Removing The Underhand Trojan Server
A guide to save you from yourself

______________________________________________________

I. The Underhand Trojan Behavior
The underhand server will copy itself to the user's preferences folder located in ~/Library/Preferences (~ means the user's Home folder, in case you didn't know that). Note that all the properties of the application may be changed and will remain changed when the copy is made (i.e. the name of the trojan server may be different as well as the icon). Once the copy is made, the original server program will launch the copy. When the copy is opened and realizes it's in the user's prefs folder, it will add itself to the user's startup items so that it launches every time the user logs in.

The most sneaky tactic that the trojan uses is that the server runs nearly invisibly. In the plst resource, a LSUIElement tag is added to make the program run without showing up in the dock, the force quit menu, or any other list of running processes EXCEPT the low-level ones which you can access via the terminal (which I will explain how to do later).

II. Removing The Trojan
Assuming you know the name of the trojan when it was installed, this is very easy. Just follow these steps:

A) Kill the trojan
1. Open Terminal (/Applications/Utilities/Terminal.app).
2. Type in top.
3. Note the PID # (number on the far left of the list) next to the process showing the name of the trojan server.
4. Press q to stop the 'top' process.
5. Type kill then space then the PID # you noted earlier to kill the running trojan.

B) Remove the trojan
1. Go to System Preferences then find the Login/Startup Items. In Panther it's located under the Accounts Pane.
2. Remove the listing for the trojan server
3. Go to ~/Library/Preferences in the Finder
4. Delete the trojan server application from this folder by moving it to the trash and emptying the trash as well (just for good measure).