What is Mosucker as well as dismissal instructions
This RAT is presented as a apparatus which is ostensible to assistance net administrators to carry out computers remotely. But a discerning investigation of a businessman outline leaves no disbelief which this RAT apparatus can be used for bootleg actions. It affects such doing systems as Windows 95/98/XP/ME/WinNT/2000. The harassment was combined by a German hacker called Krusty from a organisation called Inferno Industries. The harassment is created in Visual Basic 6 as well as dense with ASPack. Many versions appeared from Dec 1999 to Mar 2004. The infection appearance in such countries as Australia, France as well as a United States. Some versions additionally have a capability to invalidate Firewall insurance upon a putrescent PC.
From a publisher:
“MoSucker is a backdoor trojan, coded with Visual Basic 6. The server needs a vb6-runtime-dll msvbvm60.dll. It does no longer need any ocx-files (you can shift this in a EditServer) This trojan is created for Windows 95/98, it wasn’t tested upon alternative systems similar to 98se, NT as well as 2K, though it should work there, too. MoSucker is a most appropriate or a single of a most appropriate trojans ever automatic with vb. Have fun with it!’
2.30: From a doc: ‘This list will kill (terminate) all obvious firewalls as well as Anti-Virus programs now using upon a victim’s system. It will NOT undo or currupt these programs, it will only stop them.’
3.0a: From a doc: ‘This list will kill (terminate) all obvious firewalls as well as Anti-Virus programs now using upon a victim’s system. It will NOT undo or currupt these programs, it will only stop them. Kills ZoneAlarm (Including Pro), LockDown, Norton AntiVirus, Trojan Check, Trojan First Aid Kit, MS Visual Studio Spy tools, Dr. Watson, RegEdit, The Cleaner, Trojan Defense Suit 3, Anti Trojan, Dr. Solomon, Norton Utilities, McAffee Virus scan, Kaspersky Anti Virus RegRun II, Tau Monitor, ANTS as well as AtGuard … as well as others’
MoSucker 3.0b – Released Nov. 20th 2002
!!IMPORTANT!!
1) MoSucker 3.0b servers have been not concordant with a MoSucker 3.0a revise server. 2) If we get any runtime errors, govern Runtimes.exe in a runtimes folder. 3) Check a announcements in a forum for a ultimate open CGI locations. 4) The revise server cannot shift a idol for servers which embody a runtimes. Use reshacker or microangelo. Icon is 32×32 sixteen colors
Changes/bugfixes for 3.0b
- Modification of settings encryption for increasing server security. – Edit server as well as customer implement runtimes if indispensable (since nobody can read). – MSN presentation custom blunder fixed. – MSN presentation no longer gives manifest blunder summary when use is down. – Kill using complement slight checkbox blunder upon reload fixed. – File exists slight for firm files firm (bug rare) – Improved blunder doing in revise server. – Removed webdl.ocx dependancy.
MoSucker ErEbuS:
Ive packadged a mosucker trojan in to a latest trojan installer which compresses a record differently. This additionally installs a visible simple 6.0 runtimes with it. Copies record to complement office sensitively as well as runs mosucker. Ofcourse, after it runs a mosucker server, a antivirus will collect it up. we leave this complaint to you.
These have been a trustworthy server’s settings: port: 1037 (default) filename: wsvchost.exe repudiate internal connectors events: deleting/restoring of netstat as well as kills a threads of avs/fw melts a install
ErEbuS”
Mosucker primer removal:
Kill processes:
backdoor.mosucker.11.exe, createserver.exe, editserver 2.0.exe, editserver.exe, giveaway pink.exe, mosucker 2.0.exe, mosucker.exe, pics.zip.exe, server.exe, server1.exe, server2.exe, server3.exe, server4.exe, server5.exe, skinmaker.exe, [system root]\jthh.exe, [system root]\msnetcfg.exe, [system root]\system\svr.exe, [system root]\temp\pkg310.exe, [system root]\temp\pkg332.exe, [system root]\temp\pkg3392.exe, [system root]\unin0686.exe, [system root]\vvuijoe.exe, v young.exe
Delete registry values:
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\