How do you get rid of the Trojan horse Downloader Agent P virus when AVG can detect it but cannot heal or remove it?

Answer 1

A Trojan horse has infected your system. For a user like you this really sucks. But I can help you. It seems like the author of the malware has incorporated the abilities of spyware and viruses. This combination is deadly for a system. By what you have said I take it that your internet connection still works. So instead of searching the internet for software that may have malware in it I would go to trendmicro.com and run housecall. Housecall will search the componets of your system to find active malware. The Trojan is still working so trendmicro will definitely find it. Once it finds it it will attempt to restore the damaged files, delete the Trojan, delete the file, quarintine the infected file or deny the Trojan access. This is the best solution in my opinion because the site has got it down to a science.

There is another solution but it will cost you around sixty bucks. You could go out and by a rescue CD that would attempt to heal your system.

Good luck,

Computer Guru

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

Here's what I know about "downloader.agent":

1/ The file-name extension (after the 2nd decimal point)varies. Such as "Downloader.Agent.A", "Downloader.Agent.AS", "Downloader.Agent.MM", etc. So far I've found at least 50 different extensions.

2/ It creates the file "Kernell32.exe" in Windows, which is NOT a Microsoft Windows file. This file over-writes your main Dynamic Link Library file, (Kernell32.dll), which controls memory allocation for programs, ability to display images, and browser functionality.

3/ It alters the files: "Autoexec.bat", "Config.sys", and "Command.com". These are the critical files to start your machine.

4/ It creates a directory from the C:\ prompt called: "_restore\temp". You will find hundreds of files in here with a ".CPY" extension, which are NOT part of Windows. It is a log of your activity which is transmitted to someplace called the "Kazaa Network" through Outlook without your knowledge everytime you logon. If you're on DSL, you are transmitting constantly without knowing it. This is what slows down your page loading and prevents you from using icons on your desktop.

It also creates a sub-folder in Windows called "Plaxo". (C:\Windows\Plaxo). In here, you will find more CPY files, and a file called "Plaxo.Log". If you view this file, you will see a record of every single thing you've done since inheriting the virus. To view it, open your MS-DOS prompt, change the directory to c:\windows\plaxo , and then type in TYPE: PLAXO.LOG|MORE

(the | is the "pipe" sign above your backslash which lets you view the file one page at a time.)

By viewing this file, you can pinpoint the date/time you caught the virus.

It is impossible to delete the infected files, since they are in use by Windows and access is denied. Even if you change the properties of the files to delete them, Windows will not work properly since key-Windows files have been altered.

The only answer I've found so far to get rid of it, unfortunately, is to save all your user files on floppys or burn them to a CD, and RESTORE Windows from your Restore disc of Microsoft Windows disc.

I repair PCs, and have worked on more than a dozen machines in the past month all with this same problem.

Hope this helps.

Bob

Right ok bob im no computer whizz i had one of these Trojan downloaders you are talking about, burn all your files from your computer then restore it, what are you talking about all i did was run avg free then quarentined it and then ran malwere bytes and all traces of the virus has gone.

so there is no need at all to fully restore you computer or anything like that