Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone have any experience in removing the ffsearcher trojan.

One of our systems is infected. The virus scanner doesn't detect it, but our websense program is detecting all the internet activity from it.

I am trying to determine how to remove this.

Here is a great article on the virus, but no removal instructions. Tells the files infected but not how to clean.

http://secureworks.com/research/threats/ffsearcher

share|improve this question
    
Spelled 'trojan'. –  spoulson Jul 16 '09 at 18:18
    
What antivirus program are you using? –  KPWINC Jul 16 '09 at 19:49
add comment

2 Answers 2

Well, the best way is to wipe the machine and restore from backup

share|improve this answer
2  
You shouldn't trust a compromised machine. It might look like a "simple" compormise, but unless you have a mechanism to boot a trusted OS and insure that all binaries on the machine are original there may well be a "back door" lurking (rootkit, etc) even after you believe you've "cleaned" the machine. This is an old lesson in computer security that seems to be increasingly forgotten today. –  Evan Anderson Jul 16 '09 at 18:30
    
That should be "trusted backup" - if you can't remember when you got the virus, then you can't trust the most recent backups. If there's no removal instructions, the best way to remove the infection is DBAN. Don't put yourself at risk for reinfection. –  Broam Mar 22 '10 at 19:52
add comment

Combofix can get rid of it, run MBAM after to finish up..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.