How do I remove a trojan?

[b][SIZE=1][COLOR=green]Ok, this is making me very mad, someone just put a trojan on the default port, and I need to remove it ASAP. Can anyone help?

Quote:

---

Originally posted by Anirak
[B][SIZE=1][COLOR=green]Ok, this is making me very mad, someone just put a trojan on the default port, and I need to remove it ASAP. Can anyone help?

---

Kind of need to know some more info bro.. Which trojan etc..

download, install and run the cleaner, available from http://www.moosoft.com

What trojan, what port? More information is needed.

[B]27374, I think it is probably SubSeven, how do I figure out what he useD??

Quote:

---

Originally posted by Guus
download, install and run the cleaner, available from http://www.moosoft.com

---

The above quote says it all. Just go to moosoft and download the cleaner. No one needs any further information or what port it's using. The Cleaner will remove it no matter what it is. It also comes with an active monitor to prevent you getting re infected.


:o

Anirak wanted some advice on removing Trojans.

The moosoft reference will probably be your best port of call, but it's not a 100% solution. moosoft specialize in Trojan intrusions but even they can't combat a Trojan they haven't seen before.

I know of people that specialize in break and enter Trojan software that is taylored as one offs, soes not to be detected. Hopefully they can go undetected indefinately. The secret services use them all the time *wink* to spy on people, there was a recent story here on AntiOnline about the FBI using a Trojan horse to monitor a suspect.

You can take measures yourself to prevent and remove Trojan software without relying on third parties, such as moosoft. The most important thing is to try an prevent someone getting a Trojan onto your system in the first place. Next, if you do have a suspicious Trojan lurking, you have got to identify its source, so you can prevent reinfection.

Use an Intrusion Detection System (IDS) to keep tabs on your system. Lookout for the sneaky ****s that use r00tkits to hide their tracks (I've run someone elses botfarm by not protecting a 24/7 high bandwidth server at work :D ) ... Make sure you have got a system backup on a GHOST image or maybe you'd prefer to spend loads of time reinstalling your OS from the original disks.

=====

Zero out your disk, so you can be sure a hidden copy of the Trojan isn't lurking, stored on some unused space on the disk.

i.e. with Linux do this dd if=/dev/zero of=/dev/hda

Restore your usual disk image from your backup like this

dd if=/dev/cdrom/myimage of=/dev/hda

=====

If you are connected to the Internet and your machine is mega lagged (slowed down) just run a simple check

netstat -a (make sure you aren't using IRC,WEB-BROWSER etc )

You will see all the connections your PC is making with the rest of the world, and if you see millions of connections on loads of ports you can be pretty sure some ****o is using your box as a proxy.
*ROFL*


PZ

Sometimes the easyest way to remove a trojan is to download the client software, connect to yourself and use the client's "uninstall/remove" function...

Ammo

[B][I]They put a password on it...

I downloaded that stupid Moosoft thing and it don't work worth a damn. When I run it ,it automatically closes itself after about 30 seconds.

First,
Unplug yourself from the net, then noone can intrude, and all imminent danger is gone.
Second,
Find out which trojan it is. If you find ziltch on the HDD, take a look at the running proccesses.
Third,
Even a trojan needs a way to start itself. Take a look at http://www.tlsecurity.net/auto.html to find out how. Then delete every option you find beeing used, thus disabling it's capability to run itself.
Fourth,
Get yourself a decent virus-scan and let it run *ALLWAYS*

Fifth,
if you're still nowhere, place your nice install CD in the cr-rom drive and reboot the frigging thing.

Grtz,

Download and install zonealarm and that will keep unathorized access to your computer and block trojans from coming in and out of your computer.