Comments
SubSeven 1.9 comes with
2 new features. The first feature is its ICQ spy. This allows the "hacker"
to intercept your ICQ messages. The other new feature it has is in the
editserver program. The "hacker" can now add bytes onto the server file
and the keystroke recorder. Other then that and changing the default filename
for the trojan from kerne132.dl to mtmtask.dl nothing has changed.
Note: This is a trojan
that can be submitted to us for analysis. We can possibly determine
for you the password that was used and the ICQ UIN, Email or IRC channel
that was being notified. For more information on submitting trojan files
to us read here.
How To Remove
Quick fix: no
quick fix programs
Manual removal:
-
Remove the KERNEL32
key in the registry located at either HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices.
Which can be done with regedit or any other registry editing program.
-
Open the system.ini(Usually
c:\windows\system.ini) and change the key: shell=Explorer
mtmtask.dl under [boot] to shell=Explorer.exe, this can be done
with any text editing program.
-
Open the win.ini(Usually
c:\windows\win.ini) and remove the key: run=mtmtask.dl
under [Windows], this can be done with any text editing program.
-
Reboot the computer or close the trojan.
-
Delete the trojan file mtmtask.dl
in
the windows directory.
|
