Comments on: TrojanDownloader.xs (trojan-downloader.xs)

By: zesty

zesty — Thu, 21 Aug 2008 04:25:14 +0000

I have a problem similar to those above. Was able to smitfraudfix to get around most of it and I isolated/renamed the files in system32. Ran malwarebytes and AVG. both removed Trojans. I think (hope) that I am in the clear for the Trojan coming back. But I am still having a couple of annoying issues:

1. the “all programs” link is missing from my start menu. so I have no way to access the rest of my programs. it was there prior to the virus so I assume that this was something that it disabled to try to thwart its removal.

2. The “My Computer” icon is now missing from my desktop and when I try to add it back under the customization menu it is grayed out so I can’t select it.

I figure that both of these things are controlled in the registry but I can’t for the life of me find the right keys to change.

Any suggestions/help would be greatly appreciated. BTW, I am running Windows Vista Ultimate.

By: Jeff

Jeff — Tue, 12 Aug 2008 18:45:18 +0000

Amy,

With the level of denied access you have to your PC you have very few choices. If you can put smitfraudfix in a place that is easy to find in DOS, start your PC in “Safe Mode with Command Prompt”. Navigate to where you put the program and run it. Option 2&3 are the only ones you need to run. Answer yes to the questions then quit and reboot. 90% success with just doing that. Of course if that doesn’t work it time to be a slave drive and start an all out find and delete….. all the temp files, startup items, junk programs, should all be eliminated but if your lucky this will free up some function for you. Good Luck

Jeff

By: Amy

Amy — Thu, 17 Jul 2008 14:07:17 +0000

I don’t know if anyone is paying attention to these posts lately..since the last one was posted in June, but I was infected by the trojandownloader.xs 2 days ago and my computer is completely messed up. I have been reading everyone’s opinions and ideas, but I am unable to do any of them.

For one, I still have my normal wallpaper, but it switches on me every 45 seconds to the alert that there is a virus.. I have no desktop icons, no start menu, this web site opened on its own, if I close it, I wont be able to get back in. I have tried downloading spyware removal online and it wont let me download anything onto the comp. I am getting so frustrated. I tried the smitfraudfix, it downloaded but it didn’t do anything, it opened, scanned, I guess? but it didn’t say there was a problem or anything. Can someone PLEASE help me!

By: Kevin

Kevin — Tue, 24 Jun 2008 12:18:04 +0000

Is there another way to change the desktop background with the registry editor? Because I found the desktop and its background with the registry editor but I don’t know which one to delete?
Anyone can help me with that?

By: Nelson

Nelson — Tue, 24 Jun 2008 02:14:49 +0000

Frank and All,
I have Windows XP Professional, some of the files you mentioned could not find in the location you stated. Maybe because I have XP Pro. Would you have a fix for XP Pro? I also have Trojan.downloader.xs and also disabled my task manager. Went to regedit and switch parameters for current and all users to zero and still revert to value of 1. I also disconected my Internet and still revert to value of 1. Thanks.

By: Kevin

Kevin — Tue, 24 Jun 2008 01:49:13 +0000

I changed the ” DisableTaskMgr ” of the Registry Editor from 0 -> 1
but it doesn’t let me change it.

It stays at 1 and does not let me change to 0.
Any solutions?

By: Kevin

Kevin — Tue, 24 Jun 2008 00:25:16 +0000

I got a lot of spyware when I was looking for a lyrics on a website.Then I got this frozen pop-up that I can’t close and all these spyware start popping up saying I am infected.
Like :: CoolWebSearch, TrojanDownloader.xs, Mal ware crap..
I used the SmitFraudFix and the TrojanDownloader.xs still pops up saying infected file.

And also I can’t access my desktop on my profile, it only shows my background.

I cant fix my Ctrl + Alt + Delete to access task manager.
Keeps saying Disable by Administrator.
I can’t open my own ad-aware remover, they want me to download their program which I’m not going to do.

And I don’t know if anyone is still looking at this post. But I would appreciate it if someone helps me.

By: Wade

Wade — Mon, 23 Jun 2008 14:12:05 +0000

Thanks to everyone here for their insight and knowledge.

I made a lot of progress over the weekend. Managed to get rid of most of the corruption and feel somewhat safer using the system now. I think I have all the corrupted applications removed from my Windows and Windows/System32 directories and have my task manager back. And of course the computer runs about 10 times faster. Still believe I likely have a few quirky entries in the registry, but they apparently can’t find the applications to run when I boot up.

One thing that threw me off course when starting to troubleshoot things is that the particular version I had a couple of rogue applications in the Windows/System32 directory, but I also had about 30 or so rouge files with EXE and DLL extensions in the Windows directory. When I would try to remove the files with windows explorer, I would be told they were being used. I could go into DOS and remove them IF I closed explorer first, but they would re-appear a couple of minutes later.

Good luck to everyone in removing this beast.

By: Christie

Christie — Sat, 21 Jun 2008 15:29:15 +0000

It’s good now!
Sorry, I just fixed everything, but with the help of Frank’s notes.
Thanks Frank! I just need a freeware to get rid of the Trojan.Downloader now that I’ve located it..

By: Christie

Christie — Sat, 21 Jun 2008 15:14:46 +0000

Hi! I found out that I have some Trojan downloader on my computer, please help!
At about 10:20 PM yesterday (which was 20/06/08) I was browsing the Internet and clicked on a link, then suddenly the screen went black and when it came up again, I exited out of the Internet and found that the desktop had changed to a blue one with a yellow rectangle box in the middle of the screen saying
“Windows has detected Spyware!
Install an anti-virus or spyware remover to clean-up your computer”

Now, every time I go to change the desktop, there are only the options ” themes” “appearance” and “settings”, so I can’t remove the wallpaper (which comes back on even when I change it after I restart the computer) through the methods everybody here has mentioned.

Also, about every 5 or so minutes or just continuously, the screen goes black again and then a dark blue screen full of writing comes up , saying stuff like

“..windows is shutting down to prevent furthere damage to your computer.
BOGUS_DRIVER
….”
And it always has something like BOGUS_DRIVER on the screen but I don’t know what that means. In addition, there was an anti virus software that somehow installed itself on the computer, that popped up after the blue screen of writing, but I managed to get rid of that, as that was part of this virus

Somebody please help me rid my computer of the Trojan downloader, since I have no idea where it is on my computer, and the black screen-then-blue screen keeps on happening, and the wallpaper is still there too!