Notices

Overclockers Forums > Software > Internet, Networking, and Security
Internet, Networking, and Security Networking and Viruses/Malware trouble. Get the answers here.
Forum Jump

backdoor.subseven22 (trojan)

Post Reply New Thread Subscribe Search this Thread
 
 
Thread Tools
Old 02-13-03, 12:50 PM Thread Starter   #1
winny22
Member



Join Date: Nov 2002
Location: uk

 
backdoor.subseven22 (trojan)


hi i downloaded a trojan and norton anti virus quarantined it does this mean my pc is infected or do i just delete the file from quarantine thanxs guys
winny22 is offline   QUOTE Thanks
Old 02-13-03, 01:00 PM   #2
nemisys
Member

 
nemisys's Avatar 

Join Date: Dec 2002
Location: Pennsylvania

 
If Norton's quaranteened it, this typically means it found it before it had a chance to infect your computer and your computer should not be infected.

Once quaranteened, you ca ncompletely remove the file by deleting from quaranteen.
nemisys is offline   QUOTE Thanks
Old 02-13-03, 01:10 PM Thread Starter   #3
winny22
Member



Join Date: Nov 2002
Location: uk

 
thanxs nemisys didnt want to reformatt thanxs again
winny22 is offline   QUOTE Thanks
Old 02-13-03, 02:11 PM   #4
PsYcO CyBrArIaN
Member

 
PsYcO CyBrArIaN's Avatar 

Join Date: Jan 2003
Location: NORAD

 
As well, you might want to back it up with an auxillary scan from like house call and a trojan specific remover(or a general one ) youll be surprised how many times running two or even three can find something else or find the same one because the other couldnt fully delete it. Hopefully it hasnt replicated to your boot sector...
PsYcO CyBrArIaN is offline   QUOTE Thanks
Old 02-13-03, 02:29 PM   #5
nemisys
Member

 
nemisys's Avatar 

Join Date: Dec 2002
Location: Pennsylvania

 
Might try this link for a web based scan.
http://housecall.antivirus.com/
nemisys is offline   QUOTE Thanks
Old 02-13-03, 08:40 PM   #6
Enyo
Member

 
Enyo's Avatar 

Join Date: Feb 2003
Location: eating Seal@the.sea

 
i got sub seven, never noticed till i started using e-scan. (although e-scan sucks like hell it gets itself suck in a loop while scanning, it scans half the pc then scans that half again through the hub, sends info to the hub and back to itself then it scans the hd again half waythough. makes me wanna kick it.)
Enyo is offline   QUOTE Thanks
Old 02-13-03, 10:52 PM   #7
[EG]~NaTz~
Member



Join Date: Mar 2002
Location: pittsburgh pa

 
hey if u got subseven well uhh all i should say is watch what u download...

u guys know what subseven is used for correct?
[EG]~NaTz~ is offline   QUOTE Thanks
Old 02-13-03, 10:56 PM   #8
cack01
Member

 
cack01's Avatar 

Join Date: Mar 2002
Location: San diego or UC Davis

 
sounds like the perfect back door virus. http://news.com.com/2100-1001-254164.html


EDIT: man do I have a bad memory. We actually talked about using the GUI version of this virus to monitor the computer cafe at work. Its great (as long as your not infected, b/c it hides itself very very well and can replicate to come back once removed). The version we had let us do all types of things to the other user's screen, see what their seeing, control their mouse/keyboard, file transfer, and a whole lot more. Its impressive, but man I would never never want to be infected by it.

__________________
LianLi PC70
Dual PIII 1.0@1.2 (7.5*160) on ABIT VP6
768 PC-133
Geforce 4 TI4200 310/580
Sound Blaster Audigy Platinum
2x 40 GB Seagate 5400 w/Striping
1x 80 GB Seagate 7200
24X Yamaha CD-RW
Sony 520GS 21"

Last edited by cack01; 02-13-03 at 11:05 PM.
cack01 is offline   QUOTE Thanks
Old 02-14-03, 03:13 AM Thread Starter   #9
winny22
Member



Join Date: Nov 2002
Location: uk

 
will a formatt get rid of it thanxs i done a scan from trend and it was a clear scan i think norton got it first thanxs again
winny22 is offline   QUOTE Thanks
Old 02-14-03, 03:24 AM   #10
I.M.O.G.
Homeless Leader

 
I.M.O.G.'s Avatar 

Join Date: Nov 2002
Location: Rootstown, OH

10 Year Badge
 
i do not know how I got it but when i had broadband internet i used norton systemworks 2002 including internet security and antivirus... and didn't download anything which i didnt know exactly what it was, but i still got the backdoor subseven. I would get security alerts every 20 minutes telling me someone from a different i.p. address was trying to connect to my computer... i used another one of my favorite programs to track approximately where the attack was coming from geographically and they were never consistent at all, it was always some place different, and it had no geographic concentration whatsoever. i figured they were bogus security warnings... but anyways i keep all my data constantly backed up so i just reformatted and i don't have the problem anymore.

__________________
The OC Forums Way
We are a team. We are a community. We are a fellowship made strong by mutual respect and shared dedication to the task of enriching all who come here.
The OC Forums Thank You Thread
Put your computer to work for our OC Forum Teams!
Try out our POST TEMPLATES, they save you time answering common questions!

I spend half my money on CPUs, GPUs, and Liquid Nitrogen. The other half I waste.
I.M.O.G. is offline Author Profile Benching Profile Folding Profile Heatware Profile   QUOTE Thanks
Old 02-14-03, 03:27 AM   #11
I.M.O.G.
Homeless Leader

 
I.M.O.G.'s Avatar 

Join Date: Nov 2002
Location: Rootstown, OH

10 Year Badge
 
holy sh*t that news link was a good read... thats some nasty stuff, im glad i had the firewall blocking all that garbage. i never thought the firewall was really good for much, guess i was wrong.

BTW, i was connected to the internet through a router with 8 other computers, do you know if the virus is network aware so that it could travel directly from computer to computer over the network? there were a couple girls living in my house that would just open any email or attachment they got without thinking about it, i wonder if i didnt catch it from them.

__________________
The OC Forums Way
We are a team. We are a community. We are a fellowship made strong by mutual respect and shared dedication to the task of enriching all who come here.
The OC Forums Thank You Thread
Put your computer to work for our OC Forum Teams!
Try out our POST TEMPLATES, they save you time answering common questions!

I spend half my money on CPUs, GPUs, and Liquid Nitrogen. The other half I waste.
I.M.O.G. is offline Author Profile Benching Profile Folding Profile Heatware Profile   QUOTE Thanks
Old 02-14-03, 11:47 AM   #12
cack01
Member

 
cack01's Avatar 

Join Date: Mar 2002
Location: San diego or UC Davis

 
Quote:
Originally posted by I.M.O.G.

BTW, i was connected to the internet through a router with 8 other computers, do you know if the virus is network aware so that it could travel directly from computer to computer over the network? there were a couple girls living in my house that would just open any email or attachment they got without thinking about it, i wonder if i didnt catch it from them.
I really don't remember, I doubt it. Although it is possible, b/c the version that I am familiar with had an option to scan a range of IP addresses and also to look for a specific open port. So making it self aware to copy would not be too hard for the maker.

__________________
LianLi PC70
Dual PIII 1.0@1.2 (7.5*160) on ABIT VP6
768 PC-133
Geforce 4 TI4200 310/580
Sound Blaster Audigy Platinum
2x 40 GB Seagate 5400 w/Striping
1x 80 GB Seagate 7200
24X Yamaha CD-RW
Sony 520GS 21"
cack01 is offline   QUOTE Thanks
Old 02-14-03, 05:30 PM   #13
Johnny Knoxville
Disabled



Join Date: May 2002

 
I used subseven a few times on some people, you can basically access their hard disk and do anything in their computer, like viewing a screenshot of what they're currently doing, opening their cd-rom , deleting files, making fake error messages. Conclusion: make sure you don't have the trojan
Johnny Knoxville is offline   QUOTE Thanks
Old 02-14-03, 10:31 PM   #14
Hayduke
Registered

 
Hayduke's Avatar 

Join Date: Aug 2001
Location: Zen State

 
Quote:
Originally posted by I.M.O.G.
i do not know how I got it but when i had broadband internet i used norton systemworks 2002 including internet security and antivirus... and didn't download anything which i didnt know exactly what it was, but i still got the backdoor subseven. I would get security alerts every 20 minutes telling me someone from a different i.p. address was trying to connect to my computer... i used another one of my favorite programs to track approximately where the attack was coming from geographically and they were never consistent at all, it was always some place different, and it had no geographic concentration whatsoever. i figured they were bogus security warnings... but anyways i keep all my data constantly backed up so i just reformatted and i don't have the problem anymore.

Those are not bogus warnings. They are legitimate scans looking for infected computers. There are an amazing number of infected computers worldwide and an even larger number of freaks who do nothing but sit in front of their computer every spare minute scanning the internet for unprotected computers to exploit. Before I installed my router my Zonealarm logs showed thousands of probes from all over the world just randomly looking for open trojan ports. If you see scans for ports 1243, 2772, 2773, 6771, 6776, 7215, 27374 (most common), 54283, they are looking for Sub7. Other various trojan ports are 1080, 50505, 54320, 60001, and numerous others.

Check out my logs for a 3 month period ONLY for Sub7 port 27374 scans:

http://myweb.cableone.net/hayduke/sub7_probe_log.html

You should see my main log - it's massive! Sometimes the probes come from a certain part of the world for awhile then suddenly stop. Then somewhere else for a few weeks. Montreal was really bad for awhile. I had several coming from Seoul, Korea also.

Some of the WORST internet providers for lax security are Rogers, Road Runner, Shaw Cable and Videotron. I've had more probes from those domains than any other. Most providers frown on port scanning but these obviously don't care.

Now that I have a hardware firewall NOTHING gets through to Zonealarm. Kind of boring now. I miss back-tracking the probes of the day
Hayduke is offline   QUOTE Thanks
Old 02-15-03, 03:37 AM Thread Starter   #15
winny22
Member



Join Date: Nov 2002
Location: uk

 
i cant see any unusual activity goin on in my pc obvious when someone is looking through the pc the internet icon would flash.green anyway the matter is would a formatt cure the trojan or has my norton stopped it gettin thru .any way thanxs for all the replys guys i rely on this support thanxs again.
winny22 is offline   QUOTE Thanks
Old 02-15-03, 11:11 AM   #16
Hayduke
Registered

 
Hayduke's Avatar 

Join Date: Aug 2001
Location: Zen State

 
Quote:
Originally posted by winny22
i cant see any unusual activity goin on in my pc obvious when someone is looking through the pc the internet icon would flash.green anyway the matter is would a formatt cure the trojan or has my norton stopped it gettin thru .any way thanxs for all the replys guys i rely on this support thanxs again.
Sure a format will clean out anything you have. That may be the only way to completely repair the damage. That thing alters a lot of files. I got it once but caught it immediately. I accidentally double clicked on a file I suspected instead of right clicking to scan it! Oops. Anyway it really scrambled lots of dll files and after 5 installs of Windows 98 I still haven't fixed them all. It would be easier to just wipe my drive and start over which is what I ended up doing with my backup system.
Hayduke is offline   QUOTE Thanks
Old 02-15-03, 12:11 PM   #17
cack01
Member

 
cack01's Avatar 

Join Date: Mar 2002
Location: San diego or UC Davis

 
If you did not run the virus, I think you should be ok.

__________________
LianLi PC70
Dual PIII 1.0@1.2 (7.5*160) on ABIT VP6
768 PC-133
Geforce 4 TI4200 310/580
Sound Blaster Audigy Platinum
2x 40 GB Seagate 5400 w/Striping
1x 80 GB Seagate 7200
24X Yamaha CD-RW
Sony 520GS 21"
cack01 is offline   QUOTE Thanks
Old 02-15-03, 07:12 PM   #18
Hayduke
Registered

 
Hayduke's Avatar 

Join Date: Aug 2001
Location: Zen State

 
What did Norton say about the quarantine? Is there some reason is wasn't actually removed? If it can't remove it for some reason find out why. Maybe you can fix it. You can always format as a last resort but try to fix it first.
Hayduke is offline   QUOTE Thanks
Old 02-16-03, 03:26 AM Thread Starter   #19
winny22
Member



Join Date: Nov 2002
Location: uk

 
norton couldnt fix it ,said quarantine it (recommended) but i deleted it. thanxs
winny22 is offline   QUOTE Thanks

Post Reply New Thread Subscribe


Overclockers Forums > Software > Internet, Networking, and Security
Internet, Networking, and Security Networking and Viruses/Malware trouble. Get the answers here.
Forum Jump

Thread Tools Search this Thread
Search this Thread:

Advanced Search


Mobile Skin
All times are GMT -5. The time now is 04:14 AM.
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2013, vBulletin Solutions, Inc.
You can add these icons by updating your profile information to include your Heatware ID, Benching Profile ID or your Folding/SETI profile ID. Edit your profile!
X

Welcome to Overclockers.com

Create your username to jump into the discussion!

New members like you have made this the best community on the Internet since 1998!


(4 digit year)

Why Join Us?

  • Share experience
  • Max out your hardware
  • Best forum members anywhere
  • Customized forum experience

Already a member?