3 replies to this topic

[des3482]

Following a Malwarebyte scan, the results show that "Trojan Downloader" is present. I remove it, and reboot but the next scan finds it again. How can I remove this trojan completely.

[JeanInMontana]

Hi read and follow the instructions here then post a log here . Someone will be happy to help you.

[elphaba]

des3482, on Nov 23 2008, 08:59 PM, said:

Following a Malwarebyte scan, the results show that "Trojan Downloader" is present. I remove it, and reboot but the next scan finds it again. How can I remove this trojan completely.

Same thing is happening on my system. I just noticed that I think I've been removing this same worm for some time. I just didn't notice it was the same one everytime I scan. I read up on it at Symantec and found that it isn't considered a "very dangerous" worm (or virus?) but that doesn't keep me from wanting it removed.

I checked the processes that first come on line when I boot up. lsass.exe is one of them. Seems that this is a legitimate process and not one you want to remove but it also seems that that is one that the downloader trojan hijacks in the process of it doing its thing.

I found info at symantec interesting, maybe helpful. While trying to see what we hear back on this forum, I plan to try some of their suggestions by doing a full scan in "safe mode". Also, by adding the three hosts they specify as common hosts used by the downloader trojan into my hosts file (see www.mvps.org if you want more info on your hosts file). Symantec's virus info on the downloader trojan is at: http://www.symantec.com/security_response/...-011710-3138-99

Even if you don't have the full solution, any hints or tips are welcome. I'm also trying to search this forum for others who have had this same problem, I've gotten numerous hits on "downloader trojan" and lsass , trying to work several paths of troubleshooting at the same time.

[AdvancedSetup]

Hello elphaba and Welcome to Malwarebytes. Just as Jean asked the other user please follow these instructions.



Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.