Remote control Trojan Issue

[Elijah2010]

Hi all,

Our school campus computer network access to the large number of windows as the widely used computer operating system, which is currently endemic in a variety of Internet worms for windows system, rampant, so the computer security and virus protection very important. In our daily work, many users have encountered problems that are related to computer network security, virus protection, where it is necessary to guide users on how to secure and stable computer. Can anybody have any idea about how to secure from Remote control Trojan. Please suggest.

[Steve123]

In the desktop environment by crtl + alt + del keys one after the pop-up options, choose one item to change the password after the required password If you have previously lacked a password administrator, then do not need the old password of that input, only direct Enter the new password.The other user password is In the Start > Control Panel > Users and Passwords > select a user name > click Set Password. All the best.

[Shen]

This is an irc chat room based on the control of Trojans.
1. The first to use netstat-an command to determine whether your system has 113 ports open
2. Use fport command look out which program is listening port 113 fport tools to download, for example, we use fport see the following results:
Pid Process Port Proto Path
392 svchost -> 113 TCP C: \ WINNT \ system32 \ vhos.exe
This will determine the listening port in the 113 and the Trojans are programs where vhos.exe path c: \ winnt \ system32 under.
3. Identified the Trojan name (that is, the procedures for monitoring port 113), the look in Task Manager to the process, and use the Manager to end the process.
4. In the Start - Run, type regedit to run registry management program, just look in the registry to find the program and delete all related keys.
5. To the directory where the Trojan horse program to remove the Trojan. (Usually Trojan also includes a number of other procedures, such as rscan.exe, psexec.exe, IPcpass.dic, IPcscan.txt so, according to Trojans different, different documents, you can see the program and modifying the time identify and monitor 113 port of Trojan programs and other programs)
6. To re-start the machine.

[Big Fish]

Description 3389 is the first port terminal windows opened by remote management port, it is not a Trojan horse program, make sure whether the service is open to you. If it is not necessary, turn off the service. win2000 Close method:
#win2000server Start -> Programs -> Administrative Tools -> Services Terminal Services service entry found, select the Properties option to change the startup type to Manual, and stop the service.
#win2000pro Start -> Settings -> Control Panel -> Administrative Tools -> Services Terminal Services service entry found, select the Properties option to change the startup type to Manual, and stop the service.
#winxp shut down the way: In my computer, right click select Properties -> Remote, to which the Remote Assistance and Remote Desktop are two options box to remove the hook.

[Zachary]

First description 4899 port is a remote control software (remote administrator) the server listening port, he can not be a Trojan horse program, but with remote control function, usually anti-virus software can not detect it come, first determine whether the service is you open and is required. If not, please close it. Please Start -> Run, type cmd, then cd C: \ winnt \ system32 (your system installation directory), enter the r_server.exe / stop and press Enter. Then enter r_server / uninstall / silence to the C: \ winnt \ system32 (system directory) under the three files to delete r_server.exe admdll.dll radbrv.dll. All the best.

[Snake08]

Check the procedure:
1. The first to use fport command identified in the 5800 and 5900 the port monitor program location (usually c: \ winnt \ fonts \ explorer.exe)
2. In the Task Manager and kill the relevant process (note that the system itself is a normal, please note! If this penalty can be re-run c: \ winnt \ explorer.exe)
3. Deleted C: \ winnt \ fonts \ explorer.exe process in.
4. Delete registry
HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run item in the Explorer
5. Reboot the machine.