Magic Horse Trojan  
            Magic Horse Trojan 
            Server name: Magic Horse Trojan 
            Version: NA 
            Different versions: None 
            Tested: Yes, on Windows 95 and Windows NT 
            Server size: 71.8K 
            Server files: mh.exe 
            Server icon: 
             
            Infects: Windows 95, 98. NT. 
            Autoloads: Registry: 
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 
            Key: Spooler Service 
            Default port: 25 TCP 
            Can port be changed: No 
            Server Features 
              Email passwords 




  
            Comments  
            Magic Horse Trojan is just a password emailer. Nothing much else to 
            say about this one. 
            How To Remove  
            Quick fix: no quick fix programs 
            Manual removal: 
              Remove the Spoller Service key in the registry located at 
              HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run  
              Which can be done with regedit or any other registry editing 
              program.  
              Reboot the computer or close spoolsrv.exe. 
              Delete the trojan file spoolsrv.exe in the windows directory.