Removing BO2k

Now that you are done with the server, it is time to get out of there and leave no trace. You could manually remove the BO2k server binary from the hiding place, remove the registry keys that start it on boot, and kill the process, but that is the hard way.

The only real way to do it is to use a feature included in the srv_control.dll plug-in. First, make sure that this plug-in is loaded into the server (see Configuring a BO2k Server). After connecting to the server, locate the Server Commands window. Select Server Control → Shutdown Server. It takes only one variable. To delete the server permanently, type DELETE into this box. Click the Send Command button. If everything goes according to plan, you'll see "Shutting down BO2K server." in the response window, as shown in Figure 11-21. You'll be immediately disconnected.

Removing the BO2k server

Figure 11-21. Removing the BO2k server

When you remove the backdoor this way, Srv_control.dll does all of the work. It removes the binary and kills the process automatically. There may be a few references to the former server left in the registry, but nothing glaringly obvious (if the binary had an innocuous filename).

Tip

If this backdoor works just the way you like, it might be worth making a copy of it and saving it locally before you eradicate it from the server.