Comments
SubSeven 2.0 fixes various
bugs from the previous version. This version does have a lot of new features.
It can now intercept ICQ, AIM and Microsoft Messenger messages. Plus it
can steal ICQ and AIM accounts. The EditServer has changed into a wizard
type program. It now can lock the password and port so they can't be changed,
melt the server (delete the original file), and lock the configurations
with a password so they can't be read by another person. That last feature
of locking passwords can be easily defeated.
Note: This is a trojan
that can be submitted to us for analysis. We can possibly determine
for you the password that was used and the ICQ UIN, Email or IRC channel
that was being notified. For more information on submitting trojan files
to us read here.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Remove the KERNEL32
key in the registry located at either HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices.
Which can be done with regedit or any other registry editing program.
-
Open the system.ini(Usually
c:\windows\system.ini) and change the key: shell=Explorer
mtmtask.dl under [boot] to shell=Explorer.exe,
this can be done with any text editing program.
-
Open the win.ini(Usually
c:\windows\win.ini) and remove the key: run=mtmtask.dl
under [Windows], this can be done with any text editing program.
-
Change the default value
at HKEY_CLASSES_ROOT\exefile\shell\open\command
to nothing("").
-
Reboot the computer or
close the trojan.
-
Delete the trojan file
mtmtask.dl
in
the windows directory. Do note that SubSeven does make some registry
modifications but they do not appear to be important and need not to be
changed.
|
