TrojanDownloader.VBS.Agent: what the detection means and how to remove it

What TrojanDownloader.VBS.Agent is, and what it is not

TrojanDownloader.VBS.Agent is a name security programs give to a small piece of VBScript that fetches and starts other programs. It is not one program with one set of effects, and it is not the same thing as the 2006 Windows flaw our 2019 guide tied it to.

1. 1

   What Microsoft says it is

   Microsoft's entry for TrojanDownloader:VBS/Agent.EK calls it "detection for a specific block of trojan VBScript code" that "may download and execute other malicious software". The family has many such entries, each for one block of code, and Microsoft's page for another one, Agent.EE, says only that technical details are not available.

2. 2

   Where the code sits

   Microsoft says the script has been seen "inserted or injected" into existing web pages on various websites, and that it can also sit in a malicious page an attacker built. When the script runs, "any number of malicious actions could occur", including downloading and running programs.

3. 3

   What Malwarebytes adds

   Malwarebytes uses the neighbouring name Trojan.Agent.VBS as its generic detection for trojans written in VBScript. It says the detection fires on the VBScript files themselves and on the ways they are started, such as scheduled tasks and startup entries.

4. 4

   What our 2019 guide got wrong

   It said this malware exploits the CVE-2006-0003 flaw. Microsoft files that flaw under a different detection, Exploit:HTML/MS06014. The old guide also said the malware switches off antivirus and makes registry, task and startup changes; none of the Microsoft or Malwarebytes pages we read says that about this family.

Shown by

Microsoft Defender Antivirus (TrojanDownloader:VBS/Agent.xx), and under other names by other vendors (see the next chapter)

What it is

A script, not an installer: VBScript text that runs in Windows Script Host or in a web page

Job

Downloader: it fetches something else, so the real damage depends on what it fetched

Platform

Windows. VBScript runs nowhere else in this form

Not the same as

Exploit:HTML/MS06014, the detection for the 2006 RDS.Dataspace flaw (CVE-2006-0003)

EtwProviderInstall.vbs and "is this dangerous?"

EtwProviderInstall is the name of a VBScript, ETWProviderInstall.vbs, that appears in the support and logging folder of Windows setup media.

Copies of it are public. It installs or removes Event Tracing for Windows provider manifests so that setup.etl logs can be decoded. It is a Windows setup helper, not a known virus.

Reading a copy of the script, it only works on local files. It reads manifest files in a folder, writes a temporary fixed copy to the temp folder, and runs the built-in wevtutil tool to register or remove them. It does not download anything from the network. That is our reading of one copy, not a verdict on your file.

People searching this name usually met it in a scan alert or a file list, and a script with a script extension can look alarming next to a VBS downloader detection. We found no source linking this file name to TrojanDownloader.VBS.Agent. A genuine copy sits in the support folder of Windows installation media, and the same file name does not prove the file on your PC is genuine.

Is this dangerous? A VBS detection is worth taking seriously until a scan says otherwise, because a real downloader can fetch and start other malware. Check where the flagged file sits, who made it and when.

If it lies in a Downloads, Temp or AppData folder, or arrived by email, treat it as hostile and follow the removal steps above. A quiet scan does not clear a PC.

One family, several names

The 2019 guide said the name is heuristic, so different antivirus engines call the same threat different things. That is true; here are the names we found for the same family.

What we checked on 6 October 2026, and what we could not

There is no site to test and no sample to run: this is a detection name. We read what Microsoft, Malwarebytes and PCrisk publish about it and ran nothing on a PC.

The flaw, the detections and the 2019 guide: 2006 to 2026

Our guide dates from 5 June 2019. The picture is from it; the other entries are dated pages from Microsoft and Malwarebytes.

1. 11 April 2006

   Microsoft publishes MS06-014

   The bulletin fixes CVE-2006-0003 in Microsoft Data Access Components, rated Critical for Windows 98, 98 SE, ME, 2000 SP4 and XP, and Moderate for Windows Server 2003. It was updated on 11 May 2006.

2. 24 May 2007

   First Microsoft entry we found: Agent.EE

   Microsoft publishes TrojanDownloader:VBS/Agent.EE. Its technical details are listed as not available.

3. 12 August 2009

   Agent.EK: script injected into web pages

   Microsoft publishes Agent.EK and says the script was seen injected into existing pages as well as in pages built by attackers.

4. 29 December 2010

   The exploit gets its own detection

   Microsoft publishes Exploit:HTML/MS06014 for the script that tries the CVE-2006-0003 flaw in Internet Explorer. That is the entry our 2019 guide should have pointed to.

5. 5 June 2019

   Our first guide

   The 2019 guide linked the VBS/Agent name to CVE-2006-0003 and told readers to use Safe Mode with Networking or System Restore.

   

6. October 2023

   Microsoft announces VBScript's deprecation

   Microsoft's list of deprecated Windows features says VBScript will be a feature on demand before it is removed from the operating system.

7. 2024

   VBScript becomes an optional feature

   Microsoft's plan says the VBScript feature is pre-installed and on by default in Windows 11 version 24H2, will stop being on by default around 2027, and will then be retired. Malwarebytes updated its Trojan.Agent.VBS page on 29 October 2024.

The CVE-2006-0003 claim, checked

Our 2019 guide said the malware "targets" CVE-2006-0003 and that people who skip updates are the most likely to get it. The first half is a mix-up of two detections and the second half only applies to very old Windows.

We read no source that says how often the VBS/Agent detections fire on current PCs, so we cannot say how likely you are to meet one today.

What a downloader can cost you

The script only carries things in. The risk depends on what it fetched, and Microsoft names none, so these are the usual outcomes of downloaders and the ones our 2019 guide listed.

• High

  Whatever it downloaded

  Microsoft says the script may download and execute other malware. That can be a remote access tool, a password stealer, a coin miner or ransomware; Microsoft does not say which.

• High

  Ransomware

  The 2019 guide named this as the worst case: files locked and a payment demanded in a cryptocurrency, which can mean permanent file loss if there is no backup. No source we read ties this family to ransomware, so it is a possibility, not a finding.

• High

  Stolen accounts and data

  PCrisk lists stolen banking information, passwords and identity theft as the damage of this threat, and says the PC can be added to a botnet.

• Medium

  Remote control

  The 2019 guide said the code could let attackers control the PC. Microsoft's pages do not say that for this family; it applies to what is downloaded.

• Medium

  Security switched off

  The old guide said this malware disables antivirus. We found no source for that, but later downloads often do, which is a reason to scan from Safe Mode.

• Low

  Nothing, if the page was only viewed

  A detection of the script inside a web page may mean your antivirus blocked it before anything ran.

What you may notice, and what the sources say

The 2019 guide said the threat shows no symptoms but listed redirects, crashes, blue screens and a slow PC. Microsoft's two pages say less.

How a script like this reaches a PC

The sources agree on two routes, a web page and a file. The rest comes from the 2019 guide or from PCrisk and is marked as that.

1. 1

   A hacked web page

   Microsoft says the script was found injected into existing pages on various websites. The page you know can carry it without any change you can see.

2. 2

   A page made for the purpose

   Microsoft also says the code can sit in a malicious page an attacker created. The 2019 guide said crooks copy real sites to do this.

3. 3

   An email with a link

   The MS06-014 bulletin describes a crafted email that persuades the user to click a link to a hostile page. It says an attacker has no way to force a visit.

4. 4

   An email attachment

   The 2019 guide said an .html document attached to spam can run the script when you open it, and that .vbs attachments are sent in bulk. PCrisk lists infected email attachments among the ways this threat spreads.

5. 5

   Ads, cracks and tricks

   PCrisk also lists malicious online ads, social engineering and software cracks. The 2019 guide added that adware can send visitors to such pages.

Check your PC before you delete anything

Write down exactly what the alert says. The part after Agent. tells you which block of code matched.

1. 1

   Copy the alert

   Take a screenshot of the alert. Note the full name, the file or web address it names and what the program did with it (blocked, quarantined, removed).

2. 2

   Open Protection history

   In Windows Security open Virus & threat protection > Protection history. It lists what Microsoft Defender found and what happened to it. If the item says Quarantined or Removed, the script itself is dealt with, and the question left is whether it ran first.

3. 3

   Ask what you opened

   A .vbs, .js or .html file from an email, a download from a crack or fake update, or a page you were sent a link to just before the alert is the most likely source.

4. 4

   Look at what starts with Windows

   Press Ctrl + Shift + Esc, open Startup apps and note names you do not know. Open Task Scheduler (search for it in the Start menu) and look under Task Scheduler Library for tasks you did not create. Malwarebytes says VBScript trojans are started through scheduled tasks and startup entries; we have not seen what this family uses.

5. 5

   Look for script files in the usual places

   In File Explorer check Downloads and your Startup folder (press Windows logo + R, type shell:startup) for .vbs files you did not put there.

Remove it from Windows 11 and Windows 10

Do the steps in order and stop when a scan is clean and the alert has not returned. We did not run these steps on an infection; they follow Microsoft's pages.

1. 1

   Disconnect, then copy documents

   Turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.

2. 2

   Start in Safe Mode with Networking

   Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows with a limited set of files and drivers; the 2019 guide used it because it feared the malware blocks the antivirus.

3. 3

   Run a full scan

   In Windows Security > Virus & threat protection > Scan options choose Full scan and Scan now. Microsoft says Defender Antivirus detects and removes TrojanDownloader:VBS/Agent.EE, and recommends a full scan with an up-to-date security product for Agent.EK.

4. 4

   Run Microsoft Defender Offline

   In the same Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel, which helps against malware that tries to hide from a scan inside Windows.

5. 5

   Install Windows updates

   Open Settings > Windows Update and install everything offered. A downloader can leave other programs behind, and updates close the holes the 2019 guide worried about.

6. 6

   Try System Restore

   If the alert began after something new on the PC, press Windows logo + R, type rstrui.exe and choose a restore point from before it. Microsoft says System Restore reverts system files, registry settings and installed programs, and leaves personal files alone. It will not help if no restore point exists.

7. 7

   Do not edit the registry by hand

   Microsoft's page for Agent.EK says manual removal is not recommended. We found no list of the files, tasks or keys this family adds, so we cannot give one, and a wrong registry edit can break Windows.

8. 8

   Last resort: reset Windows

   Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore documents only, not programs.

Never download a removal program because a pop-up or a stranger tells you to. A real detection does not need a phone number or a payment page to fix it.

Could it be a false alarm?

Possibly. Because these names stand for blocks of script text, an alert can be about a page or a file and not about a running infection.

A clean scan after a real alert does not clear the PC: if the script had already run, what it downloaded may not carry the same name.