Backdoor.Roxy...DELETED AND COMES RIGHT BACK

  • Thread starter Thread starter Scott
  • Start date Start date
S

Scott

All of our users have "drop boxes" on our file server that I implemented in an effort to cut down on email attachments. Each system maps the X: drive to their individual box and Z: drive to the main "drop box" that has all other users boxes in it to copy to.

On one users machine he has a file payload.dat in his dropbox that just REFUSES to go away, I scan his system and his dropbox (again which is on the file server) using Symantec Corp Ed 8.1 with latest definitions, it finds a few payload.dats on the X: drive and quaritines them, I delete them, rescan it finds a few more, etc etc etc....

It seems like it's replicating itself as soon as it has been moved. Symantecs site doesn't say it exhibits this behavior and also says that it buries itself in the registry under run. On this users machine the key in the registry doesn't exist (so it looks to me like it's gone/shouldn't come back) but it ALWAYS comes back, reboot, scan, delete, scan - It's back, repeat process. And it always frinds multiple copies of it at the same location.

Has anyone else seen this? Know how the hell to kill it?
 
I also had an experience w/ a 98 box that
had "backdoor.ini" in the system32 dir (if I remember). It
would come back on its own also. I never found the answer
to it. I'd like to know if anyone knows about this file.
It was only 2 lines. I dont remember the text but the end
of the code would say "= yes".
-----Original Message-----
All of our users have "drop boxes" on our file server
Click to expand...
that I implemented in an effort to cut down on email
attachments. Each system maps the X: drive to their
individual box and Z: drive to the main "drop box" that
has all other users boxes in it to copy to.
On one users machine he has a file payload.dat in his
Click to expand...
dropbox that just REFUSES to go away, I scan his system
and his dropbox (again which is on the file server) using
Symantec Corp Ed 8.1 with latest definitions, it finds a
few payload.dats on the X: drive and quaritines them, I
delete them, rescan it finds a few more, etc etc etc....
It seems like it's replicating itself as soon as it has
Click to expand...
been moved. Symantecs site doesn't say it exhibits this
behavior and also says that it buries itself in the
registry under run. On this users machine the key in the
registry doesn't exist (so it looks to me like it's
gone/shouldn't come back) but it ALWAYS comes back,
reboot, scan, delete, scan - It's back, repeat process.
And it always frinds multiple copies of it at the same
location.
 
Back
Top