Title: Mosucker

Remove Mosucker. Removal instructions

Severity scale:

(60 / 100)

This RAT is presented as a tool that is supposed to help net administrators to control computers remotely. But a quick inspection of the vendor description leaves no doubt that this RAT tool can be used for illegal actions. It affects such operating systems as Windows 95/98/XP/ME/WinNT/2000. The pest was created by a German hacker called Krusty from a group called Inferno Industries. The pest is written in Visual Basic 6 and compressed with ASPack. Many versions appeared from December 1999 to March 2004. The infection peaked in such countries as Australia, France and the United States. Some versions also have the ability to disable Firewall protection on the infected PC.

From the publisher:

"MoSucker is a backdoor trojan, coded with Visual Basic 6. The server needs the vb6-runtime-dll msvbvm60.dll. It does no longer need any ocx-files (you can change this in the EditServer) This trojan is written for Windows 95/98, it wasn't tested on other systems like 98se, NT and 2K, but it should work there, too. MoSucker is the best or one of the best trojans ever programmed with vb. Have fun with it!'
2.30: From the doc: 'This list will kill (terminate) all well-known firewalls and Anti-Virus programs currently running on the victim's system. It will NOT delete or currupt these programs, it will just stop them.'
3.0a: From the doc: 'This list will kill (terminate) all well-known firewalls and Anti-Virus programs currently running on the victim's system. It will NOT delete or currupt these programs, it will just stop them. Kills ZoneAlarm (Including Pro), LockDown, Norton AntiVirus, Trojan Check, Trojan First Aid Kit, MS Visual Studio Spy tools, Dr. Watson, RegEdit, The Cleaner, Trojan Defense Suit 3, Anti Trojan, Dr. Solomon, Norton Utilities, McAffee Virus scan, Kaspersky Anti Virus RegRun II, Tau Monitor, ANTS and AtGuard ... and others'

MoSucker 3.0b - Released Nov. 20th 2002

!!IMPORTANT!!

1) MoSucker 3.0b servers are not compatible with the MoSucker 3.0a edit server. 2) If you get any runtime errors, execute Runtimes.exe in the runtimes folder. 3) Check the announcements in the forum for the latest public CGI locations. 4) The edit server cannot change the icon for servers that include the runtimes. Use reshacker or microangelo. Icon is 32x32 16 colors

Changes/bugfixes for 3.0b

- Modification of settings encryption for increased server security. - Edit server and client install runtimes if needed (since nobody can read). - MSN notification protocol error fixed. - MSN notification no longer gives visible error message when service is down. - Kill running system process checkbox error on reload fixed. - File exists routine for bound files fixed (bug rare) - Improved error handling in edit server. - Removed webdl.ocx dependancy.

MoSucker ErEbuS:

Ive packadged the mosucker trojan into a new trojan installer that compresses the file differently. This also installs the visual basic 6.0 runtimes with it. Copies file to system directory quietly and runs mosucker. Ofcourse, after it runs the mosucker server, the antivirus will pick it up. I leave this problem to you.

These are the attached server's settings: port: 1037 (default) filename: wsvchost.exe deny local connections events: deleting/restoring of netstat and kills the threads of avs/fw melts the install

ErEbuS"

Mosucker properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic Mosucker removal:

remover for Mosucker

SpyHunter is recommended remover to uninstall Mosucker. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Mosucker using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Mosucker (2005-04-10 05:58:17)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Mosucker (2005-04-10 05:58:17)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Mosucker (2005-04-10 05:58:17)

XoftSpySE Anti Spyware

download | review

Mosucker manual removal:

FORUM:
Discuss Mosucker in
spyware removal forum

Kill processes:
backdoor.mosucker.11.exe, createserver.exe, editserver 2.0.exe, editserver.exe, free pink.exe, mosucker 2.0.exe, mosucker.exe, pics.zip.exe, server.exe, server1.exe, server2.exe, server3.exe, server4.exe, server5.exe, skinmaker.exe, [system root]\\jthh.exe, [system root]\\msnetcfg.exe, [system root]\\system\\svr.exe, [system root]\\temp\\pkg310.exe, [system root]\\temp\\pkg332.exe, [system root]\\temp\\pkg3392.exe, [system root]\\unin0686.exe, [system root]\\vvuijoe.exe, v young.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{beuicvq-zpdev-zyk-oswoz-ipcjbgekjhf} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eengqgs-gdrfc-zzvzd-thmp-dnvpuihfkre} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{hmcsqss-ejo-sdbyh-rcwb-ypenjkwjze} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{mbubrwf-krfhc-cpg-qygw-lrjscpnsur} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{rtemrsp-vhe-kgsoz-enjdg-tdtfhwtknffn}

HELP:
how to remove registry entries

Unregister DLLs:
moicons.dll, [system root]\\buxyelbk.dll

HELP:
how to unregister malicious DLLs

Delete files:
1.stub 2.stub, 3.stub, avkill_large.ini, avkill_small.ini, backdoor.mosucker.11.exe, bios killer plugin readme.txt, bios killer plugin v1.0.gui, bios_killer_plugin.msp, build.stub, createserver.exe, data.tag, editserver 2.0.exe, editserver.exe, fake login readme.txt, fake login.gui, fakelogin.msp, free pink.exe, front.jpg, fuck me!!!!!.vbs, get.cgi, help.chm, help+tutorial.chm, htm.cgi, infector readme.txt, infector.gui, infector.msp, moicons.dll, mosucker 2.0.exe, mosucker.chm, mosucker.exe, mosucker.ini, msn mass message readme.txt, msn message v2 readme.txt, msn message v2.gui, msn message.gui, msnmsgv2.msp, new default.title.gif, newfeatures.txt, pics.zip.exe, picture 26.jpg, pictures[1].txt, put.cgi, read me.txt, readme.txt, runtimes.txt, server.exe, server1.exe, server2.exe, server3.exe, server4.exe, server5.exe, setup.ini, setup.ins, skin.ini, skinmaker.exe, superclicks readme.txt, superclicks.gui, superclicks.msp, [system root]\\buxyelbk.dll, [system root]\\jthh.exe, [system root]\\kernel32.txp{10}, [system root]\\msnetcfg.exe, [system root]\\qirqgs.bin, [system root]\\system\\svr.exe, [system root]\\temp\\pkg310.exe, [system root]\\temp\\pkg332.exe, [system root]\\temp\\pkg3392.exe, [system root]\\unin0686.exe, [system root]\\vvuijoe.exe, [system root]\\wesapygp.sys, [system root]\\winexec32.dli, [system root]\\xqwrmthm.sys, tapisvc.sys.txt, thumbs.db, v young.exe, webdl.ocx

HELP:
how to remove harmful files

Information added: 2005-04-10 03:21:02
Information updated: 2005-04-10 03:21:02

Additional resources related to Mosucker:

Attention: If you know or you have a website or page about Mosucker removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Mosucker parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.