Services    Trojan info    Chat    Downloads      About Us      Contact  Us     Help Forum     Support Us    Search

Eclypse
This trojan is basically a secret ftp server  installer . The server once executed installs a ftp server on the infected machine allowing root access to all the hard drives files  ( execute , delete , write, read )

To remove this trojan  follow this instruction :
Open regedit ( start , run , type regedit )
Then go to the following path
KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Click on 'Run' and the righthand panel will change. Look for the item titled: Rnaapp ="C:\WINDOWS\SYSTEM\rmaapp.exe"
Right click on 'Rnaapp' and choose Delete.
Close regedit
Next reboot your computer.
When windows restarts, open Windows explorer, and in the directory C:\Windows\System\ find and delete the file rmaapp.exe.
Be sure Not to delete the file rnaapp.exe (noting the rn vs rn) as it is a valid system file

Evil Ftp
Evil ftp sets the infected computer up as a full ftp server allowing access to all files on the infected computer the same way one can access an ftp site .

Evil ftp opens port 23456 on the infected computer and the server is hidden in a file called fixIT.exe.
Evil ftp does not register into your registry so the best way to kill this program is to delete the fixIT.exe file from your computer , then you should be ok

It is also a good idea to run a decent firewall program and to have a good trojan scanner for your computer , if you don't have either of these then please visit our files archive as we have a very good range of protection programs to stop and remove trojans from your computer .

Eclipse
This trojan is pretty hard to remove but it isn't impossible . It has your average trojan features and is often used because its not readily picked up by virus scanners .

Removal :
Open regedit ( click start , run and type regedit )
Follow the following path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Look for the key that says :
bybt = "c:\windows\system\eclipse2000.exe"
Now go to  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Look on the right hand side for the key:
cksys = "c:\windows\system\ could be anything .exe"
Please NOTE what the filename is here, as it could be anything. You will need to know the name to delete later.
Right click on cksys, and choose delete.
Next, close HKEY_LOCAL_MACHINE, and follow the path:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
At the end, click on 'Run' once, and the right hand panel should change.
Look on the right hand side for the key:
ewgiops = "c:\windows\system\eclipse2000.exe"
Right click on ewgiops, and choose delete.
Close regedit and reboot your PC.
Do go away yet, your only half done. After you reboot, you still need to delete the trojan program itself.
The trojan is at C:\WINDOWS\System\eclipse2000.exe and in C:\windows\system\ under the filename you noted from above.
They can be deleted through Windows Explorer, or simply by going into My Computer, C:, and Windows. Once you find the file, right click on it and choose Delete. Then empty your recycling bin.