Hacktool.Rootkit (yeah again...)

By Harrower
Feb 23, 2006
  1. Last week we got this trojan in our network, everyone have Norton AntiVirus.
    NAV found rofl.sys and placed it in quarantine, but everytime someone restarted NAV found rofl.sys again. Nobody could use printers through network and internet laged.

    We found solution on http://lv.trendmicro-europe.com/ent...p?LYstr=VMAINDATA&vNav=2&VName=WORM_SDBOT.DJN
    We used AUTOMATIC REMOVAL INSTRUCTIONS, everything was fine, trend found this trojan and deleted, trojan files were spoolsvr.exe and eraseme_12345.exe (random numbers). And we cleared registers too.

    Everything was fine but few days ago this trojan is in every computer again. How can we fix it?

    Our workstations doesn't have firewall, only server have.

    We can't unplug computers from network.
    We can't use firewall software unless it's free.

    And btw we use Windows 2000 sp4, windows is fully updated and NAV virus database is fully updated too.
  2. Peddant

    Peddant TS Rookie Posts: 1,446

Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...