trojan deleted, how long?

Jon wrote:

> When I did a complete virus scan yesterday Norton found a trojan and
> deleted it. I'm fairly certain it just got in a few minutes before but
> since the file was deleted is there any way to find out for sure when
> the file was created?

even if the file was still there you wouldn't be able to tell when the
file was created... that file information can be modified...

the only way to find out how long it had been there is if you used some
sort of system integrity monitoring software that stored snapshots from
various point in time - and even then the granularity of the time
measure would be pretty high (it would have been there no longer than
the most recent snapshot that doesn't include it)...

--
"we are the revenants
and we will rise up from the dead
we become the living
we've come back to reclaim our stolen breath"