Backdoor Subseven/Trojan - Help

I have a Backdoor/Subseven Trojan Horse on my computer. I have installed Norton
Internet Security, so, now it can't get out. However, I cannot seem to delete
it. I've tried the Symantec removal instuctions, when I am in the DOS window;
and am to cd \winnt it states it is an invalid directory and when I try to copy regedit.exe
regedit.com it says the file doesn't exist. Can you help me? I do not really
want to spend 4.95/min on the phone to Symantec. My internet provider has already suspended my service for spamming. Help would be appreciated. Thanks. Tara

Norten says the following:

"Attempt to connect to local computer using the Backdoor/Subseven Trojan horse detected."

Try cd \windows if you are not on Windows NT, 2000 or XP.

just because it says "Attempt to connect to local computer using the Backdoor/Subseven Trojan horse detected" doesn't mean your infected. Everytime some one uses sub7 to scan ranges of ip's for already infected people, you will get that message from norton if they scan past your ip. If norton is up to date and not finding anything, i'm willing to bet you dont have anything. But just in case, disable your virus scanner and go to housecall.antivirus.com/ they will scan your computer from theirs. If they find subseven, remember the version it states and go to: http://www.hackfix.org/subseven/

Hope this helps

What operating system?

If it isn't c:\winnt then it's probably c:\windows

Giving us the OS will really help....... :D

I had the trojan horse before I got Norton Internet Security. I have Windows XP, and my system is becoming slower everyday?

Quote:

---

Originally posted here by Tara47

Norten says the following:

"Attempt to connect to local computer using the Backdoor/Subseven Trojan horse detected."

---

Uhhh... that sounds like your firewall & what is most likely just a scan or something. And any AV that doesn't detect sub7 should be thrown in the garbage can. Do you have some of the newer products? Because I hear many of nortons new products can **** up performance a bit. Infact almost anything I buy now days with 2003/2004 on the end of the logo seems to mess up. But thats just me...

Like Specialist said, Sub7 can be detected easily by AV software, it's just too old to be a threat to most systems. If you don't have AV though, it's still dangerous. And Firewalls do tend to indicate the presence of trojans when a request is made to the trojan's port, with or without the trojan's presence.

So, I probably do not have the sub7 on my system?

I had the apparent sub7 before the AV. which was told to me by my internet supplier when SHS.exe was detected by my operating system.

Quote:

---

Originally posted here by Tara47
which was told to me by my internet supplier when SHS.exe was detected by my operating system.

---

:confused: !!!Detected by your OS? WTF!!! :confused:

Ummm.... whatever, pal.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run, key: preset value

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices, key: preset value

WIN.INI, section [windows], key run={server name}.exe

SYSTEM.INI, section [boot], key 'shell=Explorer.exe {server}.exe

HKLM\Software\Microsoft\Active Setup\Installed Components\{random value}

Check for startups.
Or you could go to restore then reboot and see if it still shows up.

maybeyou just got an alert from your firewall, thats all nothing to worry about

prolly just follow all the instructions in this thread before you post anymore.. not to be mean man but seriously.

Like other members have said you were most likely were just scanned for subseven. A fun thing that I have done in the past with people trying to spread Sub7 was to get connect to your computer with the client and find out the information of the person who put it on there. If they protected the server with a password you could use a program called Sub7 sniper. It is cool to send them Email or ICQ messages. I hate script kiddies.

Open a command shell when you are online and type netstat -av, and look for the port 27374 to be open, if you have subseven this is the default port that will be open, look for any port numbers that are out of the ordinary. Actually, if the firewall is any good it probably logged the connection attempt and it will have the port number that someone tried to connect to. You might try setting your firewall to a learning mode where it asks you which taffic can go out and which can come in. More than likely everyone is right, it was just a scan. Hope this helps.
-libertie

Easy to follow instructions.
Some people forget that plain english is easier for people new to this to follow.

Sub7 was a back door into your computer.

In order to find which doors are open hackers often try all the doors on all the houses in the street.

When your internet security package notices some one trying the handle it reports it to you.

The fact that it reports it means that your security package is up to date enough to block people opening the door and would remove the virus if you had it.

I wouldn't necessary go by the default port number though. That is easily changed by the server editor for the program, and a good many people change it to better mask the fact it is there.

I would recomment booting in safe mode first. THen do a system scann or just delete the file. It should work that way.

If you dont have an av, do scans from trend micro

Quote:

---

My internet provider has already suspended my service for spamming. Help would be appreciated

---

Try contacting them and tell them what happened?