BO2K.TrojanVariant

[kdub2000]

I have E2K sitting on an W2K server. There is a file called the "wlogin.exe" that is corrupted by the "BO2K.TrojanVariant" virus. Norton AntiVirus Corporate edition has detected this virus, but cannot remove, or quarantine it. And I'm under the assumption that I cannot delete the file.

Symantec's web site doesn't give me any advice, except to update to the latest edition...which I have done...and the virus is still here.

Is there any advice anyone has to help me with this problem?

 

[Kento]

That's a variant of the back orifice trojan so you've been hacked. Have a look:

http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=BO2K.Trojan&btnG=Google+Search

see this:

http://www.hackfix.org/bofix/fix2k.shtml

Download and run The Cleaner which is free to try and see if it'll remove it for you. It's a trojan specific scanner.

http://www.moosoft.com

Tauscan is also free to try:

http://www.agnitum.com/products/tauscan/

 

[Kento]

Here's more info on back orifice and what it does.

http://securityresponse.symantec.com/avcenter/venc/data/backorifice.html

 

[kdub2000]

Kento,
Thank you for the information, I'll try the links you've suggested.

--kdub2000

 

[kdub2000]

Kento,
Cleaner worked...Thank you.

kdub2000

 

[Kento]

You're welcome. If you have no firewall on that pc then I would suggest you get one. It'll help prevent hacking. Zone Alarm has a free version and it's one of the best there is.

http://www.zonelabs.com

 

[kdub2000]

We do have a firewall...This is a server that is for a company that is subletting space from us and their server came with the virus on it...The virus didn't seem to do anything except be a pain in the A**, but the tools you pointed me to removed them.

Thanks again.
kdub2000

 

[Kento]

I see. But actually 'back orifice' isn't a virus that does damage. It's a remote access trojan that allowed hackers to access the system whenever they wanted.

http://securityresponse.symantec.com/avcenter/venc/data/backorifice.html

Anyway, glad it's gone.