HJT log, "avagnt.exe" what the???

[nsomnius]

Having issues with norton. CPU goes hogwild after manually scanning once in a while so ran highjackthis and see this entry for:
C:\WINDOWS\system32\avagnt.exe -

- I googled avagnt.exe and got a big fat nothing.

Please take a look at the attached log file. Any insight is very welcome!
Incidentally, norton system scans reveal a trojan but cannot deal with it, and it doesn't show up in a2anti-malware.

- Thanks all

 

[howard_hopkinso]

Hello and welcome to Techspot.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Chaos Manager 2

Close control panel.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

avagnt

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

avagnt.exe
cm2.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.zonelabs.com/store/content/support/userForum/userForum_agreement.jsp
O4 - Startup: Chaos Manager loader.lnk = C:\Program Files\Chaos Manager 2\cm2.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O23 - Service: avagnt - Unknown owner - C:\WINDOWS\system32\avagnt.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\system32\avagnt.exe
C:\Program Files\Chaos Manager 2<Delete the entire folder.

Reboot into normal mode, turn system restore back on and rehide your protected OS files.

Post a fresh HJT log and let me know how your system is running.

Regards Howard :wave: :wave:

This thread is for the use of nsomnius only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nsomnius]

I'm on it Howard, thank you. Will post new hjt log when ready. I use Chaos Manager 2 on several computers without issue, it's my personal information manager software, is it a known problem? I recognize and rely on it, so I'm very curious about this.

 

[howard_hopkinso]

The only reason I told you to get rid of Chaos Manager 2\cm2.exe, is because of THIS.

If you still wish to keep it, then by all means do so.

Regards Howard

This thread is for the use of nsomnius only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nsomnius]

Ouch, CM2. It looks as though the file name is adopted by another source, rather than Chaos Manager 2 is malware, my prophylactic programs never reported any misbehavior on it's part...???

I went ahead and did what now appears to be half the job, in the present light. I left one other item, the Digital Line Detect, which is a DELL fax utility to acknowledge incoming faxes. It's rarely connected to a modem but want to retain that functionality, unless doctors orders are to remove it too. The pesky avagnt.exe is now gone it appears. I thought it might be part of AVG which I installed on my wife's machine, but her's shows no such devil. Curiously, when I tried to stop the service, the options were greyed out, although it was listed as running. I disabled it there, stopped it in Task manager and deleted it as per instructions. The machine seems a bit snappier already, I hope thats the end of that nonsense. Your help is tremendously appreciated, I was looking at a plunge into reformat, reinstall never-finished-land. Thanks a million!!!!!!!!

 

[howard_hopkinso]

Your HJT log is now clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of nsomnius only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.