Comments
Web Serve 2 is a Spanish
Visual Basic trojan. Web Serve listens on port 80 and acts as an HTTP server.
To make finding infected computers easier, all servers attempt to log on
to a Spanish IRC server. Once in this server, they sit and say their IP
address until someone connects with a web browser.
How To Remove
Quick fix: no quick
fix programs
Manual removal:
-
Remove the instalIIex
key in the registry located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and the instEX key in the registry located
at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
and
the IIexInstal
key
in the registry located at HKEY_CURRENT_USER.
Which can be done with
regedit or any other registry editing program.
-
Reboot the computer or
close INSTLIEX.exe
-
Delete the trojan file
INSTLIEX.exe
in the windows system directory.
|
