Competition between Viking and kill-killing tools-following the first occurrence of worm. Viking. DY

EndurerOriginal

2006-11-02 No.1Version

Last night, I was too late to help the netizen having worm. Viking. Dy in the computer perform a detailed check.Worm. Viking. DYIt is officially started at noon today.

According to the Rising Antivirus record on the user's computer, four more times this morning, C:/winnt/logocmd.exe was infected.Worm. Viking. DY, Cleared.

In the past, there were moreLogocmd.exe, There should also beRundl132.exe(In the file name, the letter D is followed by the English letter l in lowercase, and the letter 32 is followed by the number 1 ). But it cannot be found in the computer on the webpage.Rundl132.exe. It is estimated that the virus was detected and cleared by rising just after intrusion. Where is the source?
Ask a netizen to learn that his computer is using LAN sharing. The virus is probably transmitted from other computers in the LAN.
Ask a netizen to open another computer in the LAN, and then QQ remotely assists in the inspection.

Download hijackthis scan log from the http://endurer.ys168.com, and surely get something:
/---------
Logfile of hijackthis v1.99.1
Scan saved at 12:36:52, on 2006-11-2
Platform: Windows XP SP2 (winnt 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running Processes:
C:/Windows/logocmd.exe

F3-Reg: win. ini: load = C:/Windows/rundl132.exe
---------/

Anti-virus software is not installed on this computer, but it is restored with one click.

Download Rising Antivirus assistant aide4rav from http://endurer.ys168.com, use rising online free scan, found a lot:

/---------
2006-11-2 13:42:34 Rising anti-virus Assistant
Windows XP Service Pack 2 (5.1.2600)
File Name virus name
C:/Windows/system32/wincfgs.exeWorm. usbspy.
C:/Windows/system32/wincfgs.exe. VIRWorm. usbspy.
C:/Windows/system32/dllms. dllTrojan. psw. wowar. qq
C:/Windows/system32/ztdll. dllTrojan. psw. zhengtu. Sm
C:/Windows/system32/dllwm. dllTrojan. psw. Agent. ase
C:/Windows/system32/hx2dll. dllTrojan. psw. hx2online.
C:/Windows/mtinstaller.exeTrojan. Small. ICD
C:/Windows/rundl132.exe> upack0.32Worm. Viking. DY
C:/Windows/logocmd.exe> upack0.32Worm. Viking. DY
C:/Windows/SVCHOST. exeTrojan. psw. xyonline. GF
C:/Windows/rundll32.exeTrojan. psw. hx2online.
C:/Windows/download/svhost32.exeTrojan. psw. zhengtu. St
C:/Windows/DLL. dllWorm. Viking. dz
C:/program files/Microsoft Office/office11/winword. EXE> upack0.32Worm. Viking. DY
...... (Each disk has an EXE file, omitted)
---------/

Viking not only infected the EXE file, but also downloaded a bunch of account theft Trojans ......

You can use the Rising Antivirus assistant to call the right-click menu to package and back up the backup, and then delete all the Trojans.

Manual check, one found in C:/Program FilesSvchost32.exeRising did not report the error. After packing the backup, delete it.

The computer has won the bid. It is better to test the effects of several kill tools by the way.

Rising's exclusive killer tool was tested yesterday, with no performance.

Try again the antivirus software "vipro", updated on: 146-09-15 file size: kb. The result is: 0.

Try again Jiangmin's Weijin worm killing. The file extension is. scr. Scan, discover and clear ......

Sorry, it's time for work in the afternoon ......

The netizen is not online yet, so he still does not know the effect of killing.

It is estimated that the virus source is the computer without anti-virus software. Although there is a one-click restoration, it only restores the C drive. Other infected files still exist in the drive, and the virus will attack again, it also affects other computers in the LAN.

SoAlthough one-click restoration is good, anti-virus software is still indispensable ......