trojan.sefex found but can't clean it

[hoinvip]

Hi there,

One of our clients foolishly opened an attachment that sneaked in somehow and as a result, our NAV found Trojan.Sefex on a user's PC (Win98)in the c:\windows\temporary internet files\content.ie5\Index.dat file.

We pulled the wire from the workstation, shut it down, rebooted to DOS and deleted the file. We then rebooted into Windows and ran a full system scan. However, whenever we open Outlook, NAV is still finding this trojan...

Can anyone offer some suggestions please?

 

[TopRung]

don't know if this will do it, but run some cleanup software. I would run both ADAWARE and Search and Destroy.


It has helped me resolve similar issues.

 

[BoomStick]

I would try to go to housecall.trendmicro.com to get a second opinion on the virus. It could be that it's a false positive.

If you are deleting the file in DOS and it is reappearing at startup, then there is probably something in the RUN registry that is executing viral code and recreating the infected file. Go and check out the hklm\software\microsoft\current version\run (I think that's what it was in 98) and see if you find anything strange. Also look in the startup group and in the win.ini.

Good luck