Transfer from the original forum Jakee posts:
Recently many netizens reflect their machine is called a gray pigeon Trojan virus, this virus is very naughty, in different kill soft have different names such as: Gpigeon, Huigezi, Feutel, in the computer to clear it is very troublesome, especially its just opened issued 2005, Through the interception of Windows System API to achieve program file hiding, proces
Clam Antivirus is an anti-virus package used on UNIX-like systems. Mainly used in mail server, multi-threaded background operation, you can automatically upgrade the virus database.1. Software Installation[email protected] ~]# Yum install ClamAV clamav-db clamav-devel clamav-milter-y[Email protected] ~]# vim/etc/clamd.confLogfile/var/log/clamav/clamd.log #去掉以下注释L
First, the preface
Virus class teacher threw us a copy of the VBS script virus code to try to analyze, here the analysis process sent out for everyone's reference, if found in what is wrong or what is suggested, you can leave a message to me, thank you!
Ii. Table of Contents
The entire analysis process can be divided into the following sections:
0x00 Preparation Work0x01 Decryption part0x02 function Ana
The popularity of the internet has made our world a better place, but it has also made people unhappy. When you receive a message with the theme "I Love You", when you click on an attachment with a mouse that is almost shaking with excitement, when you browse a trusted Web site and find it very slow to open each folder, do you realize that the virus has broken into your world? May 4, 2000 in Europe and the United States outbreak of "love Worms" networ
Virus Name: Worm.Pabug.ck
Size: 38,132 bytes
md5:2391109c40ccb0f982b86af86cfbc900
Adding Shell way: FSG2.0
Written Language: Delphi
How to spread: through mobile media or Web page malicious script propagation
Through the virtual machine operation, and after the Shell OD analysis, its behavior is as follows:
File creation:
%systemroot%\system32\gfosdg.exe
%systemroot%\system32\gfosdg.dll
%systemroot%\system32\severe.exe
%systemroot%\system32\drivers
Where is a bear cat burning incense?????Not a panda in incense, but all the EXE icon pocket into a burning 3 fragrant little panda, the icon is very cutePay in a manual way:Panda Variety Spoclsv.exe SolutionVirus name: WORM.WIN32.DELF.BF (Kaspersky)Virus alias: WORM.NIMAYA.D (Rising)win32.trojan.qqrobber.nw.22835 (Poison PA)Virus size: 22,886 bytesAdding Shell way: upackSample md5:9749216a37d57cf4b2e528c027
"Nima (Worm.nimaya)" Virus: Alert degree ★★★☆, worm, transmitted through infected files, dependent system: Win 9X/NT/2000/XP.
The virus uses the Panda avatar as an icon to entice the user to run. After the virus runs, it automatically finds the EXE executable file in Windows format and infects it. Because of the problem with the
This is the latest variant of the Niu.exe virus, and recently the spread of new variants of the virus has been raised, I hope that attention.
Quote:
File:Discovery.exe
size:74240 bytes
Modified:2008 year February 2, 0:03:34
md5:2da55f2a36e852ee6fc96d34dd520979
Sha1:44ce8f1c1a02591a88867f421c0c658b200d94c1
crc32:e20e292d
1. After the virus runs, the following
File name: Video.exe
File Size: 40960 bytes
AV name: BACKDOOR.WIN32.IRCBOT.AFM (Kaspersky)
Adding shell mode: Unknown
Writing language: Microsoft Visual C + +
Virus type: IRC back door
File Md5:c06d070c232bc6ac6346cbd282ef73ae
Behavioral Analysis:
1. Release virus copy:
%srstemroot%system32\firewall.exe 40960 bytes.
(The filename should be random, not necessarily this).
Compress the replica
Modified:2008 year May 8, 18:52:32
md5:7009ac302c6d2c6aadede0d490d5d843
sha1:0e10da72367b8f03a4f16d875fea251d47908e1e
crc32:dce5ae5a
After virus runs:
1. Release a sbl.sys to the%system32%\drivers below, and copy a cover Beep.sys, then load the drive, restore SSDT hook, resulting in some anti-virus software active defense function failure.
2. End the process of many anti-
Recently a lot of people have this "beast" virus, the reason is called "beast" virus is because the virus is running, Folder Options hidden files in the text content has been modified to "animals have a bit of compassion, and I do not, so I am not an animal." ”
This virus is actually a variant of the original analysis
This is a use of ANI to spread the Trojan Horse group, its "dynamic insertion process" function is caused by the difficulty of antivirus after the one of the reasons.
Another: After the recruit, the system partition of the. exe is all infected. This is also the problem after the poison.
"Symptoms" After the Recruit: Shualai.exe process is visible in the list of processes.
Suggestion: Use Sreng to keep the log, in order to understand the basic situation, easy to the back of the manual antiviru
in fact, we only need to install a new poison tyrant, basically will not have the problem, if your computer has a problem, you must use the rising, rising in this aspect of the anti-virus ability is really limited, we recommend to Jinshan next poison PA, I used to rising often poisoned, since the use of poison PA has not seen such a situation. It's not advertising.
About Logo1_.exe Basic Introduction:
Virus
"Download antivirus Software"
1, mobile phone poisoning The first thing we are downloading installation 360 housekeeper or other mobile phone housekeeper, and then to kill the virus.
"For Antivirus"
1, open the download good housekeeper, you can find the "virus killing" this function
2, the use of anti-virus software, we can carry out the killing
1. Open Antiarp Sniffer, check the right "management" column is automatically get the gateway address, if not obtained, then manually enter the gateway address, and then click "Take Mac". MAC address acquisition and then click "Automatic Protection"! As shown in figure:screen.width-500) this.style.width=screen.width-500; "Border=0>2. After running for a period of time, if the pop-up prompts said "found ARP spoofing packets", you can in the "cheat data detailed records" See "Spoofing MAC Address"
--Problem (*) Find the last element of a list.--(Note, the Lisp transcription of this problem is incorrect.) --Example in haskell:--prelude> mylast [1,2,3,4]--4--prelude> mylast [' x ', ' y ', ' z ']--' z ' module Main wheremain::i O () main =
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.