I’ve had an interesting strugle with Downloader-VA. Not that particular problem in the MS KB, but that article suggests steps to take to get rid of the Trojan. The only useful information in that entry is this, Trojan.Win32.Agent.aw, the alias for Downloader-VA from Kaspersky Lab.

From that alias, I stumbled upon these threads. The first explained a registry key, while I didn’t have the exact key entry on this system, I had a similar one which I removed. However, the registry key came back on reboot. The second find, however, mentioned two, well actually three tools which helped fix the problem. eScan’s virus tool, while it doesn’t remove or fix anything in the trial version, does show you a log of locations and files that are infected. SSS also allows you to remove some IE and Windows settings, which I did.

Basically, betwen manually deleting or renaming what eScan found and SSS I might have been safe, but I wanted to be sure, so I broke out the big gun, Hijack This. While a useful tool, it is also very easy to hose a system with this tool as it not only locates possibly spyware hooks, but legit system hooks for valid programs and helpers. However, the common 8 random character filename was in the Hijack This results in about 5 places. I removed these entries, rebooted the system, and the user no longer gets a warning from McAfee when they start Internet Explorer.

I know, I know, the logical fix to this would be to install FireFox, but some of my users are not ready for that step.

Just thought I’d share this in hopes that Google picks it up to help other techs who need help removing Downloader-VA.

This will probably be my next computer purchase, especially since Kevin was able to get into his and do the upgrades with ease.

I’m also wondering if I made the right modchip purchase for my Xbox.