Can someone please help on removal of this thing. it has opened two ports. one stealth and one on 1234. i shut down the ports, but am concerned about it on my linux os. it came from 130.remotehosting.net. a us watcher. 208 address. I would look at removal tools for linux, but am not sure of them as could insert other spy trojans. can someone please advise or help on best solution to get this crackers twat tool off linux.

many thanks

ps... am also worried about my firewall for allowing this thing in. any good firewalls anti virus visual style.....

Subseven is a Windows trojan/backdoor and should not work on linux. Try doing:

lsof -i

or if you don't have lsof, try:

netstat -pantu

Have now resolved issues that appeared on firewall.
Have also downloaded logcheck and portsentry to control or make syslog checks for any future actions brought on by newbie thoughts

Thanks for your post.

You should definitely take a look at tripwire and chkrootkit as well.