RTKT/Agent.aagg

[oao]

We have a lptop running vista and Avira's AntiVir.

Today an AntiVir scan claimed it found a RTKT/Agent.aag. It offered to clean after next boot, but then it said it could not due to locking.

I rebooted, installed your program and ran a scan which found nothing.

I tried to rescan with AntiVir and the system crashed during the scan.

Avira instructed me to run a scan in Safe Mode after turning off System Restore.

But when I tried the computer would not boot after 2 attempts at Windows repair. The reason was:

Boot critical file c:\windows\system32\drivers\wvnmdsng.sys file is corrupt.

This is the file that Avira identified as infection.

Pls advise.

Thanks.

[sjpritch25]

When you get to advanced menu option by pressing F8, please select Last known good configuration.

Download GMER Antirootkit Here, click on Download EXE and save to your Desktop

• Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver
  
• Double-click Gmer.exe to run the program.
  
• When the program opens, click the "Rootkit" Tab
  
• On the right-side, check all the items to be scanned, but leave "Show All" unchecked
  
• Select all drives that are connected to your system to be scanned
  
• Click the Scan button
  
• When the scan is finished, click Copy to save the scan log to the Windows clipboard
  
• Open Notepad or a similar text editor
  
• Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
  
• Save the gmer scan log and post it in your next reply.
  
• Close Gmer
  
• Open a command prompt (Start | run |type cmd and hit Enter)
  • Type or paste the following to unload the gmer driver:
    
  • net stop gmer
    
  • Hit Enter
    
  • Exit the command prompt.
    

  [*]Re-enable all active protection.

[Fatdcuk]

Hi i am locking this topic as the original poster appears to have got assistance and remedied at another forum.

http://forum.avira.com/wbb/index.php?page=...threadID=104482