Comments
InCommand 1.6 beta 6 was
released to fix the ICQ notification. ICQ blocked messages sent from InCommand,
but this version avoids ICQ's blocking. InCommand has an edit server program.
Besides setting an ICQ UIN for notification when your computer comes online,
now the server icon and server file name can be changed. This point means
that InCommand 1.6 beta 6 can use any name, not just server16.exe, when
it infects. The edit server also can choose between one of three methods
of infection the InCommand server will use once it is run. However, we
found this choice of infection does not work; it would only use the win.ini
to auto load. Also note that the edit server can increase the size of the
server and/or bind it to another file.
Note: This is a trojan
that can be submitted to us for analysis.
We can possibly determine
for you the password that was used and
the ICQ UIN that was being
notified. For more information on submitting trojan files to us read
here.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Change the run=server16.exe
to run= in the win.ini located under [windows].
Which can be done with any text editing program.
-
Reboot the computer or
close the server16.exe.
-
Delete the server16.exe
that is located in the Windows directory.
|
