Re: Trojan found...

One additional registry location you might want to check is this =>

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components

Used by Subseven remote access Trojan

Regards,

Patrick Nolan
Virus Researcher - Fortinet
pnolan@fortinet.com

• Original Message ----- From: "aladin168" <aladin168@hotmail.com> To: <incidents@securityfocus.com> Sent: Thursday, April 24, 2003 7:22 AM Subject: Re: Trojan found...

| In-Reply-To: <20030417230836.23848.qmail@web41603.mail.yahoo.com>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOn
| ce]
| · [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

>--------------------------------------------------------------------------

>--------------------------------------------------------------------------

--

| Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the


to

| ensure your place. http://www.securityfocus.com/BlackHat-incidents


--

|

|



----------------------------------------------------------------------------
Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the 
world's premier event for IT and network security experts.  The two-day 
Training features 6 hand-on courses on May 12-13 taught by professionals.  
The two-day Briefings on May 14-15 features 24 top speakers with no vendor 
sales pitches.  Deadline for the best rates is April 25.  Register today to 
ensure your place. 
http://www.securityfocus.com/BlackHat-incidents 
----------------------------------------------------------------------------