TDS exe protection

I try to let TDS-3 delete it:

 

I click OK and TDS-3 deletes it:

 

I look in my registry and have to delete this entry manually in:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

See screenshot further for that reg-key.

EDIT-1
For full description of that reg-key I quote from here

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The name of the entry is "TrojanSimulator" (without the quotes), and its value is the path to TSServ.exe, enclosed in quotes ("), and followed by the /install parameter. The type of the entry is REG_SZ (standard registry string value).

- end quote -

EDIT-2
I also manually deleted the file Trojansimulator.exe

 

OK, that's it for the moment.
I hope it makes some sense and that I did the right things

 

To make sure we all are talking about the same TrojanSimulator, is here the MD5 checksum for the zip-file:

The file <D:\Trojan Simulator\TrojanSimulator.zip>
has the following Checksum(s)

MD5 - 6A1AC6675073BAB8EC61839E1D1434D6

 

Yes, FanJ and Pilli are correct .

You must have scan for Clients/EditServers enabled to detect the trojansimulator.exe, as this is the Client/EditServer:

Client: What a script kiddie/trojaner would generally use to connect to the actual server (in this case tsserve.exe) on a victims computer.

EditServer: Usually a part of the Client (sometimes seperate) used by the script kiddie/trojaner to create a server with different default ports, startup methods etc...then the default server would have contained.

Server: The nasty part which will install the trojan on your computer, thus allowing the script kiddie/trojaner to remotely connect to the trojan server (in this case tsserve.exe) on your computer and control it.


Having said that, TDS detects/stops all these parts of the TrojanSimulater test trojan - see my screenshot.

Regards,
Jade .

 

Thanks Jade !

It looks to me that we both tested it in a different way:

I tried to test it with ExecProt.
You tested it with a file-scan.

 

No probs FanJ , although in my screenshot you will see that I tested Execution Protection as well as the file scan .

Best regards,
Jade.

 

Oops, you're right !!!

Cheers, Jan.

 

very cool and newbie friendly

 

Thanks buddy !

cookie for you