Win32/Agent.ODG virus in memory

Acer / 5620
March 21, 2009 at 03:36:59
Specs: Windows XP, 1024
Im running Xp SP2 on an Acer Laptop. I have a win32/Agent.ODG virus in memory. I have eset nod32 installed, and run scans from under the normal boot, safeboot and ran eset from the command line. No files are found, but when rebooting eset pops up and says the virus is in memory. Any ideas where I should be looking for this?

I cant run malwarebytes, spybot s&d etc, they just don't start, but do install in safemode.

any help greatfully received

See More: Win32/Agent.ODG virus in memory

Report •

March 21, 2009 at 04:11:44
Create Rescue Disc from nod32 and full scan your system!
or write here

Report •

April 1, 2009 at 08:42:09
use fixwareout (475KB) to destroy this agent-virus. This Program reboots your Windows and clean it. Internet connection for update is helpfull.

Greetings from Germany

Report •

April 2, 2009 at 12:34:32
I have the same problems.. solved the 'cant run cleaner tools' by renaming the exe file to something else ( MS Malicious removal tool mrt.exe to help.exe) tools will run. Unfortunately im still trying to remove it from memory.. soon as i get it out - i'll repost

Report •

Related Solutions

April 2, 2009 at 13:16:43
I fixed it using GMER

took about 10 minutes and was clean as a whistle afterwards


Report •

April 2, 2009 at 13:34:50
~*Update*~ I've cleaned mine also.. but with Ccleaner, Malwarebytes Anti-Malware and MS Malicious Removal Tool. Nod32 scan didn't detect it in resident memory. Good luck.


Report •

June 6, 2009 at 15:28:50
Fixwareout (found above) seems to have worked (NOD32 had detected but could not remove the threat) - Followed up by running GMER ( and killing the red-highlighted items per instructions on the site. This seems to have worked (for now). I've bookmarked this thread and will post any more information as it comes my way.

THANKS THANKS THANKS for the Fixwareout and GMER links.

IF YOU GET "PERSONAL ANTIVIRUS" on your computer, IGNORE all the bullcrap links that tell you that Malwarebytes will fix it (if you read through the links you'll find it's all the same article) Malwarebytes AV will NOT fix it. It won't even run on a system infected with this. "Personal Antivirus" will block the execution of SpyBot Search & Destroy (even in safe mode prompt only) and doesn't show up on an AVG scan once the system is infected.

Had not tried AVG's anti-rootkit, although a trial version is available and has good recommendations.

Greetings from Florida

Report •

Ask Question