It’s a mystery

Going to be in full investigation mode today. One of the PC’s here at work, when visiting some website, got 3 different Symantec warnings about Trojan.Trunlow:

The virus warnings said “Access Denied”

But at the same time stamp, Symantec was shutdown, and some of the password stealer .exe’s listed on that page showed up in C:/WINNT/. On the other hand, none of the registry settings were made, and there’s no evidence that it tried to actually send out any information, that I’ve found yet. The IE patch was installed, so in theory, between that being patched and Symantec catching the VBS trojan, none of it should have been allowed to run, but it was.

I suppose it’s time to go ask some questions of the user. I’m sure that won’t provide any real answers. 🙂

Similar Posts

  • I’m hating Symantec

    Well last night I was REALLY hating Symantec, I’ve since cooled off a bit. A friend of ours purchased, and then tried to install, Norton’s System Works 2006. She thought she had a successful install, however when she restarted her computer, her new System Works immediately went into red stop sign mode, telling her that…

  • Birthday gifts

    Yeah you might not be jealous of the external hard drive, the SCTV DVD set, a couple of other CD’s, some clothes and books, etc. But I know you all are jealous that I got this for my birthday! Update: You can see them in action over on Angela’s blog. Follow these topics: Uncategorized

  • AVG Free

    Andy pointed out the other day that AVG would stop updating version 6 of their free AV product at the end of the year, but they had made version 7 available. I went to take a look at that over the weekend and discovered something that didn’t make me happy. Seems that their definition of…

  • Email

    Not sure if it’s related to the blaster worm or not, but email to this domain is not being delivered right now, and hasn’t been since at least sometime this afternoon. I don’t know if it’ll bounce eventually or get to me eventually, but if you’re awaiting a response from me, don’t hold your breath….

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Your post must include a link to this post.

How does this work?
Write a response on your own website and include a link to this post. Then submit your response’s URL here. Your response may appear here after moderation. To update or remove it, edit or delete your original post and submit the same URL again. Learn more about Webmentions.