Hacktool.Rootkit (yeah again...)

Status
Not open for further replies.
Last week we got this trojan in our network, everyone have Norton AntiVirus.
NAV found rofl.sys and placed it in quarantine, but everytime someone restarted NAV found rofl.sys again. Nobody could use printers through network and internet laged.

We found solution on http://lv.trendmicro-europe.com/ent...p?LYstr=VMAINDATA&vNav=2&VName=WORM_SDBOT.DJN
We used AUTOMATIC REMOVAL INSTRUCTIONS, everything was fine, trend found this trojan and deleted, trojan files were spoolsvr.exe and eraseme_12345.exe (random numbers). And we cleared registers too.

Everything was fine but few days ago this trojan is in every computer again. How can we fix it?

Our workstations doesn't have firewall, only server have.

We can't unplug computers from network.
We can't use firewall software unless it's free.

And btw we use Windows 2000 sp4, windows is fully updated and NAV virus database is fully updated too.
 
Status
Not open for further replies.
Back