Re: Files Associated With Client Component of TCP/IP Properties

"GreggMB" <GreggMB@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D5A71317-8EB6-4936-B1A9-12EE7248C271@xxxxxxxxxxxxxxxx
All this does is affects the transport (or "infrastructure") the Trojan
uses.
It has no affect on Trojan itself.

I think that depends on the implementation. One possible scenario is that
the Trojan loads itself as a kernel rootkit virus through one of those
files, then allows the normal functionality to proceed.

I admit it is a long shot to find this thing in any case. Once a rootkit
gets installed, it can hide activity in the kernel from you and make things
seem clean when they are not.

--
Will



"Will" wrote:
Is there a place I can get a specific filelist of the files
(re)installed
when you remove the Client component of TCP and then re-install it?

We have a trojan on a computer that was cleared by that action and I
would
like to start isolating the affected files to see if I can determine a
possible source of infection.

--
Will


.