Comments
SubSeven 2.1 Bonus fixed
the following bugs: IRC bot, AIM spy, ICQ spy, and offline key logger.
The 2.1 bonus client also included a password bypass feature. Any previous
server could have it's password protection removed. However all new servers
are immune to this feature.
Note: This is a trojan
that can be submitted to us for analysis. We can possibly determine
for you the password that was used and the ICQ UIN, Email or IRC channel
that was being notified. For more information on submitting trojan files
to us read here.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Remove the Winloader
key in the registry located at either HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices.
Which can be done with regedit or any other registry editing program.
-
Open the system.ini(Usually
c:\windows\system.ini) and change the key: shell=Explore.exe
some random name.exe. under [boot], to shell=explorer.exe. This
can be done with any text editing program.
-
Open the win.ini(Usually
c:\windows\win.ini) and remove the key: run=some
random name.exe under [Windows], this can be done with any text
editing program.
-
Change the default value
at HKEY_LOCAL_MACHINE\SOFTWARE\exefile\shell\open\command
to nothing("").
-
Reboot the computer or
close the trojan.
-
Delete the trojan file
some
random name.exe
in the windows directory.
.
|
