Preserved Topic: Subseven 2.2 Removal

I've tried everything to get rid of Subseven, Scanners, Manual, etc. but I can't seem to get rid of it. Anyone know what I can do?

.

[This message has been edited by moaiz (edited 07-12-2001).]

http://www.hackfix.org/subseven/


You are probably gonna have to hack your registry so back it up first
Note: I put "SubSeven removal" in Google and that was the first link


Walking the Earth like Kane

[This message has been edited by bitdamaged (edited 07-11-2001).]

[This message has been edited by bitdamaged (edited 07-11-2001).]

The trojan scanners will normally tell you the files that are infected, but will be unable to delete them. So you then write down all the file names, and locations, then you reboot into dos.

From there you will be able to remove the files, because in dos they are not in use, at least in most cases.

You will then have the files deleted, and from there you should do a system overinstall. Because you will have deleted some system critical files that the trojan has jumped onto. After the overinstall your system should be working OK. However, to be safe, you will want to open up reg edit and delete all references to the trojan. You may also need to edit you win.ini to get rid of the trojan loading process.

Lots of it is just intuitive deletion of trojan related materials.

Oh, and when you are in dos, you might want to try a FORMAT /mbr which will format the master boot record (slash may point in other direction).

This is the way I get rid of most of the trojans that appear in my computer. I don't know about sub seven, but I don't think it would be much different than the others.

I tried "subseven removal" on google also, and came up with some relevant information, but alot of it was dated. I just thought one of you might be very familiar with it and be able to give me details on the infection.

I think I've stopped all booting methods and deleted the files, but Norton has been coming up with a repeated hit on a .cpy file that is in my C:\_restore folder. Anyone know why that might be happening?

The problem is in Windows Me's System Restory utility. It has made a backup copy of one infected file, so that you can restore it later if you delete it (Windows doesn't know that it's infected). You'll have to delete it manually from there...