Backdoor Subseven/Trojan - Help

[SevenBleach]

prolly just follow all the instructions in this thread before you post anymore.. not to be mean man but seriously.

[sysmin770]

Like other members have said you were most likely were just scanned for subseven. A fun thing that I have done in the past with people trying to spread Sub7 was to get connect to your computer with the client and find out the information of the person who put it on there. If they protected the server with a password you could use a program called Sub7 sniper. It is cool to send them Email or ICQ messages. I hate script kiddies.

[libertie]

Open a command shell when you are online and type netstat -av, and look for the port 27374 to be open, if you have subseven this is the default port that will be open, look for any port numbers that are out of the ordinary. Actually, if the firewall is any good it probably logged the connection attempt and it will have the port number that someone tried to connect to. You might try setting your firewall to a learning mode where it asks you which taffic can go out and which can come in. More than likely everyone is right, it was just a scan. Hope this helps.
-libertie

[mark_boyle2002]

Easy to follow instructions.
Some people forget that plain english is easier for people new to this to follow.

Sub7 was a back door into your computer.

In order to find which doors are open hackers often try all the doors on all the houses in the street.

When your internet security package notices some one trying the handle it reports it to you.

The fact that it reports it means that your security package is up to date enough to block people opening the door and would remove the virus if you had it.

[sysmin770]

I wouldn't necessary go by the default port number though. That is easily changed by the server editor for the program, and a good many people change it to better mask the fact it is there.

[spools.exe]

I would recomment booting in safe mode first. THen do a system scann or just delete the file. It should work that way.

[Fatphantom]

If you dont have an av, do scans from trend micro

My internet provider has already suspended my service for spamming. Help would be appreciated

Try contacting them and tell them what happened?