Doly Trojan (1.50)
Server name: Doly Trojan
Version: 1.50
Different versions:  [1.1][1.35][1.50][1.60][1.70][1.70 SE][2.0]
Tested: Yes, on Windows 95 and Windows NT
Server size: 227K
Server files: Mirabilis ICQ.exe
Server icon:

Infects: Windows 95/98/ME/NT/2000
Autoloads: Registry and start up group
Default port: 1015 TCP
Can port be changed: no

Server Features

  • Change computer name
  • Change owner name
  • Change resolution to 640/480
  • Change the title color on open windows to a random color
  • Change volume to maximum or minimum
  • Close all windows
  • Close server
  • Chat with server
  • Disable double click
  • Disconnect server from internet
  • Display fatal error plus customizable message
  • Display FBI screen
  • Get ICQ UIN
  • Get passwords
  • Get user info
  • Hide/show all drives
  • Hide/show find dialog (Start menu..find)
  • Hide/show mouse
  • Hide/show run dialog (Start menu..run)
  • Hide/show task bar
  • IRC notify
  • Key logger on/off
  • Move mouse
  • Open/close cd-rom
  • Open FTP server
  • Remove windows background
  • Run program (visible to user or hidden)
  • Screen capture
  • Send key or string
  • Send to URL
  • Set all window names to another name
  • Set systems color
  • Sleep
  • Show/stop error screen
  • Shutdown windows
  • Start/stop crazy mouse
  • Swap/unswap mouse buttons (Left button becomes right)
  • View running applications
  • View, clear or change clipboard text

 
Comments 
Doly Trojan 1.50 once again comes with a huge install file, 2.34 megabytes this time. This setup.exe installs Memory manager 2.6 and Doly in the background. Doly 1.50 is rather buggy and did not add any significant features. 

How To Remove 
Quick fix: no quick fix programs
Manual removal:

  1. Remove the Ms tesk keys in the registry located at HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run. Then delete Enable, parameters, path and startup keys in the registry located at HKEY_USERS\.Default\Software\Mirabilis\ICQ\Agent\Apps\Ava. Which can be done with regedit or any other registry editing program.
  2. Reboot the computer or close mdm.exe in the program files directory (Usually c:\program files\) and in the windows start up directory (Usually c:\windows\start menu\programs\startup\). Also reboot or close Kernal32.exe in the windows system directory. 
  3. Delete the trojan file Kernal32.exe in the windows system directory. Also delete mdm.exe in the windows start up directory (Usually c:\windows\start menu\programs\startup\) and in the program files directory (Usually c:\program files\). If any of the files can not be deleted or closed then reboot the computer into DOS mode and delete them there. 

 
Related 
Article: General removal info
Section: Test your knowledge, take our Trojan Quiz
Service: Trojan removal
Service: Tell a friend about this trojan
Service: Print this page
 
 
Copyright © 2000 and 2001, Dark Eclipse Software. All rights reserved. 
This page may not be redistributed or reproduced in any manner without specific written permission from Dark Eclipse Software. If permission to use this page is desired then contact Dark Eclipse Software. While we consider the content of this page to be accurate, we cannot guarantee either the accuracy or the appropriateness of any portion of the page, including our analysis and manual removal. 
Any actions taken by a reader in response to this or any other Dark Eclipse Software page are completely and solely their responsibility.