A result of reverse transmission of qq files

Author: ruder
Http://ruder.cdut.net
Mail: cocoruder@163.com

I don't know what the virus name is. I only know it is so powerful that I will automatically send a file to your friends. The code won't be posted if the previous status judgment is too long. However, I still learned a lot and want to know more about it :)

* Manually delete viruses *
1. Check the process rundll32.exe k.
2. If there is a. exe (note that a special character is not a space) process, kill
3. Locate [HKEY_LOCAL_MACHINESOFTWAREClassesxtfileshellopencommand]
Change the default key value to "notepad % 1" (note that there is no special character similar to space before)
4. Locate [HKEY_LOCAL_MACHINESOFTWAREClassesexefileshellopencommand]
Change the default key value to "% 1" % * (note that there is no special character similar to space before)
5. Locate [HKEY_LOCAL_MACHINESOFTWARETENCENTQQ]
Get your qq directory and go to your qq directory.

Two files are found.
TIMPlatform.exe
TIMP1atform.exe (note that 1 is not L)
Delete the timplatform.exe(virus, as the winrarmap, and rename timp1atform.exeas timplatform.exe
6. Delete the virus file. The following figure shows the virus file to be deleted (all of them are winrar icons). Assume that the windows directory is c: winnt.
C: winntsystemundll32.exe
C: winntsystem32.exe
C: winntsystem32otepad.exe

* Install the "patch" for your system "*
This virus will not be detected after the patch is installed.

Locate the registry key (new if no registry is available)

HKEY_LOCAL_MACHINESOFTWAREClassesMSipv

Add one-click Value
MainVer type: REG_DWORD; Value: ffffffff (hexadecimal)
This value will be queried after the virus startup judgment status parameter is complete. If the current version value is smaller than this value, a dialog box will pop up and exit.
The virus version I got is 505.