full-disclosure - W32/Toolber.c.Trojan Removal?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000001c38c11$23d01d00$fe78a8c0@SecureWTD.de>
From: Eric.Fassbender.bgszsiuk at t-online.de (Eric Fassbender)
Subject: W32/Toolber.c.Trojan Removal?

I read about your problems and solutions that you had with
the W32/Toolber.c.Trojan and couldn't find any information
about how the Trojan spreads and how it is activated.
We had an F-Prot bootable CD that found and identified the
Trojan, but couldn't remove it. We manually deleted the
.exe file and it should be alright now, but I still have 
two questions left:

- Through which possible ways could the .exe enter the system,
and how did it activate itself?

- Is there any known tool that cleans the system, so we don't 
have to manually delete the .exe and the registry entries?

Hope someone has an answer to these questions,

regards,

Eric Fassbender

IT-Security Officer