 |
 |
In the past two days, Norton Anti-virus has found the Fake.Gina Trojan on two computers in my department. The odd thing is that it found it at boot time, when the system loads it in response to a registry hack. At this point, the trojan .dll is already in the system32 folder. It seems as though NAV should have found it when it when it was written there and quarantined it at that point, so we're puzzled as to how it's getting there. Has anyone else run into this recently? (According to Symantec, the trojan itself has been around for over a year.) These computers have Microsoft's RPC vulnerabilities patched, but did not have the more recent patch for the Messenger Service. --Chris ============================================== Chris Wolf Computer Service Manager Agricultural Economics [log in to unmask] Michigan State University 517 353-5017