[wes0125]

We use Symantec Endpoint on our servers. My boss evidently opened an email, using Outlook, and got hit with Trojan Horse. Symantec keeps sending a notification the it has quarantined a XXXXXXXX.tmp file (x=variable name). Originally they were DWH#####.tmp. I found some of these and were able to delete them. Then they became APQ######.tmp. When I go to the path indicated, nothing shows. The quarantined files totaled 24,000+ before I shut it down (300+ mb of space). I have scanned with McAfee, Malwarebytes, and Spybot trying to find the Trojan itself, but they didn't found anything.

Is "Trojan Horse" a specific trojan and is this a generic term?

I had a similar problem with a friends PC an couple of weeks ago. But Malwarebytes found and fixed the prob. Not this time.

Has anyone come across this problem and found a solution?

[Phantom010]

Read this. It's usually a generic name but I think there is a Trojan Horse specifically called Trojan Horse too.

I think you would be better served in the Malware Removal & HijackThis Logs forum.

[wes0125]

Thanks for the info. Will try the removal option. I was able to finally delete all the quarantines.

[Cookiegal]

With regards to malware, we normally don't work on company computers as they have their own IT departments and also in the process we could delete and/or change some needed settings, permissions, etc.

Having said that, it seems this issue is likely not a virus at all but is to do with Symantec and there is a patch to correct this. Here is a link to the support article:

http://service1.symantec.com/SUPPORT...07111911135548

The APQ files are contained in the APTemp folder which is where Symantec moves the "infected" files before they are quarantined.

I'm confident the patch or workaround in the Symantec article will solve the problem for you. Please let us know how it goes.

Also, I assume you used the McAfee online scan and are not actually running two anti-virus programs as they would conflict with each other.

[wes0125]

This is without a doubt the answer but when I try to run the downloaded fix for a 32-bit machine, I get a msg that it is not a vaild 32-bit application (SEP32_56To33_clientMSPMSI.exe). The client is a Dell Vostro 32-bit running Vista Ultimate. ?????? ideas?

[wes0125]

Problem solved. I ran the fix from the website instead on saving it to a flash drive and trying it. It works from the website.

THANKS A MILLION FOR YOUR HELP.

Wes

[Cookiegal]

It's my pleasure and I'm glad it solved the problem for you.