Kerne1 & Sub7

i was deleting my sub seven server and then i accidently ran the file. It infected my kerne1.exe file in my c:\windows\ folder so since i have never seen that file in my windows folder before i figured it was probably the sub7 server. the next day i i turned on my computer everything seemed to work fine until i logged in. a window popped up saying kerne1.exe was missing and i had to reinstall windows, i can't seem to access the c:\ drive in dos so...what should i do? oh, and i'm running windows ME (i know i know...it's not my fault!)

-thanks

i have never been one to flame. usually, if i have nothing nice to say, i say nothing at all, and limit my posts to ao for only educational posts with some real purpose. but for you i will make an exception.
you sir, are a dumbass.

:spank:

Quote:

---

what should i do?

---

Reinstall windows....from scratch. As in format the harddrive and then install. Use a boot disk to get to the c drive in dos. You want to make sure that the reinstall doesn't keep any old settings, which does happen sometims. And if at all possible, get rid of ME. Go back to 98 if you can. Preferably Win2k.

Good luck....

haha
LOL @ VanEck. Short, sweet and simple flame.
But anyway...didn't the guy say he couldn't access his c: drive from dos? Well in that case check your bios settings, see if the primary and secondary drives are in the right order...and off you go. After that, don't ever touch that SK subseven crap, that MS m.e crap, and get a linux distro.
:D

Or, if you have a friend running the same OS.
get a copy of the file from him (and make a
bootable floppy while you're at it)

Boot from floppy, replace file.
:cool:

didn't i say i was deleting sub 7?....why are you guys flaming me?

Only VanEck flamed you, and he was just saying it was stupid to play with a trojan. The rest of us were trying to help you....

Well..deleting subseven sounds alot like, "i used subseven and was trying to flip my friends cursor when i accidently clicked on server.exe. now i wanna get rid of subseven"
Get the drift? And that my friend...was not a flame. VanEck was not a flame. You have obviously not seen Negative's posts.

You dont have to reinstall your windows all you have to do is this-
The order to remove this trojan is complicated by the depth to which the trojan hooks the operating system.
One trick that I discovered is to rename the registry editing program from their original .EXE to a .COM extension (as in REGEDIT.COM). This will by pass the limitations created by removing the trojan prior to editing the registry. This will allow you to remove references of trojans and Internet worms.
--- Manual Removal Instructions ---

1) Identify and note the files associated with this trojan as detected by the scanner.

2) Click START|RUN, type

COMMAND /C COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
and hit ENTER
3) Click START|RUN, type REGEDIT.COM and hit ENTER

4) Remove references to the trojan from these keys of the registry

HKCR\exefile\shell\open\command\

HKLM\Software\CLASSES\exefile\
shell\open\command

They should contain only the value not including brackets
[''%1'' %*].

5) If applicable, remove any keys that run the main trojan under

HKLM\Software\Microsoft\Windows\
CurrentVersion\RunServices\

HKLM\Software\Microsoft\Windows\
CurrentVersion\Run\

HKLM\Software\Microsoft\Active Setup\Installed Components\KeyName\

6) If applicable, delete the registry key if it exists

HKEY_CLASSES_ROOT\.dl

and exit Regedit

7) If applicable, edit WIN.INI and remove the reference to the trojan from the run= line in the [windows] section.

8) If applicable, edit SYSTEM.INI and remove the reference to the trojan from the shell= line in the [boot] section. It should just contain the file EXPLORER.EXE.

9) Restart the system.

10) Delete the trojan program(s). If all is well the files should be deleted OK. If you get an error message saying that windows is unable to delete the file because it is in use, then you have made an error in the above procedure. Repeat steps 1 to 9 and try again.

I would install linux on the box and then try to run your sub7 server again, oh and while your at it why dont you write some visual basic viruses on the linux box.....:P

err...well for the people who are willing to help...

i can't seem to access my hard drives from dos at the startup... when i log into windows it says the file cannot be found and windows needs to be reinstalled... and then it shuts down... i found out that kerne1.exe was the backdoor and that it adds an entry to the registry so that it is started as a system program... i'm gunna take my hard drive to a friend's house tommorow to try and copy a file in place of kerne1.exe and maybe everything will be all right...

well...unless that doesn't work...but thanks for all the help...
yes, even you VanEck....i know i am a dumbass....

Try and access dos from a boot disk

relacing kerne1.exe will not help anything becaue your registery is all screwed up

Well hellbringer87 ummmm there is alot of programs to delete the whole intaer sub7 program.... i suggest u try one i never tried it though but just try that

well i did try and access dos from a boot disk but the problem is.. it doesn't read the hard drive, there's also an error message that says the computer doesn't recognize any FAT or FAT32 partitions even though windows will still start without a book disk it's just load after logging in.

I think the reason your stopping at login is because of a run statement in the win.ini file at the top that says:

[windows]
load=
run=c:\windows\kerne1.exe


Those statements are used to load or run a program everytime you boot up the os.
If you can get into dos open the win.ini via

EDIT WIN.INI

just remove the c:\windows\kerne1.exe part, the "run=" and "load=" is normal to have in there.

That should get you past the login to the desktop.

To get into dos try hitting the F8 button and going to the startup menu. Once there you should be able to hit like ctrl-F5 or something to go directly to dos(look at the bottom of the scree). If your getting to the login part of windows you should be able to easily get to this point. Once in edit your win.ini and also your system.ini.

In system.ini in the [boot] section your looking for a line that says:

shell=Explorer.exe c:\windows\kerne1.exe

delete the end of it so it only says:

shell=explorer.exe

do that and i'll help you furthur.