TechSpot

Hacktool.Rootkit (yeah again...)

By Harrower
Feb 23, 2006
  1. Last week we got this trojan in our network, everyone have Norton AntiVirus.
    NAV found rofl.sys and placed it in quarantine, but everytime someone restarted NAV found rofl.sys again. Nobody could use printers through network and internet laged.

    We found solution on http://lv.trendmicro-europe.com/ent...p?LYstr=VMAINDATA&vNav=2&VName=WORM_SDBOT.DJN
    We used AUTOMATIC REMOVAL INSTRUCTIONS, everything was fine, trend found this trojan and deleted, trojan files were spoolsvr.exe and eraseme_12345.exe (random numbers). And we cleared registers too.

    Everything was fine but few days ago this trojan is in every computer again. How can we fix it?

    Our workstations doesn't have firewall, only server have.

    We can't unplug computers from network.
    We can't use firewall software unless it's free.

    And btw we use Windows 2000 sp4, windows is fully updated and NAV virus database is fully updated too.
     
  2. Peddant

    Peddant TS Rookie Posts: 1,644

Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.