|
Bionet
The 0.8x versions of this trojan are win 95/98 only.
However the 0.9x (and above) have versions each for 95/98 And NT.
The client-server protocol is the same, so an NT client can hack a 95/98 infected machine, and a 95/98 client can hack an NT infected system just the same. File transfer, message boxes, screen and key capture, move mouse and reboot/shutdown are a few of its commands. You usually notice your infected because you no longer can reboot or shutdown the computer (as the trojan wont shutdown.) It also makes it impossible to reboot to MSDOS mode to delete the trojan.
How to remove ( this is pretty technical )
You will need a Windows Boot disk to repair your system from this trojan.
If you do not have a boot disk, its easy to make, and all you need is a blank floppy disk.
Making a boot disk
Click Start, go to Settings, and choose Control Panels. In here, open the Add/Remove Programs control panel.
One tab at the top should be labeled 'Startup Disk.' Click that tab, then click the button labeled 'Create Disk...'
You may need your Windows 95 or 98 CDROM, and you will need to put a blank floppy disk in the floppy drive.
After it creates the disk, eject your Windows CDROM however leave the floppy in place.
You will want to boot up with the floppy disk in the drive, and this should boot into a clean uninfected copy of MS-DOS.
Here, you will be at an A:\> prompt.
Type C: to switch to your hard drive.
Then type cd \windows to change to the right folder.
You should now be looking at an C:\Windows\> prompt.
First you need to make the trojan visible (as it is hidden by default.)
To do this, type attrib libupd~1.exe -h
Next, you can remove the trojan by typing:
del libupd~1.exe
Next, eject the floppy disk and restart your computer (Its safe to use the reset button or power switch from an MSDOS floppy disk.)
When windows reloads, you will be uninfected, however you will need to fix your registry, as indicated below..
Click Start, and go to Run. In the box, type regedit and click OK.
When regedit starts, you will see a file-like tree on the left hand panel. Open the folders to follow the path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Click on 'Run' and the right-hand panel will change. Look for the item titled: WinLibUpdate = "c:\windows\libupdate.exe -hide"
Right click on 'WinLibUpdate' and choose Delete.
Close regedit.
Then reboot , your pc will hopefully be clean now .
|
|
