- This topic has 26 replies, 15 voices, and was last updated 17 years ago by
.
-
Posts
-
XERY wrote:Can Magic PS 1.5 SE be detected by norton 2004 ? or do you need something more?
Dear XERY, the answer is yes, but scan and delete in Window’s Safe Mode only. Sometimes it will not kill it if running under Normal Mode.
Good luck =)
I haven’t looked much into Magic -Ps 1.5’s behaviour
But i will soon.
I’m not sure if it run’s its registry traps on every startup.
I was reading this earlier and put this small program together for people trying and recovering from Magic-ps infection.
It will let you restore Regedit,taskmanager,taskbar,logoff,shutdown,run and file find.
This program has not been tested on non NT systems like win95/98/Me
I will add more to this the more i read up about Magic-ps and if anyone has further info on how it behaves would be benficial.
Will also add a custom Run box to run Programs soon so you can run programs even if RUN is hidden.
UPDATE: Changed programming languages to Delphi as VB’s Registry calls were annoying me and i moved on to Delphi a while back anyways so totally rewrote it in Delphi and re-uploaded.
The main form is a Run Command clone that will do pretty much all Run can do apart from saving last jobs.
If your on XP you can just type notepad or msconfig or regedit and press open but if your in win95/98/me you must include extension like notepad.exe , regedit.exe…etc..then press open.
The file is slightly bigger..been Delphi but it does not require runtimes or extra ActiveX Controls like Visual Basics does.( i also UPX’ed it to compress its size.)
Dermot
Dear Dermot,
Thank you for your contribution. I will take a look at your program =)
Keep up the good work.
UPDATE: I tested your program. Yes, it is a nice tool to aid in removing Magic PS in general but it does not rid Magic PS from the PC, (an example would be the files it created, etc.) but of course you can always make it better =D
Magic PS (all versions) was created by the people in the Middle East. Now an Anti-Magic PS (all versions) also was created by the people in the Middle East. Please note that I did not fully tested this program yet. If anyone willing to test it, please provide your feedback here. Thanks =)
UPDATE: Yes, the program does work 😉
NOTE: This program is NOT the same one as Dermot’s Anti-Ps =P
True it does not get rid of it or search for it.
I Dont know much about the behaviour of it to work on something to do that.
I have contacted the authors of your program above to lemme know which pattern they take on searching for it…and a possible chance to convert their program to Delphi.
I have changed my file above and re-wrote it in Delphi, it does not as i said find or kill the magic -ps but will help you in doing so manually if it came to it…and may other trojans bar magic-ps that disable these valuable windows options.
If you have any info on the Magic-ps or a place to find it so i can rip it apart…lemme know.
Dermot
as antihacker suggested removing those files wont help (as i have tried) cos mps doesnt simply use one more two files to send passwords…wht it does is it creates 2-3 dll’s in windows directory wch are near impossible to find….cleaning thm is impossible since u dont know the names of the dlls…well the simplest solution lies here
1) restore ur wingays to earlier point whn u think u werent infected. (may work)
2) if u dont worry about being infected with trojan but u do worry about ur passwords being sent to someone then follow these steps..download MPS from anywhere….make your own server.exe file configure it so tht it sends the passwords to ur yahoo id….and execute in safe mode….will surely work….
Hi there Sha3er.
That thread was almost a year ago – I feel it’s best to let the discussion on it die now.
I would guess that if such a beast IS still around, the standard antivirus/antispyware programs will have all caught up with it long ago.
(I hope! 😉 )
- You must be logged in to reply to this topic.