Help getting rid of this trojan setCrSr.exe w32.agent.agrf

[econtrerasguzman]

i reinstalled the OS in my g/fs PC and installed a couple things, startup inspector, one note(microsoft) and norman, and norman says that there is a trojan at that location c://system32\setCrSr.exe

there is barely any information about it on the web. plz help.

tequilamolotov

[redwudz]

I found quite a bit of information by doing a Goggle search for 'setCrSr.exe'. It appears to be a Trojan and possibly a password stealer, so beware. You could try running Hijack This and see if it can help you get rid of it. Besides the System 32 folder, it may be in the registry. I would disconnect the computer from the Internet and you may want to think about changing any passwords that may be for financial or other sensitive sites.

I'd try the above search first and see what suggestions you find there.

[Wile_E]

I've never heard of "norman" anti-virus. Here are some links to some online Anti-virus programs. Try them and see if they can remove it. Could be a false positive.

http://www.kaspersky.com/virusscanner

http://housecall.trendmicro.com/

[jman98]

AVG (http://www.grisoft.com) is a free antivirus program that might be able to get rid of it.

[ROF]

I thought AVG was trialware?

[waheed]

There are two versions for AVG. One is freeware and the other trailware (which is the pro version).

[ROF]

Where can you get the free version? All I see is Trialware versions and licensed versions.

[steveryan]

http://free.grisoft.com/doc/avg-anti-virus-free/lng/us/tpl/v5

[aedipuss]

avg free -

http://free.grisoft.com/doc/1

[ROF]

Yep. Found that after I posted the question.

[econtrerasguzman]

i looked for the file and tried deleting it, it didnt work, i deleted the registry file for this program and after rebooting the PC it is not there and norman does not detect the virus anymore, why could this be happening and how could i have gotten a virus? i use startup inspector in my PC and have never gotten a virus. thanks for all your help.

[Seeker47]

why could this be happening and how could i have gotten a virus? i use startup inspector in my PC and have never gotten a virus. thanks for all your help.

Most commonly -- clicking on an email attachment that should never have been opened. Or downloading an infected program. Sometimes a rogue website can plant it on you. A decent on-access scanner should detect this right away and deal with it, provided you keep the viral definitions current.
I've heard of Norman AV, but don't know how good it is. The free AVG is pretty good.

[redwudz]

'setCrSr.exe' is also known as 'Trojan.Win32.Agent.rd'.

You could try a free online scan with eiwido: http://www.ewido.net/en/download/

Here is a post from the SpyBot forum on the Trojan: http://forums.spybot.info/showthread.php?t=6151

Good luck.

[econtrerasguzman]

the setCrSr.exe that i had was not detected as agent.rd but as agent.agrf

[MOVIEGEEK]

Windows Live online scanner or AVAST free should get rid of it.