Endpoint Protection

Our client found this trojan(11.0.4014.26) and cleaned it but it didn't go away, it keeps coming back. I did google on the issue but nothing seemed
to be working. Tried many different tools (hijack this, adaware, malware bytes, spybot, spy doctor, combofix,...). Nothing did the thing. In the registry we can't
see anything strange. Even in  the win.ini and the system.ini we don't see anything strang at all. Please does anybody have an idea. perhaps reinstalling the sep client?????

Our client is 11.0.4014.26 and not the trojan of course.

Have you tried the latest Rapid Release definitions?

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=rr

http://www.symantec.com/business/security_response/definitions/rapidrelease/index.jsp

You may need to submit a sample to Security Response for a possible new varient in the wild.

Thomas

 The backdoor's take advantage of system vulnerability. So make sure your system is all patched up.

Unfortunately... it's possible that you are being reinfected using a security hole in the operating system created by the initial infection.  That is the very nature of a backdoor.

Title: 'Backdoors and What They Mean to You'
Document ID: 2008120313315548
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008120313315548

"Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system." 

sandra

Hey guys and girls, problem solved. I used the combination of microsoft updates and spybot and adaware end yes the trojan is gone.
Thanks anyway.

I'm glad to hear, but please bear in mind that security on a level that can't be repaired by any AV software may still be compromised.

See this, an oldie but a goodie from 2004:

Help: I Got Hacked. Now What Do I Do?
http://technet.microsoft.com/en-us/library/cc512587.aspx

sandra