AVG Support Community
Share tips and solutions on AVG Products
Community topics
AllAVG Gurus
These community experts are here to help
-
Alan Binch
-
Borislav Angelov
-
Vladimir Bartl
-
Subhadeep Kanungo
-
Miloslav Serba
Chris Platteel Trojan horse Agent5.AETS infection
I also got the Trojan horse Agent5.AETS infection on my WinXP Pro SP3 from AVG Internet Security 2014.0.4830 this morning. Have been working for several hours to determine what it is and try to clean it. Followed recommendation to Repair the AVG program, but then it reboots with a required fix to the Web Browsing module. When updated, the infection is there again!!!!!!
Almost took the laptop to Staples and would have spent $99 or $169 for cleaning, but held off when I noticed the recommended procedure on this Community Forum. HELP?
Almost took the laptop to Staples and would have spent $99 or $169 for cleaning, but held off when I noticed the recommended procedure on this Community Forum. HELP?
Thanks for this.
I started this day with AVG Internet Secuity 2014 and during a scan I got my first of many blue screen fatal error warning C000021a. After several attempts to repair on my own I tried an other tack and I downloaded from the official AVG website Internet Secuity 2015 thinking that it would over right the error.
Now every time I try to run a virsus scan it crashes at 20% - same as with 2014. Now that I'm expecting the crash at 20% I noticed that my AVG dashboard tells me there are 5 threats that were not there yesterday.
I followed the control panel cnahe/repair and had AVG run a repair action but the same crash at 20% still occurs - this is frustrating.
Whwn I do a full computer scan and it detects the viruses it reboots the computer with out finishing the scan. I did a full scan in safe mode and this is what it shows:
c:\WINDOWS\system32\winlogon.exe (272) Trojan horse Agent5.AETS
c:\WINDOWS\system32\services.exe (316) Trojan horse Agent5.AETS
c:\WINDOWS\system32\lsass.exe (328) Trojan horse Agent5.AETS
c:\WINDOWS\system32\svchost.exe (484) Trojan horse Agent5.AETS
c:\WINDOWS\system32\svchost.exe (580) Trojan horse Agent5.AETS
c:\WINDOWS\explorer.exe (864) Trojan horse Agent5.AETS
c:\Program Files\AVG\AVG2015\avgui.exe (1108) Trojan horse Agent5.AETS
c:\Program Files\AVG\AVG2015\avgscanx.exe (1508) Trojan horse Agent5
Searching for help on how to remove the trojan, I came across the following webpage offering download of an automatic Agent5.AETS removal tool: http://www.removeviruspc.com/remove-trojan-horse-agent5-aets-infection-quick-solution-to-remove-trojan-horse-agent5-aets/
Since I'm not sure this is legit, I'm afraid to try it! But if anyone else wants to...
OR is there a way to check if the above webpage is legit??
I am running the free version of AVG 2015.
I am running AVG Anti Virus Free
AVG version 2015.0.6086
Virus Database Version 4409/10507 (Tuesday August 25 2015, 4:12AM)
by the way AVG guys - it would be nice if the about page "project" tab put all of the information in a window which could be copied like the Program tab so that everything could be copied easily.
I get the same agent5.aets error only on the process scan. no threats were detected when I did a full scan ending 8/23/2015 11:56:49 but the next post update memory scan (the next morning) on 8/24/2015 09:14:05 reported 29 errors. a full scan done earlier today reported no file problems but 28 errors. it looks like every one of them is loading the WINDOWS\SYSTEM32\ws2_32.dll file (I have not actually confirmed this) and it looks like all of them are in my system tray or are some kind of system process. the entry on display shows a "\memory" after the entry too. every error shows the main process followed by a line with the ws2_32.dll file included and both lines show the agent5.aets virus
If I was to make a guess (and it is just a guess) I suspect that the memory scan is detecting something in this dll which is causing it be reported for every process that is using the dll.
a suggestion for the AVG developers (not sure if this can be done easily) but perhaps as part of the process scan it might be a good idea to scan the loaded dll files and report them as a separate entry (loaded dll xyz.dll has virus abcdef.12345 for example). if you are detecting it as part of the scan for the entire process it might be helpful to detect it as a separate step.
I do not check my email at the address used here as often as I check my regular email so I may be slow to respond to requests for additional information.
and as long as I am reporting things the free version "scan results overview" is a pain to cleanup because the highlight on the entries I want to remove is an "almost black" background on top of a "black" background and is very hard to see - I cannot find a way to make it more visible (no color settings).
I just updated the virus definitions at about 6:40PM EDT (a few minutes ago) and the post update memory scan no longer reports any errors. I will do another full scan tonight.
newest virus database version is: 4409/10511 (Tuesday August 25, 2015, 2:30PM)
and another thing for the AVG guys: what timezone is that 2:30PM in? showing the timezone would be useful information. was this update done at 2:30PM in my timezone or your timezone?
Standing by for assistance. Richard Roberts
Wade
Thank you for letting us know: I'm currently 'updating' my 2012 Free AVG edition and running a complete computer scan now. According to these posts, it seems to have only affected XP systems. What a pain! I've only been hit with one virus in all my 20 years on computers, and then to get hit with this!
The worrying part is AVG detected an "Inaccessible" object...oh, wait a miniute, my scan just finished....
NO THREATS FOUND! YIPPEEEEEEE!!!!!
Will wait for my scheduled scan again and see what happens, but I think I'm cured! THANK YOU AVG for your prompt aid! Especially in taking care of your free editions~ whenever I can spring for a full package antivirus, I will certainly turn to you guys.
you have a good point! Has the new update from AVG changed the anti-virus scanning to ignore the Trojan horse Agent5.AETS virus, or does the AVG update from this morning actually clean up the startup of the AVG anti-virus programs so that the Trojan horse does not get started.
I do not have another virus scanning program to check if it detects the Trojan horse after The AVG scan reports no such virus detected.
I would like to hear from AVG what this Trojan horse detections were all about and what was done to prevent detection on the last update.
So, is the Trojan horse really gone, or simply lurking underneath if the new update won't "heal" the old scan files?
NUTS!
Apparently, the Trojan was removed with the last update, (despite the old files not 'healing'):
Thisis AVG's response:
"It is to keep you informed that the infections might got removed from your PC during the latest update of the program so you need not worry about it. Please feel free to contact us back for further assistance. Thank you. Kishore, AVG Customer Care."
Good, that thing is gone, now to change a gazillion passwords on everthing just to make sure a criminal idiot isn't getting into my accounts...grrr!
Wade, Have a look @ this link (https://support.avg.com/answers?id=906b0000000DKDAAA4).
AVG Guru