Backdoor.SubSeven22 - Removal

This Trojan can be difficult to remove because it does not make the same changes to all systems. To remove this Trojan, you need to:

• Remove any references to the Trojan from the following registry keys:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
• Delete every occurrence of the Trojan's name in the Win.ini and System.ini files.
• Shut down and turn off the computer to remove the Trojan from memory, or use a utility capable of stopping the process, such as Dllview.exe.
• After restarting, delete all instances of the Trojan.
• Examine the following registry keys:
  HKEY_CLASSES_ROOT\exefile\shell\open\command
  HKEY_CLASSES_ROOT\.dl
  Remove any value containing a reference to the name of the .exe launcher that the Trojan dropped, or delete the HKEY_CLASSES_ROOT\.dl registry key if it exists.
• Delete all randomly named variables from the following keys:
  HKEY_LOCAL_MACHINE\Hardware\Data
  HKEY_LOCAL_MACHINE\Hardware\Enum
  HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
• Run a full system scan.

For detailed instructions on how to do this, see the sections that follow. Follow the instructions in the order that they appear.

NOTE: These instructions assume that you are familiar with Windows conventions and are comfortable editing and deleting Windows files. If you are not, we suggest that you obtain the services of a qualified computer consultant.

To remove entries from the registry
You must identify and remove any registry entries that allow the Trojan to load when Windows starts. It is important that you write down the file names as noted in the previous section. You will need to edit the registry again after restarting the computer.

CAUTION: We strongly recommend that you back up the system registry before making any changes to it. Incorrect changes to the registry may result in permanent data loss or corrupted files. Be sure to modify only the specified keys. See the document How to back up the Windows 95/98/NT registry before proceeding.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
   
   NOTE: If the Registry Editor does not open, and you are sure that you have typed the command as shown, the Trojan has modified the registry so that .exe files will not run. In this case, first make a copy of the file Regedit.exe as Regedit.com, and then use the copy to edit the registry. For instructions on how to do this, read the section To copy Regedit.exe to Regedit.com at the very end of these removal instructions.
   
3. Browse to and select the following subkey:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
   
4. In the right pane, look for values that do not refer to programs that should run at startup. In most cases, this value will be Winloader.
5. Write down the name of the file that the value is loading, for example:
   
   Winloader C:\Windows\Pl9k09t.exe
   
6. Delete the suspect value.
   
   NOTE: This does not delete the file itself; it only prevents the file from loading when Windows starts. If you remove a value that loads a program that you want to start when Windows starts, you will need to re-enable the loading of the program.
   
7. Browse to and select the following subkey:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
   
8. Repeats steps 4 through 6.
9. Exit the Registry Editor.

To remove references from Win.ini and System.ini:
You must identify and remove any references to the Trojan from the common load points in Win.ini and System.ini. These will not exist on all systems.

CAUTION: If you find files that are loading from the load points in Win.ini or System.ini, write down the exact name of the file before you remove it. For example, if you find run=pl9k09t.exe, write down pl9k09t.exe before you remove the entry. You will need this information later in the removal procedure.

1. Click Start, and click Run.
2. Type the following, and then click OK:
   
   edit c:\windows\win.ini
   
   The MS-DOS Editor opens.
   
   NOTE: If Windows is installed in a different location, make the appropriate path substitution.
   
   CAUTION: The steps that follow instruct you to remove text from the load= and run= lines of the Win.ini file. If you are using older programs, they may be loading at startup from one of these lines. The Trojan adds lines such as run=<random file name>. If you are sure that the text contained in these lines are for programs that you normally use, we suggest you do not remove them. If you are not sure, you can prevent the lines from loading by placing a semicolon in front of the line, for example:
   
   ; run=accounts.exe
   
3. Locate the load= line within the [windows] section of the Win.ini file; it is usually located near the top of the file.
4. Position the cursor immediately to the right of the equal sign.
5. Press Shift+End to select all of the text to the right of the equal sign, and then press Delete.
6. Repeat steps 5 and 6 for the run= line, which is usually beneath the load= line.
7. Click File, click Exit, and then click Yes when you are prompted to save the changes.
8. Click Start, and click Run.
9. Type the following, and then click OK:
   
   edit c:\windows\system.ini
   
10. Locate the line that begins with shell=
11. Position the cursor immediately to the right of the equal sign.
12. Press Shift+End to select all of the text to the right of the equal sign, and then press Delete.
13. Type the following text:
    
    explorer.exe
    
    The line should now read
    
    shell=explorer.exe
    
    NOTE: Some computers may have an entry other than Explorer.exe after shell=. If this is the case and you are running an alternative Windows shell, then change this line to shell=explorer.exe for now. You can change it back to your preferred shell after you have finished this procedure.
    
14. Click File, click Exit, and then click Yes when you are prompted to save the changes.
15. Exit the System Configuration Editor.

To restart the computer:
Close all programs, shut down the computer, and turn off the power. Wait at least 30 seconds. You must turn off the power to clear memory. Do not just press the Reset button.

To locate and delete files:
You now need to find and delete the files whose names you wrote down previously:

1. Click Start, point to Find, and click Files or Folders.
2. Make sure that "Look in" is set to (C:) and that "Include subfolders" is checked.
3. In the Named box, type the file names that you removed from Win.ini, System.ini, or the registry.
4. Click Find Now. Windows will find the files and display them in the lower pane of the Find dialog box.
5. Delete the displayed files.
6. Right-click the Recycle Bin icon on your desktop, and then click Empty Recycle Bin.
7. Close the Find Files window.

To remove additional entries from the registry:

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and click OK. The Registry Editor opens.
3. Look for the following subkey:
   
   HKEY_CLASSES_ROOT\.d
   
4. If the key exists, delete it.
5. Navigate to and open the following key:
   
   HKEY_CLASSES_ROOT\exefile\shell\open\command
   
   
   CAUTION: Do not inadvertently modify the HKEY_CLASSES_ROOT\.exe subkey. Changes made to that key can prevent .exe files (program files) from running. Be sure to navigate past this all the way down to the HKEY_CLASSES_ROOT\exefile\shell\open\command subkey as shown in the following figure.
   
   
   <- This is the subkey that you will edit.
   
   
6. Double-click the (Default) value in the right pane.
7. Delete the current value data, and then type: "%1" %* (That is, type the following characters: quote-percent-one-quote-space-percent-asterisk.)
   
   NOTE: The Registry Editor will automatically enclose the value within quotation marks. When you click OK, the (Default) value should look exactly like this: ""%1" %*"
   
   Make sure that you completely delete all value data in the command key prior to typing the correct data. If a space is left accidentally at the beginning of the entry, any attempt to run program files will result in the error message, "Windows cannot find .exe." If this happens to you, then start over at the beginning of this section, making sure to completely remove the current value data.
   
8. Locate the following registry keys. Remove any randomly named values that have been added:
   
   HKEY_LOCAL_MACHINE\Hardware\Data
   HKEY_LOCAL_MACHINE\Hardware\Enum
   HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
   
9. Exit the Registry Editor.

To run a full system scan:
When you have finished with the removal procedure, start Norton AntiVirus (NAV) and run a full system scan. Unless you are using NAV 2001, make sure that NAV is set to scan all files.

To copy Regedit.exe to Regedit.com:
Do this only if the Registry Editor does not open when you follow the instructions in the first section of the removal instructions, "To remove entries from the registry." In this situation, because the worm modified the registry so that you cannot run .exe files, you must first make a copy of the Registry Editor as a file with the .com extension, and then run that file.

1. Do one of the following, depending on which version of Windows you are running:
   • Windows 95/98 users: Click Start, point to Programs, and click MS-DOS Prompt. A DOS window opens at the C:\Windows prompt. Go on to step 2 of this section.
   • Windows Me users: Click Start, point to Programs, point to Accessories, and then click MS-DOS Prompt. A DOS window opens at the C:\Windows prompt. Go on to step 2 of this section.
   • Windows NT/2000 users:
     1. Click Start, and click Run.
     2. Type the following and then press Enter:
        
        command
        
        A DOS window opens.
        
     3. Type the following, and then press Enter:
        
        cd \winnt
        
     4. Go on to step 2 of this section.
   • Windows XP:
     1. Click Start, and click Run.
     2. Type the following, and then press Enter:
        
        command
        
        A DOS window opens.
        
     3. Type the following, and then press Enter after typing each one:
        
        cd\
        cd \windows
        
     4. Proceed to step 2 of this section.
        
2. Type the following, and then press Enter:
   
   copy regedit.exe regedit.com
   
3. Type the following, and then press Enter:
   
   start regedit.com
   
   The Registry Editor will open in front of the DOS window. After you finish editing the registry, exit the Registry Editor, and then exit the DOS window, as well.
   

1. Go back to the beginning of these removal instructions, and start again with the section, "To remove entries from the registry."

Technical Details