Found this, HOW TO REMOVE:
Sockets de Troie (Socket23) backdoor for Windows
Description:
The Sockets de Troie ("Trojan Sockets") backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent.
Once installed on a system, the Sockets de Troie backdoor binds to UDP port 1 and listens for client connections. The Sockets de Troie client connects to this port and sends a string ("/udp/ connect") followed by the TCP port the client is listening on. The backdoor server then connects back to the client on this port. At this point, an attacker can begin sending commands.
Platforms Affected:
Windows 95
Windows 98
Remedy:
Use a commercial antivirus program to remove this backdoor. To remove the Sockets de Troie backdoor:
If you do not have an antivirus program installed, download and install one of these virus scanners:
Norton AntiVirus:
http://www.symantec.com/nav/indexA.html McAfee VirusScan:
http://software.mcafee.com/centers/download/ Trend Micro PC-Cillin:
http://www.antivirus.com/pc-cillin/products/Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Sockets de Troie backdoor from your computer.
Consequences:
Gain Access
References:
PCHelp's Web site, "Reproduction and translation of JCrun Softwares site" at
http://www.nwi.net/~pchelp/st/jcrun.htmStandards associated with this entry:
Reported:
Date not applicable.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2003 Internet Security Systems, Inc. All rights reserved worldwide.
AND THIS Sockets de Troie (French for "Trojan Sockets")
Sockets de Troie currently affects Windows 95/98 PC's.
The "server" portion is typically named "mschv32.exe".
Ports 5000 and 5001 (by default) are used to establish the connections between the "client" and "server".
Who is Responsible?
Unknown at this time...
There are two methods (that I know of) that Sockets de Troie can be unknowingly installed.
In the first, when the "server" portion is run, it shows an error dialog stating that SETUP32.DLL is missing. At the same time the "server" portion copies itself to WINDOWS\SYSTEM directory as MSCHV32.EXE and modifies the Windows Registry so it would be executed during every further Windows bootup.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunLoad
MSchv32 Drv = C:\WINDOWS\SYSTEM\MSchv32.exe
In the second, when the "server" portion is run, it shows an error dialog stating that ISAPI32.DLL is missing. The "server" portion copies itself three times to the WINDOWS\ and WINDOWS\SYSTEM directories under the following names:
c:\windows\rsrcload.exe
c:\windows\system\mgadeskdll.exe
c:\windows\system\csmctrl32.exe
The virus also modifies Windows Registry to make these files be executed on every further Windows bootup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunLoad
Mgadeskdll = C:\WINDOWS\SYSTEM\Mgadeskdll.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunLoad
Rsrcload = C:\WINDOWS\Rsrcload.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesLoad
Csmctrl32 = C:\WINDOWS\SYSTEM\Csmctrl32.exe
Topic: SOS!! Quick! Help! <cough> <sputter> <wheeze> Mayday!! (Read 13325 times)