QQ tail virus exclusive software and manual removal methods

The latest QQ tail virus, send a temptation message to attract netizens, click the link in the QQ tail virus message, download and run it, and send similar messages to friends without stopping. Detailed analysis reports and manual cleanup methods are as follows:

Virus name: Worm. QQTailEKS. ds.20.64

Transmission Mode: Send messages through QQ and spread messages through automatic playback and malicious web pages.

Virus behavior:

1. Copy multiple copies to the system directory after the virus runs in the memory:

% Windows % \ cacom.exe (% windows % is generally c: \ windows Directory)

% System % \ Akica.exe (% system % generally refers to the c: \ windows \ system32 directory)

In Windows, the program generated by the virus is sycacom.exe.

2. Programs that cover the system game "card:

% System % \ sol.exe

% System % \ drivers \ sol.exe(this sol.exe is not normal here)

3. copy itself to the root directory of a partition other than the system partition:

X: \ EKS.exe (X is the drive letter)

4. generate an automatic playback file:

X: \ Autorun. inf:

Content:

[Autorun]

Open‑eks.exe

Shellexecutepoliceks.exe

Shell \ Auto \ commandpoliceks.exe

Shell = Auto

5. Modify the registry and create a startup Item:

[HKEY_LOCAL_MacHINE \ SOFTWARE \ Microsoft \ Windows

\ CurrentVersion \ Run]

"Akica" = "% System % \ Akica.exe"

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunServices]

"Cacom" = "% Windows % \ cacom.exe"

6. Send the following virus Address message to QQ friends:

Look at my friends in Hangzhou, who have fair skin and outstanding body. I want her to become a lover and ask for your advice.

Discuss, her video HXXP: // 2.emeishan-jiudianyuding.cn//v.asp? Q = 2

Do you still remember Xiaowen? She is now a mistress, dressed hot and sexy, and driving a BMW, it was wrapped up by a Hong Kong man. I can't believe it. Look

After reading the video on her blog, you will know hxxp: // 2.emeishan-jiudianyuding.cn//v.asp? Q = 1

Hi, hurry up and help. Open the URL and click a link below. hxxp: // 2. emeishan-

Jiudianyuding.cn//v.asp? Qiniurl-movies.htm will tell you why. Thank you very much.

I just found out that the super exciting ** movie is fast and free for one month. hxxp: // 2. emeishan-

Jiudianyuding.cn//v.asp? Qiniurl-free-movies.htm

After sending the message, try to close the chat dialog box. The virus will also visit some advertisement pages.

Manual cleanup method:

1. Stop the virus Process

Press Ctrl Alt del, and start the task manager. Then, the vm1.exeprocess is changed to akica.exeor cacom.exe ).

2. Click Start, Run, enter regedit, start Registry Editor, and delete the following virus startup items:

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]

"Akica" = "% System % \ Akica.exe"

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunServices]

"Cacom" = "% Windows % \ cacom.exe"

3. Use anti-virus software or manually delete virus files.

We recommend that you immediately upgrade the anti-virus software and then scan for it. If you do not have the latest version of anti-virus software, you can manually delete the following files.

% Windows % \ cacom.exe, (% windows % usually refers to the c: \ windows Directory)

% System % \ Akica.exe, (% system % usually refers to the c: \ windows \ system32 directory)

% System % \ sol.exe

% System % \ drivers \ sol.exe

4. Resume the card game

The virus replaces the card game. You can COPY the game program from the normal system to the % system % directory.

5. Delete Virus files from other partitions

Use "Resource Manager" instead of double-clicking to access the disk. double-clicking will start automatic playback, and virus programs in other partitions will automatically run. In this way, the previous work will be wasted. The folder state is recorded in the root directories of each partition, and eks.exe and Autorun. inf are deleted.

6. Disable automatic playback to prevent such viruses

The virus is still transmitted through automatic playback. We strongly recommend that you use the Group Policy Editor to disable automatic playback for all drives. The operation procedure is: Click Start → run → enter gpedit. msc, open the Group Policy Editor, browse to Computer Configuration → manage template → system, double-click "Disable automatic playback" in the right pane, select all the drives in the dialog box, and click OK.

1 2 Next Page

[Content navigation]
Page 7: manual clearing of QQ tail Virus	Page 6: QQ tail virus exclusive Software Download