Identify new QQ tail virus and manual removal methods

The new QQ tail, send temptation messages to confuse netizens, click the link in the message, download and run it, and send similar messages to friends after being poisoned. Detailed analysis reports and manual cleanup methods are as follows:

Virus name: Worm. QQTailEKS. ds.20.64

Transmission Mode: Send messages through QQ and spread messages through automatic playback and malicious web pages.

Virus behavior:

1. Copy multiple copies to the system directory after the virus runs in the memory:

% Windows % \ cacom.exe (% windows % is generally c: \ windows Directory) % System % \ Akica.exe (% system % is generally c: \ windows \ system32 directory)

In Windows, the program generated by the virus is sycacom.exe.

2. Programs that cover the system game "card:

% System % \ sol.exe % System % \ drivers \ sol.exe(this sol.exe is normal)

3. copy itself to the root directory of a partition other than the system partition:

X: \ EKS.exe (X is the drive letter)

4. generate an automatic playback file:

X:\Autorun.inf：

Content:

[autorun]open=EKS.exeshellexecute=EKS.exeshell\Auto\command=EKS.exeshell=Auto

5. Modify the registry and create a startup Item:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Akica"="%System%\Akica.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]"cacom"="%Windows%\cacom.exe"

6. Send the following virus Address message to QQ friends:

Check out my friends in Hangzhou, who are white and tall. I want her to become a lover and ask for your advice. Her video hxxp: // 2.emeishan-jiudianyuding.cn/<blocked>/v. asp? Q = 2 do you still remember Xiaowen? She is now a sophomore, dressed hot and sexy, with a BMW and wrapped up by a Hong Kong man. I can't believe it, check out the video on her blog and you will know hxxp: // 2.emeishan-jiudianyuding.cn/<blocked>/v. asp? Q = 1Hi, please do it quickly. Open this URL and click a link below. hxxp: // 2.emeishan-jiudianyuding.cn/<blocked>/v. asp? Qiniurl-movies.htm will tell you why. Thank you very much. I just found out that the super exciting ** movie is fast and free for one month. hxxp: // 2.emeishan-jiudianyuding.cn/<blocked>/v. asp? Qiniurl-free-movies.htm

After sending the message, try to close the chat dialog box. The virus will also visit some advertisement pages.

1 2 Next Page

[Content navigation]
Page 1: virus Behavior	Page 1: manual cleanup