reinstall anything and teach the customers anything at all, they will have less trouble. Don't be silly.

Tell me, genius - what are the actual differences between Home and Pro? I can tell you that they have nothing to do with viruses and spyware. Please don't spread BS in our forums.

Don't even think of telling me anything about the two. I'm the MCSE/MVP here. I know. I'm certified to know.

So - you're selling these people a $200 upgrade that they will never be able to make use of or are you installing a pirate version of Pro?

Merry Christmas to you too.

[crapyking]

Don't be such a bully Bill. I was just stating an opinion, not trying to "sell" the customer anything. :eek:

[BipolarBill]

Unfortunately, your opinion is based on misconceptions at best and ignorance at worst. You made the satement in your post title that Home is junk. That's opinion that sounds like fact. I deleted that.

As a matter of fact, it's much easier to mess up XP Pro thanks to the Policy snap-ins. Home doesn't have that ability and prevents people from committing hari-kari.

You haven't answered my question. Did you sell these people a $200 upgrade or did you give them a "free" version of Pro?

[mireland]

Unfortunately, your opinion is based on misconceptions at best and ignorance at worst. You made the satement in your post title that Home is junk. That's opinion that sounds like fact. I deleted that.

As a matter of fact, it's much easier to mess up XP Pro thanks to the Policy snap-ins. Home doesn't have that ability and prevents people from committing hari-kari.

You haven't answered my question. Did you sell these people a $200 upgrade or did you give them a "free" version of Pro?


I think either Home or Pro will work just fine for a home user...is there more things in Pro a user could mess up..possibly, but I really doubt a typical home user could tell the difference.. :t

[genesound]

:eek:

[BipolarBill]

I've been using XP Home on this PC for 3 years. I don't even "need" Pro.

[zybch]

Nor do most ppl, however Pro does seem to have some sort of added idiot proofing compared to Home, and Server 2003 and X64 (based on 2003) certainly does.
I see far more Home installations screwed up than Pro ones, even from the same people who have let the same trash install through P2P etc as they did in their Home installs.

Being an MCSE/MVP means bugger all in the 'real' (non corporate) world, you should know that.
Congratulations, you got some bits of paper you can hang on the wall, but you of all people should know that the real world with real people is far different from what you learn in order to gain MS certification.

I sure wouldn't trust an electrician to wire up my home if he had no practical experience in wiring houses up but had read a few books and scored an A on a written test about house wiring.
Its the same with tech certifications. I've known people with lots of them, MCSE etc and most of them I wouldn't let anywhere near my PC. I have the MSCE 'manuals' myself, and they certainly don't cover even 1/5th of the problems I see week in week out with people's PCs.
I still can't find the section about viruses and Spyware anywhere in the MCSE certification, and these things cause far more problems in real life than the majority of the stuff covered by the MCSE certification do.
In the corporate world this might not be the case, but for the average home user and the problems they get themselves into, most certifications are pretty worthless because home users don't use their systems the way that the software engineers who wrote the stuff designed them to be used.

[BipolarBill]

I shouldn't respond, but I will.

My certifications are not the foundation that my skills are built on. In my case, they are simply "icing on the cake". I prove my skills every day here. The certifications only verification that I passed the tests, which should tell you that I know at least a little about IT.

As far as Pro being more idiot proof than Home, that's balderdash. They both require proper login and use the same kernel and feature set. All Pro does is offer dual CPU support, domain support, closer policy management and file encryption. The average Joe has no use for those features and wouldn't know what to do with them anyway. It can't handle any more RAM. It's no faster than Home. It's no "cooler" than Home. It's truly made for "pros" and IMO, very few of our members even qualify as pros - much less "mom and pop".

What you're seeing when you service a user with a Home setup that's hosed is simply inexperience. Once someone comes in to clean the mess and instruct the user, it doesn't matter what you leave them with - they won't need as much help in the future.

Also keep in mind that Home outsells Pro in the retail market about a 6:1 ratio. Naturally, more peopke with problems are running Home because more people are running it. Don't blame the OS. Blame the user.

[BipolarBill]

Um, we've hijacked this poor guy's thread. I'll reopen it if JurrasicJet PMs me.