> Spyware Encyclopedia Page 52 > Evil FTP

Evil FTP removal

Spyware Evil FTP Information
Name: Evil FTP Category: RAT Date: 1998-09-09 Coded in: Visual Basic. Requires Msinfo.vbx Dangerous: Yes

Evil FTP is one of RAT spywares.
Hidden FTP server. Opens port 23456 tcp. Ostensibly removes nuke, ssping, & teardrop. Instead, installs & runs silently, permitting remote control. Finding it on your computer means that your computer is infected with RAT and crucial data could be endangered or even lost.

Evil FTP description by publisher:

Creator: Important no quotes on anything that I put quotes on... I mean when you write it or you knwo... Ok here you go guys have fun... OverView... What this application does is when it´s run on someones computer it opens up a port & runs in the background so anybody can connect.. Disguised... This application is disguised & fools the user running it that it´ll fix the bugs in win95..the bugs it acts like it´s fixing are "nuke" "ssping" "teardrop" How it runs... Ok what you need to do is give it to the user fool them into taking it which is easy then have them run it... You need there IP too...After they run it...The application runs in the background & the only way to shut it down is ctrl+alt+del...One thing that´s important the application modifys the win.ini file so that everytime you start up your computer no matter weather you did ctrl+alt+del it starts up again in the background so you don´t know its running & anybody can connect...If you don´t want this application to run you´ve to go into win.ini & steal out the command line Run=C:\WIN95\system\msrun.exe & delete the file msrun.exe in the win95\system directory... What ports & pass/login... You need to put there IP in then The port which is 23456 the the pass & login is yo and connect Ok now you´ve connected... I´m pretty sure about you can download any file & I know you can upload... Another thing there are some custom commands...I´m gonna tell you how to use them in CuteFTP only... goto "Commands" then "Custom Commands" then "Define" then click on "add" now in the label field type "Execute exe" Then goto "command Text" Type "EXEC %f" check the box that says "Show server´s response" you may put in a hotkey if you like... When your done with that click on "add" again now in the label field type "Execute Notepad Text" Then goto "command Text" Type "EXEC c:\win95\notepad %f" There´s one thing with this command everytime you go into a different computer the windows directory might be different... What I mean by windows directory is where there windows95 is installed... so if there windows directory is c:\win95\ you need not change the text in the "Command Text" box but if there windows directory is c:\windows\ or c:\window\ you need to goto goto "Commands" then "Custom Commands" then "Define" Then click on the "Execute Notepad Text" in the "Commands" box & you´ll have to change the "Command Text" text to which ever directory... Example... If there windows directory is c:\windows\ you´ve to change the text in the "Command Text" to "EXEC c:\windows\notepad %f" And so on for there windows 95 directory... check the box that says "Show server´s response" you may put in a hotkey if you like... Which operating system... The only operating system I know this application works on it Windows 95 ... I don´t know if this works on WinNT... Testing by anybody is thanked in advanced... Well have fun & no uploading viruses...

This RAT is also known as:

•destructive program - named by F-Prot.
• EvilTP - named by -.
• FixIt - named by McAfee.
• Trj/Evil.FTP - named by Panda.
• Trojan.Fixit.a - named by a.
• Trojan.Fixit.a - named by Kaspersky.
• Win.EvilFTP - named by Computer Associates.
• Win/Fixit!Trojan - named by Computer Associates.

>> Delete Evil FTP automatically - Download Spyware Doctor

Evil FTP Removal Instructions
Kill the following processes fixit.exe
Remove the following files evilftp.txt, fixit.exe.

Bookmark Evil FTP page

Previous Spyware: Remove Evil AIM SN Maker

Next Spyware: Remove Evil Goar