It’s a mystery

Going to be in full investigation mode today. One of the PC’s here at work, when visiting some website, got 3 different Symantec warnings about Trojan.Trunlow:

The virus warnings said “Access Denied”

But at the same time stamp, Symantec was shutdown, and some of the password stealer .exe’s listed on that page showed up in C:/WINNT/. On the other hand, none of the registry settings were made, and there’s no evidence that it tried to actually send out any information, that I’ve found yet. The IE patch was installed, so in theory, between that being patched and Symantec catching the VBS trojan, none of it should have been allowed to run, but it was.

I suppose it’s time to go ask some questions of the user. I’m sure that won’t provide any real answers. 🙂

Similar Posts

  • OPML challenge..

    Kent and Eric have answered the call from last week and sent me links to their OPML files. I’ve imported them to NewsDesk, pruning as I did it to avoid duplication or just feeds that don’t apply to me. (By the way, nice feature of NewsDesk to let you add channels by loading an OPML…

  • Upgrade update

    My original prediction, of course, was a month and 4 meetings. The President got the memo yesterday, had a short meeting with my boss, and sent me 4 different emails with questions and suggestions for possible changes. My boss is now trying to schedule a meeting for us to discuss options with 3-4 other people,…

  • OneNote video

    Saw a number of pointers to this post on jkOnTheRun: OneNote is one of the most capable programs I use and like all such versatile applications there are a lot of features and capabilities that I am sure I am not using. If you are a budding OneNote user or just trying to figure out…

  • Traffic blocks

    According to Dave this morning: “Can you believe it — there are weblogs that turn away traffic based on referrer. This is bad practice. These people seriously need to take a refresher course in what the Web is about and how important links are and stop screwing around with them. I won’t read sites that…

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Find out more about Webmentions.)