Software

Ask something
Discussion Locked

Outlook Express/Trojan? Help!

0 helpful
3 replies

by dwhopkins

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A clients computer has what looks similar to a back orifice/trojan. It has created a shortcut on the desktop titled "backchina_com" with random characters after. When looking at the file extension, it is a .eml file (outlook express). It has written itself to several folders, including \Windows\System. Each file has the same date and file size. McAfee's latest online scan did not recognize it as a virus. Unable to delete, move or rename any of the files (74 to be exact) - even from dos command promt. Uninstaller was also unsuccessful in removing files. Error recieved when trying to delete is "file error 1024". Client is running Win98 second edition and IE 5.5 with Outlook Express. Any idea's? Is this a back orifice or somethingnew?

3 replies

by rlevesque

Sounds like you contracted the nimda virus.

I would highly recommend going to McAfee or Symantec and downloading their virus scanners and cleaning tools and see if you can remove the virus. they also have manual stteps to go through as well.

once you have everything cleaned up, make sure you install and update your virus protection!

by dwhopkins

Sorry, I should have been more specific. Not only did I load McAfee and updated dat file. I ran the McAfee's AV from their online service (which I assume had the most recent engine and dat). I had already removed nimda from the machine as well asW32 and W95.spacing. So imagine my suprise when this virus? wasn't recognized. I also tried booting from floppy and running McAfee from command line. The file has not tried to replicate itself any more and the only effect at this point seems to bethat on a warm boot, you lose the nic card. But when you cold boot the nic card is back. I did a sysedit review and there doesn't seem to be a reason for the nic driver not loading.
Any ideas?

This discussion is closed to new replies.