Methods for Removing 10 Trojans Including Glacier - China DOS Union Forum

Sender: shaoxiang(Na Yun)
Compiled by: williamlong(2001-11-21 21:04:50), on-site mail

1. Glacier v1.1 v2.2
Glacier is the best domestic trojan.
Steps to remove the v1.1 trojan:
Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Find the following two paths and delete them
" C:\windows\system\ kernel32.exe"
" C:\windows\system\ sysexplr.exe"
Close Regedit
Restart into MS-DOS mode
Delete the trojan programs C:\windows\system\ kernel32.exe and C:\windows\system\ sysexplr.exe
Restart. OK

Steps to remove the v2.2 trojan:
The server program and path can be defined freely by the user, and the key name written into the registry can also be defined by yourself.
So it cannot be stated clearly.
You can check the registry and delete suspicious file paths.
Restart into MS-DOS mode
Delete the trojan program corresponding to the registry entry
Restart Windows. OK

2. Acid Battery v1.0
Steps to remove the trojan:

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete Explorer ="C:\WINDOWS\expiorer.exe" on the right
Close Regedit
Restart into MS-DOS mode
Delete the trojan program c:\windows\expiorer.exe
Note: do not delete the correct ExpLorer.exe program; the only difference between them is i and L.
Restart. OK

3. Acid Shiver v1.0 + 1.0Mod + lmacid
Steps to remove the trojan:

Restart into MS-DOS mode
Delete C:\windows\MSGSVR16.EXE
Then go back into Windows
Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete Explorer = "C:\WINDOWS\MSGSVR16.EXE" on the right
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Delete Explorer = "C:\WINDOWS\MSGSVR16.EXE" on the right
Close Regedit
Restart. OK

Restart into MS-DOS mode
Delete C:\windows\wintour.exe then go back into Windows
Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete Wintour = "C:\WINDOWS\WINTOUR.EXE" on the right
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Delete Wintour = "C:\WINDOWS\WINTOUR.EXE" on the right
Close Regedit
Restart. OK
4. Ambush
Steps to remove the trojan:

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Delete zka = "zcn32.exe" on the right
Close Regedit
Restart into MS-DOS mode
Delete C:\Windows\ zcn32.exe
Restart. OK
5. AOL Trojan
Steps to remove the trojan:

Boot into MS-DOS mode
Delete C:\ command.exe (remove the file's hidden attribute before deleting)
Note: do not delete the real command.com file.
Delete C:\ americ~1.0\buddyl~1.exe (remove the file's hidden attribute before deleting)
Delete C:\ windows\system\norton~1\regist~1.exe (remove the file's hidden attribute before deleting)

Open the WIN.INI file
Under , both "run=" and "load=" have the path of the Trojan program loaded, and they must be cleared:
run=
load=
Save WIN.INI

You also need to correct the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete WinProfile = c:\command.exe on the right
Close Regedit, restart Windows. OK

6. Asylum v0.1, 0.1.1, 0.1.2, 0.1.3 + Mini 1.0, 1.1
Steps to remove the trojan:

Note: the default filename of the trojan program is wincmp32.exe, but the program can change the filename freely.
We can remove the trojan based on the two files system.ini and win.ini that it modifies.
Open the system.ini file
Under there is a "shell=filename". The correct filename is explorer.exe
If it is not "explorer.exe", then that file is the trojan program. Find it and delete it.
Save and exit system.ini
Open the win.ini file
Under there is a run=
If you see a path and filename after the =, you must delete it.
The correct state is that there is nothing after run=.
The path and filename after the = is the trojan; find it and delete it.
Save and exit win.ini.
OK

7. AttackFTP
Steps to remove the trojan:

Open the win.ini file
Under there is load=wscan.exe
Delete wscan.exe; the correct form is load=
Save and exit win.ini.

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete Reminder="wscan.exe /s" on the right
Close Regedit, restart into the MS-DOS system
Delete C:\windows\system\ wscan.exe
OK

8. Back Construction 1.0 - 2.5
Steps to remove the trojan:

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete "C:\WINDOWS\Cmctl32.exe" on the right
Close Regedit, restart into the MS-DOS system
Delete C:\WINDOWS\Cmctl32.exe
OK

9. BackDoor v2.00 - v2.03
Steps to remove the trojan:

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete ‘c:\windows\notpa.exe /o=yes‘ on the right
Close Regedit, restart into the MS-DOS system
Delete c:\windows\notpa.exe
Note: do not delete the real notepad.exe Notepad program
ＯＫ

10. BF Evolution v5.3.12
Steps to remove the trojan:

Open the registry Regedit
Click through to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete (Default)=" " on the right
Close Regedit, restart the computer again.
Then C:\windows\system\ .exe (the space exe file)
ＯＫ

Of course there are many more trojans; they won't be listed one by one here.
Hehe~~

Floor1　ko20010214	Posted 2003-06-20 00:00
版主　Posts 1,628　Credits 7,296
Sender: shaoxiang(Na Yun) Compiled by: williamlong(2001-11-21 21:04:50), on-site mail 1. Glacier v1.1 v2.2 Glacier is the best domestic trojan. Steps to remove the v1.1 trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Find the following two paths and delete them " C:\windows\system\ kernel32.exe" " C:\windows\system\ sysexplr.exe" Close Regedit Restart into MS-DOS mode Delete the trojan programs C:\windows\system\ kernel32.exe and C:\windows\system\ sysexplr.exe Restart. OK Steps to remove the v2.2 trojan: The server program and path can be defined freely by the user, and the key name written into the registry can also be defined by yourself. So it cannot be stated clearly. You can check the registry and delete suspicious file paths. Restart into MS-DOS mode Delete the trojan program corresponding to the registry entry Restart Windows. OK 2. Acid Battery v1.0 Steps to remove the trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete Explorer ="C:\WINDOWS\expiorer.exe" on the right Close Regedit Restart into MS-DOS mode Delete the trojan program c:\windows\expiorer.exe Note: do not delete the correct ExpLorer.exe program; the only difference between them is i and L. Restart. OK 3. Acid Shiver v1.0 + 1.0Mod + lmacid Steps to remove the trojan: Restart into MS-DOS mode Delete C:\windows\MSGSVR16.EXE Then go back into Windows Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete Explorer = "C:\WINDOWS\MSGSVR16.EXE" on the right HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Delete Explorer = "C:\WINDOWS\MSGSVR16.EXE" on the right Close Regedit Restart. OK Restart into MS-DOS mode Delete C:\windows\wintour.exe then go back into Windows Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete Wintour = "C:\WINDOWS\WINTOUR.EXE" on the right HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Delete Wintour = "C:\WINDOWS\WINTOUR.EXE" on the right Close Regedit Restart. OK 4. Ambush Steps to remove the trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Delete zka = "zcn32.exe" on the right Close Regedit Restart into MS-DOS mode Delete C:\Windows\ zcn32.exe Restart. OK 5. AOL Trojan Steps to remove the trojan: Boot into MS-DOS mode Delete C:\ command.exe (remove the file's hidden attribute before deleting) Note: do not delete the real command.com file. Delete C:\ americ~1.0\buddyl~1.exe (remove the file's hidden attribute before deleting) Delete C:\ windows\system\norton~1\regist~1.exe (remove the file's hidden attribute before deleting) Open the WIN.INI file Under , both "run=" and "load=" have the path of the Trojan program loaded, and they must be cleared: run= load= Save WIN.INI You also need to correct the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete WinProfile = c:\command.exe on the right Close Regedit, restart Windows. OK 6. Asylum v0.1, 0.1.1, 0.1.2, 0.1.3 + Mini 1.0, 1.1 Steps to remove the trojan: Note: the default filename of the trojan program is wincmp32.exe, but the program can change the filename freely. We can remove the trojan based on the two files system.ini and win.ini that it modifies. Open the system.ini file Under there is a "shell=filename". The correct filename is explorer.exe If it is not "explorer.exe", then that file is the trojan program. Find it and delete it. Save and exit system.ini Open the win.ini file Under there is a run= If you see a path and filename after the =, you must delete it. The correct state is that there is nothing after run=. The path and filename after the = is the trojan; find it and delete it. Save and exit win.ini. OK 7. AttackFTP Steps to remove the trojan: Open the win.ini file Under there is load=wscan.exe Delete wscan.exe; the correct form is load= Save and exit win.ini. Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete Reminder="wscan.exe /s" on the right Close Regedit, restart into the MS-DOS system Delete C:\windows\system\ wscan.exe OK 8. Back Construction 1.0 - 2.5 Steps to remove the trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete "C:\WINDOWS\Cmctl32.exe" on the right Close Regedit, restart into the MS-DOS system Delete C:\WINDOWS\Cmctl32.exe OK 9. BackDoor v2.00 - v2.03 Steps to remove the trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete ‘c:\windows\notpa.exe /o=yes‘ on the right Close Regedit, restart into the MS-DOS system Delete c:\windows\notpa.exe Note: do not delete the real notepad.exe Notepad program ＯＫ 10. BF Evolution v5.3.12 Steps to remove the trojan: Open the registry Regedit Click through to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete (Default)=" " on the right Close Regedit, restart the computer again. Then C:\windows\system\ .exe (the space exe file) ＯＫ Of course there are many more trojans; they won't be listed one by one here. Hehe~~

Floor2　tanglu_sd	Posted 2003-06-21 00:00
高级用户　Posts 271　Credits 948　From sd
Not bad, collected

Floor3　xqx	Posted 2010-08-14 23:07
初级用户　Posts 25　Credits 28
This is a moderator's post, so you have to read it. Following that idea, it might possibly be made into something like this (I haven't tried it): reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " C:\windows\system\ kernel32.exe " /f reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " C:\windows\system\ sysexplr.exe " /f del /f /q /s>nul C:\windows\system\ kernel32.exe del /f /q /s>nul C:\windows\system\ sysexplr.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " Explorer" /t reg_sz /d " C:\WINDOWS\expiorer.exe " /f /f del /f /q /s>nul c:\windows\expiorer.exe del /f /q /s>nul C:\windows\MSGSVR16.EXE reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " Explorer" /t reg_sz /d " C:\WINDOWS\MSGSVR16.EXE " /f reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices " /v " Explorer" /t reg_sz /d " C:\WINDOWS\MSGSVR16.EXE " /f del /f /q /s>nul C:\windows\wintour.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " Wintour" /t reg_sz /d " C:\WINDOWS\WINTOUR.EXE " /f reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices " /v " Wintourr" /t reg_sz /d " C:\WINDOWS\WINTOUR.EXE " /f reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " zka" /t reg_sz /d " zcn32.exe " /f del /f /q /s>nul C:\Windows\ zcn32.exe del /f /q /s>nul C:\ command.exe del /f /q /s>nul C:\ americ~1.0\buddyl~1.exe del /f /q /s>nul C:\ windows\system\norton~1\regist~1.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " WinProfile" /t reg_sz /d " c:\command.exe " /f del /f /q /s>nul c:\WINDOWS\wscan.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " Reminder" /t reg_sz /d " wscan.exe /s " /f del /f /q /s>nul C:\windows\system\ wscan.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " C:\WINDOWS\Cmctl32.exe r" /f del /f /q /s>nul C:\WINDOWS\Cmctl32.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " c:\windows\notpa.exe /o=yes " /f del /f /q /s>nul c:\windows\notpa.exe reg delete " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " /v " (Default)=" "" /f del /f /q /s>nul C:\windows\system\ .exe [ Last edited by xqx on 2010-8-16 at 18:15 ]