Backdoor Attack: Win32.Agent.olt

[Mark Tan]

Hi guys,

Need help on this matter please.

I need solution ASAP:

Findings:
It will hang-up the system
File Sharing is affected
Access to the machine infected with the virus will not be
available

[Jinx]

Win32.Agent is an adware trojan program that downloads unwanted software. When Win32.Agent launches, it copies itself to %WINDIR%\System32 under a random name and it will launch each time Windows is rebooted on the user's computer.

Step 1 : Use Windows File Search Tool to Find Win32.Agent Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "Win32.Agent" file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "Win32.Agent", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Win32.Agent in the following manual removal steps.

Step 2 : Use Windows Task Manager to Remove Win32.Agent Processes

1. To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
2. Click on the "Image Name" button to search for "Win32.Agent" process by name.
3. Select the "Win32.Agent" process and click on the "End Process" button to kill it.
4. Remove the "Win32.Agent" processes files:
5. sskupdater.exe ssk.exe sskupdater.exe5102.exe ssk.exe 5102.exe



Step 3 : Detect and Delete Other Win32.Agent Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
2. Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
3. To change directory, type in "cd name_of_the_folder".
4. Once you have the file you're looking for type in "del name_of_the_file".
5. To delete a file in folder, type in "del name_of_the_file".
6. To delete the entire folder, type in "rmdir /S name_of_the_folder".
7. Select the "Win32.Agent" process and click on the "End Process" button to kill it.
8. Remove the "Win32.Agent" processes files:
9. sskupdater.exe ssk.exe 5102.exe