Comments
Doly Trojan 1.1 came with
a 1.75 megabyte setup.exe file to infect your computer. The setup file
installs a Memory manager file but also installs the trojan. However because
of the large setup file and the existence of newer versions, this older
trojan is rare. Features include a format option, which may or may not
work. The server can upload files and then run them, which thereby allows
other trojans to be installed.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Remove the Ms
tesk keys in the registry
located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
Which can be done with regedit or any other registry editing program.
-
Open the win.ini(Usually
c:\windows\system.ini) and remove the key: load=c:\windows\system\tesk.exe
under [windows]. This can be done with any text editing program.
-
If the computer has not
been rebooted since the setup file was ran then do the following: Remove:
copy
c:\sys.lon c:\windows\start menu\programs\startup\MStesk.exe
from the winstart.bat. Then
remove: @echo off copy c:\sys.lon cL\windows\startM~1\programs\startup\mdm.exe
in
the autoexec.bat. Both the winstart.bat
and autoexect.bat can be edited with notepad. Then delete c:\win.reg
and c:\sys.lon if they exist.
-
Reboot the computer or
close tesk.exe
in
the windows system directory. Also close or reboot MStesk.exe
in the windows start up directory (Usually
c:\windows\start menu\programs\startup\) and in the program files directory
(Usually c:\program files\).
-
Delete the trojan file
tesk.exe
in the windows system directory and MStesk.exein
the windows start up directory (Usually
c:\windows\start menu\programs\startup\) and in the program files directory
(Usually c:\program files\).
If any of the files can not be deleted or closed then reboot the computer
into DOS mode and delete them there.
|
