-=PCTechTalk=- Re: netbus

Here you go;
HackFix - NetBus Removals

www.hackfix.org/netbusfix/ -
Welcome to our pages on the NetBus trojan. Within you will find information
not just about NetBus, but how to check yourself for it as well as how to
remove it Yourself, without using an "uninstaller" or any .exe

NetBus can be placed on your system in the same way as Back Orifice, and the
same rules about programs and installers applies here as well.
99% of the time NetBus is gotten when you download a program from the
internet, be it a freeware game on your friends webpage, to a members only
warez ftp site... It can be an exe installer of itself, OR can be hidden
inside a REAL setup.exe, usually planted in it and totally separate from
whomever released the actual program.

NetBus is very similar to Back Orifice, and has many of the same features.
It also has more features added, which are there only to annoy and interfere
with the computers operator. However (in NetBus v1.60 and above) there is
also a command which allows you to remove the server totally (Which actually
works.)

There are three versions of this program which are still in use. Versions
1.5x, 1.60, and 1.70. Each have a different removal process so we have
included sections for each. Our scanner on the page will also report this
version to you.

Unfortunately with version 1.70 (and above) the port can be changed from
12345. This brings the same scanning problem we have with BackOrifice, as we
can only scan one port. If you are infected with a NetBus server on a port
other than 12345, our scans cant find it to tell you. In this case you would
be better off looking at your registry and looking for lines similar to the
ones NetBus installs (Shown in the 1.70 removal instructions.)

We would like to encourage safe internet usage when it comes to downloads
and programs.. Never accept an installer, or an exe from a non-reputable
site. Even ours! We will never distribute exe files or "auto magic removers"
for that very reason.
++ There is more on the web site.

Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews http://www.mwn.ca/ 

*********** REPLY SEPARATOR  ***********

On 26/03/2004 at 11:40 PM =^;^= wrote:

Is anyone familiar with this program?
Software isn't released, it's allowed to escape



To unsub or change your email settings:
http://www.freelists.org/webpage/pctechtalk

To access our Archives:
http://groups.yahoo.com/group/PCTechTalk/messages/
http://www.freelists.org/archives/pctechtalk/

For more info:
http://www.freelists.org/cgi-bin/list?list_id=pctechtalk

Other related posts: