hijacking item] on the left, find the project corresponding to O26 on the right, right-click, select Delete from the pop-up menu.In [advanced functions]-> [IE and OS repair], click [repair ].
Some Virus File Information:
File Description: C:/Windows/anistio. exeAttribute: ---An error occurred while obtaining the file version information!Creation Time:Modification time:Access time:Size: 16201 bytes, 15.841 KBMD5: e32230ed6197e2e21796eb66e6b013f5Sha1: b59e4b2c1aaa38a7299333340983e4c3b6276788CRC32
/help/ztpass.exe-------------
Stop and disable system services:Microsoft winshellZT Massacre (ztmassacre)
Downloading procview to the http://endurer.ys168.com terminates suspicious processes.
Use WinRAR to find the following suspicious files, package the backup, and add the. Del extension:-------------C:/Windows/Microsoft winshell.exe (the value of Kaspersky isBackdoor. win32.hupigon. BWT)
**************************************** ********Virus report
Rootkit. win32.ressdt. O/Trojan-Downloader.Win32.Agent.mjp Analysis
Original endurer2008-04-10 1st
It is something that Xialu has published on its official website.
Rootkit. win32.ressdt. O/Trojan-Downloader.Win32.AgentHttp://endurer.bokee.com/6681893.htmlHttp://blog.csdn.net/Purpleendurer/archive/2008/04/09/2271747.aspxHttp://blog.sina.com.cn/s/blog_49926d910100926n.html
File Description: D:/test/svcos.exeAttribute: ---An error occurred while obtaining the file version information!Created at:
kakatool. dll of the card assistant. (the result of running the virtual machine and the content in the program code are verified)
In order to block the "back-to-back" of the poisoned person, another mean method was adopted.Modify the hosts file to block the website of anti-virus software vendors. The kaka community is "lucky" to become one of the blocked members:This is what we later saw with SREng, and the corresponding content in the program code is also available:
127.0.0.1 mmsk.cn127.0.0.1
Kakatool.dll (did so, the results of the virtual machine run and the contents of the program code are matched)
In order to block the "back" of the poisoned people, another despicable method was adopted.
To modify the Hosts file, shielding antivirus software manufacturer's website, the card community "fortunate" to become one of the masked members:
This is the result that later uses Sreng to see, in the program code also has the corresponding content:
127.0.0.1 mmsk.cn
127.0.0.1 ikaka.com
127.
:34:20Size: 93240 bytes, 91.56 KBMD5: ef70da-91d050cc898319acbb044e847
Kaspersky reportsWorm. win32.viking. II
After 0.exe is run, other malicious files will be downloaded and the EXE file will be infected.
The following is a record of Kaspersky 6 after 0.exe is run:/----Detected: Risk SoftwareTrojan. GenericRunning process: D:/test/0.exeDetected: Trojan programTrojan-PSW.Win32.Magania.jmFile: C:/winnt/syst
, and then scan. Sure enough, cured has a large number of EXE files.
I found that there are many *. tmp files in C:/windows. It is estimated that the files are still not cleared. Download and install AntiVir, scan the files after upgrade, and scan and kill one piece ......
File Description: C:/auto.exeAttribute: ---Language: English (USA)File version: 0. 0. 0. 0Note:Copyright:Note:Product Version: 0.0.0.0Product Name:Company Name:Legal trademark:Internal Name:Source File Name:Creation Time: 22:2
The system time is modified to use the xibgptd.exe, netdde32.exe, and so on.
EndurerOriginal1Version
File Description: C:/Windows/netdde32.exeProperty:-sh-An error occurred while obtaining the file version information!Creation Time:Modification time: 9:19:16Access time:Size: 46080 bytes, 45.0 KBMD5: a51350e65839a16ab5f5de5de6c525e8
Subject:
Re: netdde32.exe [KLAB-2608379]
Sender:
""
Sent:
Hello,Netdde32.exed-Trojan-Downloader.Win32.QQHelper.wkNew malicious soft
First, the solution of Kaspersky Scan suddenly fixed problem
There are several reasons for this situation:
1, the hard drive has a very large file in operation, if the hard drive lights flashing words is at work, and so on.
2, in Kaspersky set inside, scan inside have a custom, inside have a more than time 30 seconds automatically skip, the front dozen a hook, if you are not good, please scan in safe mod
-------------------------/
Check the following folders with WinRAR and find:
C :/============================================Internt. HTA (Kaspersky reportsTrojan-PSW.Win32.QQPass.hn)RAR. HTA (Kaspersky reportsTrojan-Downloader.JS.Small.cq)Vidll. dll (indicated by KasperskyWorm. win32.viking. rThe rising report isWorm. Viking. AA)
C:/Documents and Settings/user/Local Settings/temp===========================
For small and medium-sized enterprise network administrators, it is often necessary to ensure the smooth operation of the enterprise intranet, and the smooth operation of the Intranet is closely related to the security of employees' computers. I believe most enterprises have installed anti-virus software for employees' computers, however, even with anti-virus software, it is impossible for us to completely prevent viruses and hackers from attacking the enterprise's Intranet, because whether the
Kabbah has been prompted early in the morning, the beginning of the "delete" Kabbah project, then only "restore" and "skip", the virus, from the Win3.exe has been changing, as long as you press skip, 20 seconds before the pop-up next combination. Fainted ...There are pictures, this is what virus how to killing? There is no solution to the online search. Master Help. Thanks
Copy Code code as follows:
HIJACKTHIS_ZWW-Chinese version of the scan log V1.99.1
Saved in 11:01:38, date 2006-9
My mailbox, probably charge three categories of content. On the one hand are some dealings in the work, such as work arrangement and notice. On the one hand, some personal letters, such as old classmates, friends sent greetings. After registering many sites with the same mailbox, some of the service chambers are driven by interest to disclose the email address to some spammers. Causes the mailbox often to receive some spam mails, either fraudulently clicks, or carries the virus. And there is no
$INSTDIR is considered invalid. un. Guiinit:
The callback will be called before the first page is loaded and the Uninstaller dialog box is displayed, allowing you to adjust the interface of the uninstall program. Un.oninit:
The callback will be called when the uninstaller is nearing completion of initialization. If the Un.oninit function uses Abort, the uninstaller
Beep. sys/Trojan. ntrootkit.1192, msplugplay 1005.sys/ backdoor. pigeon.13201, etc. 2
Original endurer2008-06-25 1st
(Continued 1)Modify the computer date, and then download drweb cureit! Scan.At the same time, download bat_do and fileinfo to extract file information, package and backup, and delete files in a delayed manner.Then download the rising Kaka Security Assistant to clean up the malicious program startup project.
Appendix 1: malicious file informationAppendix 2: drweb cureit! Scan logs
OutputPath File test.txt # define Uninstaller name Writeuninstaller $INSTDIR \uninstaller.exe #-------#default Section EndSectionend #CreateA Section toDefine what the uninstaller does. # the Section'll always be named"Uninstall" Section "Uninstall"# alwaysDeleteUninstaller First Delete$INSTDIR \uninstaller.exe # NowDeleteInstalled fileDelete$INSTDIR \test.txt SectionendThis part of the code is al
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.