Comments
The Infector 1.7 is the
first trojan we have seen to use Flash. Of course it is using Flash in
its client. This version has a new client and a few new features. Like
previous versions the server is large because it is released uncompressed.
This allows the server to be compressed by a "hacker" and not be detected
by trojan scanners. The Infector 1.7 creates a file setup.int. Setup.int
is a plaintext (you can view in notepad) file which logs all of the keys
you have typed.
Note: This is a trojan
that can be submitted to us for analysis. We can possibly determine
for you the password that was used and the ICQ UIN that was being notified.
For more information on submitting trojan files to us read
here.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Change the shell=Explorer.exe
FC32.exe to shell=Explorer.exe
in the system.ini under [boot]. Which can
be done with any other text editing program
-
Reboot the computer or
close FC32.exe.
-
Delete the trojan files
d3x.drv,
FC32.exe and setup.int
in the windows directory.
|
