SubSeven (2.2)
Server name: SubSeven
Version: 2.2
Different versions:  [1.0][1.1][1.2][1.3][1.4][1.5][1.6][1.7][1.8][1.9][Apocalypse][2.0][2.1][2.1 Bonus][2.1 Defcon][2.1 ICQ Fix][2.1 Gold][2.1 MUIE][2.2 beta 1][2.2 beta 2][2.2]
Tested: Yes, on Windows 95 and Windows NT
Server size: 54.5K
Server files: server.exe
Server icon:

Infects: Windows 95/98/ME/NT/2000
Autoloads: Yes, varies from Registry, System.ini, Win.ini
Default port: 27374 TCP
Can port be changed: Yes

Server Features

  • App redirect
  • AIM, ICQ, MSN and YAHOO spy
  • Caps lock on/off
  • Change resolution
  • Change/view date and time
  • Change volume settings
  • Change windows colors
  • Clipboard manager
  • Control mouse
  • Disable/enable ALT-CTRL-DEL
  • Disable/enable keys
  • File manager
  • Find files
  • Flip screen
  • FTP server
  • Get AIM password
  • Get cached passwords
  • Get home info 
  • Get ICQ password
  • Get pc info
  • Get RAS passwords
  • Get screen saver password
  • Get screen shot
  • Hide/show clock
  • Hide/show desktop
  • Hide/show mouse cursor
  • Hide/show start button
  • Hide/show task bar
  • ICQ takeover
  • Key logger
  • Log off, power off, reboot or shutdown windows
  • Monitor on/off
  • Network browser
  • Nums lock on/off
  • Open/close CD-Rom
  • Packet sniffer
  • Play tic-tac-toe with server
  • Port redirect
  • Print manager
  • Process manager
  • Record from microphone
  • Registry manager
  • Scrolls lock on/off
  • Send keys
  • Send message
  • Send to URL
  • Show matrix
  • Swap mouse buttons
  • Text-2-speech
  • View webcam
  • Window manager

 
Comments 
SubSeven 2.2 has many more features and a more advanced edit server program. This version of SubSeven has three new ways to auto load with windows. The first is to use the registry as an Installed component (step 2). The second is to make (using the registry) a start up folder (step 3). The third method is to make an explorer.exe in the root directory (step 6). Our advice would be to use a Anti-Trojan program to remove SubSeven 2.2, because it's just nicer to click remove in a program.

How To Remove 
Quick fix: no quick fix programs
Manual removal:

  1. Remember the file in RunDLL32r key in the registry located at either HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices and then remove the RunDLL32r key. Which can be done with regedit or any other registry editing program.
  2. Remove the %random key name% key in the registry located at HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components. Which can be done with regedit or any other registry editing program.
  3. Remove the Common Startup key in the registry located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\explorer\User shell folders. Which can be done with regedit or any other registry editing program.
  4. Open the system.ini(Usually c:\windows\system.ini) and remove the key: shell=Explorer.exe c:\windows\sytem\some random name.exe under [boot], to shell=explorer.exe. This can be done with any text editing program. 
  5. Open the win.ini(Usually c:\windows\win.ini) and remove the key: load=c:\windows\system\some random name.exeunder [Windows], this can be done with any text editing program. 
  6. Delete c:\explorer.exe.
  7. Reboot the computer or close the trojan. 
  8. Delete the trojan file, which is listed in the registry, in the windows system directory. 

 
Related 
Article: General removal info
Section: Test your knowledge, take our Trojan Quiz
Service: Trojan removal
Service: Tell a friend about this trojan
Service: Print this page
 
 
Copyright © 2000 and 2001, Dark Eclipse Software. All rights reserved. 
This page may not be redistributed or reproduced in any manner without specific written permission from Dark Eclipse Software. If permission to use this page is desired then contact Dark Eclipse Software. While we consider the content of this page to be accurate, we cannot guarantee either the accuracy or the appropriateness of any portion of the page, including our analysis and manual removal. 
Any actions taken by a reader in response to this or any other Dark Eclipse Software page are completely and solely their responsibility.