Re: Downloader-VA trojan??????
From: number1 (number1_at_blazemail.com)
Date: 17 Feb 2005 08:29:21 -0800
I had been fighting this same problem for the last several days, and
finally found the solution. This trojan seems to attach itself to
Internet Explorer as a helper program, and then when you launch IE, it
reinfects your computer. McAfee does detect the virus, but it does not
disinfect properly, at least it didn't for me.
First, be sure to turn off System Restore, because you will be deleting
some dll and sys files, and they may get restored automatically if you
Second, get a copy of the program StartupList from
You'll find it in the section labelled "Official Downloads".
Then, run the program. It will give you a lot of information about
programs that are starting up when your computer boots. Most of the
info you can ignore. Look for the section about Browser Helper Objects.
Here is what I found on my computer:
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat
(no name) - C:\WINDOWS\system32\xxculexp.dll -
(no name) - C:\WINDOWS\system32\cdafzfyu.dll -
In my case, I deleted the two strange programs xxculexp.dll and
cdafzfyu.dll. I suspect that the names are randomly generated, so yours
will probably be different.
Then, check the Microsoft article at:
and delete files that it refers to that you find. For example, I had
msupd6.exe, as well as cjoxroft.sys, and deleted those. Again, the
names assigned to your particular version of the trojan are probably
Finally, go into Regedit, and delete any instances of any programs that
are like the ones that you deleted. So, I deleted any keys that
referred to xxcuplexp.dll, cdafzfuy.dll, msupd6.exe, and cjoxroft.sys.
Now, close Regedit and reboot the computer. Restart IE, and make sure
everything now works normally. Then turn System Restore back on.
Good luck. This seems to be a very nasty one.
> Since a few days I get a warning from my
> virusscanner McAfee that the file:
> was infected bij the downloader-VA
> trojan. It occurs everytime I start
> my internet or my mailprogram.
> I could not find where it comes from.
> Please, does anyone know a solution
> for me? Where can i remove it permentley?