Anti-Virus "Agent Trojan" variant in December 9

Among the upcoming viruses this Sunday, Trojan/Agent. pgz "proxy Trojan" variants pgz (also known as "robot dog") and Trojan/Tibs. ccp "bis" variants ccp are worth noting.

Virus name: Trojan/Agent. pgz

Chinese name: "proxy trojan" variant pgz (also known as "robot dog ")

Virus length: 49152 bytes

Virus Type: Trojan

Hazard level:★★

Affected Platforms: Win 9X/ME/NT/2000/XP/2003

Trojan/Agent. pgz "proxy Trojan" variant pgz is one of the newest members of the "proxy Trojan" Trojan family. It is written by MASM32/TASM32 and the virus program icon is "robot dog ". After the "proxy trojan" variant pgz is run, a program named userinit.exe.pdf and the runtime (“userinit.exe "is required for Microsoft to start the operating system under the % SystemRoot % \ System32 \ directory. The user computer is infected with the virus, and the trojan will overwrite the userinit.exe file .). The malicious program connects to the specified site of the hacker on the background of the infected computer, obtains the download list of other malicious programs, downloads a large number of malicious programs on the infected computer, and automatically calls and runs them. Modify the Registry to enable automatic startup of Trojans. Release a file named "pcihdd" in the % SystemRoot % \ System32 \ drivers directory of the infected computer. sys "malicious drive file, which can create disk I/O interfaces, automatically identify the system disk format, and directly read and write the hard disk; it has the functions of system protection software such as "Freezing Point recovery Genie" and "movie sub-system", which invalidates "ice point Recovery System" and "movie sub-system" and embeds viruses into real systems for saving and running. In addition, after "pcihdd. sys" is installed, the "proxy trojan" variant pgz will automatically uninstall and delete the malicious driver file.

Virus name: Trojan/Tibs. ccp

Chinese name: ccp, a variant of "tibis"

Virus length: 25832 bytes

Virus Type: Trojan

Hazard level:★★

Affected Platforms: Win 9X/ME/NT/2000/XP/2003

Trojan/Tibs. ccp the ccp bis variant ccp is one of the newest members of the bis Trojan family. It is written in VC ++ 6.0 and shelled. After the ccp of the bis variant runs, it copies itself to the specified directory of the infected computer system. Modify the Registry to enable automatic startup of Trojans. Connect to the specified site of the hacker in the background, download the malicious program, and run it automatically on the infected computer. Modify security-related registry keys to reduce the security of infected computers.

For the above viruses, Jiangmin anti-virus Center recommends that the majority of computer users:

Upgrade Jiang's anti-virus software and conduct comprehensive anti-virus operations. enable various monitoring functions. You must keep passwords for accounts such as online banking, payment platforms, online securities transactions, and online games properly, try not to use it on a computer with potential security risks.