SubSeven trojan removal... help...

alien7749

My PC constantly got attacked by SubSeven trojan (the "runtime error 216" messages). So far I used spyware removal but none succeed. I read the manual removal but do not know which version of the SubSeven.

Any suggestion? Is there any one shot removal software to remove this particular trojan?

mehacomp_91

Removal -

The order to remove this trojan is complicated by the depth to which the trojan hooks the operating system.

One trick that AVERT has discovered is to rename the registry editing program from their original .EXE to a .COM extension (as in REGEDIT.COM). This will by pass the limitations created by removing the trojan prior to editing the registry. This will allow you to remove references of trojans and Internet worms.

To repair the registry via a registry script file, download this http://download.nai.com/products ... tand_alone/undo.reg, and open it.

<--- Manual Removal Instructions ---

1) Identify and note the files associated with this trojan as detected by the scanner.

2) Click START|RUN, type

COMMAND /C COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM

and hit ENTER

3) Click START|RUN, type REGEDIT.COM and hit ENTER

4) Remove references to the trojan from these keys of the registry

HKCR\exefile\shell\open\command\

HKLM\Software\CLASSES\exefile\
shell\open\command

They should contain only the value not including brackets
[''%1'' %*].

5) If applicable, remove any keys that run the main trojan under

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices\

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run\

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\
Installed Components\KeyName\

6) If applicable, delete the registry key if it exists

HKEY_CLASSES_ROOT\.dl

and exit Regedit

7) If applicable, edit WIN.INI and remove the reference to the trojan from the run= line in the [windows] section.

8) If applicable, edit SYSTEM.INI and remove the reference to the trojan from the shell= line in the [boot] section. It should just contain the file EXPLORER.EXE.

9) Restart the system.

10) Delete the trojan program(s). If all is well the files should be deleted OK. If you get an error message saying that windows is unable to delete the file because it is in use, then you have made an error in the above procedure. Repeat steps 1 to 9 and try again.

bzzts

spyware remover is to remove spyware.

trojan need to use trojan remover.

try ni :

1- http://www.download.com/Trojan-K ... 5237.html?tag=lst-4
2- http://www.download.com/CWShredd ... 4216.html?tag=lst-7

alien7749

ok, I run the trojan killer program but it cannot find the subseven. Yet, after reboot, the runtime error 216 message vanised. I suspect the thing goes to dormant mode.

I did try the manual removal, but from step 4 onward, i cannot find the respective files.

bzzts

have u try scan in safe mode?

alien7749

did it.

detection gave the same result.

kmkd

popup tu dah hilang kan?
jadi rasanya seperti regisrty problem,

coz fail tu pun alien tak jumpa.
popup hilang

kira solved la kan? rite?
atau ada problem lain lagi?

bzzts

cek jugak kat startup, BHO, dan lelain autorun/autorun.inf dlm hddisk jika ada.

alien7749

dari mana subseven ni datang? is there any tools to block it? sbb kalau kene, memang tensen giler. Ada sekali tu, semua *.exe fail tak leh bukak. kene format hardisk.

kmkd

apa error yang keluar bila jalankan fail .exe tu?

alien7749

takde error msg, cuma die tak run. nothing happen.

bzzts

ko guna antivirus apa ek, AVG aku leh detect banyak trojan...

mehacomp_91

haaa keygen apa tu
semalam buat pc customer ni guna AVG 8 beta
byk gak virus yang dia tangkap
tapi masih tak dapat menandingi AVIRA ku
Avg ni slow sikit la berbanding AVIRA kenapa ye?
meha ingat lepas ni nak bagi customer pakai avg je sebab update dia laju

bzzts

laju? takde kene mengene dgn detection virus/trojan.

kalu laju update, mmg la tu penting. avira manjang sangkut je. skrg ni je la stabil sikit kot.
tapi scara jujor nya, aku prefer AVG. avira aku kasi experimen kat pc opis ni, so far update dia asyik bukak advertising je suruh upgrade. tak malu tol.



p/s: keygen tu utk aku buat bisnes...

mehacomp_91

no maksud meha pc punya performance jadi slow sikit
masa nak start komp selalu camtu

pasal advertising tu no komen:re:

[ Last edited by  mehacomp_91 at 20-2-2008 12:17 PM ]

bzzts

maybe setting pc + startup pc meha lain kot.

bzzts punya pc okey je. masa boot, dia akan update.
dan paling penting, avg ni disablekan scan on startup kat automatic scheduler; buang daily scan.

mehacomp_91

nanti insyallah meha try

bzzts

kalo tak, kena babap.

mehacomp_91

meha nak try kat pc customer

tanak buat kat pc sendiri

testas

beli baru aje meha oiiiii.. apa nak try kat pc customer plak.. :@ :@ :@