On this page we'll show you how to uninstall SubSeven (server.exe).

To get infected by the SubSeven trojan you need to open a file named server.exe. It is 55kb and it can be renamed to whatever. You might not even know you have been infected by it but sometimes you cd drive might open or your computer keeps on doing weird things then u have been infected. To get it off your computer just read the following page.

When you open server.exe it installs the trojan files on your computer. Everytime you startup windows the trojan starts up too. The trojan hides itself from the CTRL>ALT>DELETE menu so you cannot turn it off. Too turn it off so it does not startup everytime do this.

Go to the Start Menu>Programs>Accessories>System Tools>System Information.

When you open System information , got to the top tool bar and click the tab that says "Tools" and then click "System Configuration Utility".

When you have opened the "System Configuration Utility", click the startup tab. Now all the checked boxes are the programs that startup when windows starts up. All the boxes should be check unless you have edited it before like I have. The SubSeven trojan program uses different names all the time, but you should uncheck the one that says either "run=" or "load=". Now beside the box you uncheck it should say the process name that started up. Mine was "epbshxj.exe". Yours will probally be different. Write that name down!!!!!!! Now Apply the settings and it should tell you to restart you computer. RESTART IT!! YOU HAVE TO!

After you restarted your computer go under the Start Menu>Find>Files or Folders. Now type in the name of the process that you wrote down(like mine was epbshxj.exe). But when you search for the file dont put down the .exe just the name. Now when it is done searching it should have found that file in either \WINDOWS\ or \WINDOWS\SYSTEM\. Delete the file(If it says that windows is currenyly you the file and you cannot delete it then in the StartUp processes you did not uncheck the process! But there might be 2 trojan processes so whatever other process in the startup has the same file like mine was epbshxj.exe then uncheck it too. then restart computer). After you deleted it you are safe so no hackers can get on your computer. Unless u install the trojan again.

If you have any of the following files in your WINDOWS\SYSTEM\ folder deleted them!!!! They are some of the masked trojan files.

File Name - sijllbn.exe , rcimqnm.exe , lsldf.exe , hrpdl.exe , evem.exe , lqvtf.exe , exkby.exe , iisucolw.exe , tpyewnv.exe , bonrwn.exe
Size - 54.5kb(55,808 bytes)
Location - C:\WINDOWS\SYSTEM (your system directorie)

File Name - s7fun2.dll
Size - 36kb
File Name - s7capture.dll
Size - 89kb
File Name - s7fun1.dll
Size - 163kb
File Name - matrix.dll
Size - 140kb
File Name - s7keys.dll
Size - 52kb

If you know of any file that i missed Email me and please tell me.