Computers are connected to the network every day. Nowadays, there are countless Trojan viruses on the network, and viruses will inevitably happen one day. So what should we do after the virus? The correct solution can avoid greater losses and minimize the damage caused by viruses. Let's take a look.
I. MediumVirusSymptom
When your computer is infected with viruses, the
Characteristics of the virus:
The biggest feature of the virus is self-replicating, from the classification of viruses there are many kinds, here we will introduce the most popular add-onVirus, which is adapted to the normal file to achieve its own replication purposes.From a procedural point of view, we have two things to do:
1, so that the program can be copi
Definition of computer virus
Computer virus is a destructive and infectious ability of the program, and other normal procedures, when a computer virus from a certain way into the perso
; Obtain data from the returned pioreq after pIFSFunc is called
Cmp dword ptr [ebx + 20 h + 04 h + 04 h], 00000024 h
Jne QuitMyVirusFileSystemHook
; Get the modification date and time of the file in DOS mode
Mov eax, [ecx + 28 h]
Mov (FileModificationTime-@ 6) [esi], eax; save the obtained File time and date
; Exit the virus program
QuitMyVirusFileSystemHook:
Popad; recover all registers
that the virus is a MS Word macro virus, copy the "normal. dot" file in the C: Program FilesMicrosoft OfficeTemplates directory and all the files in the C: Program FilesMicrosoft OfficeOfficeStartup directory to the floppy disk.
If you suspect that the virus is a Microsoft
Computer viruses generally have the following features:1. computer Virus procedural (executable) computer viruses, like other legal programs, are executable programs, but they are not a complete program, but parasitic on other executable programs, therefore, it enjoys the po
in DOS mode
mov eax, [ecx+28h]
MOV (FILEMODIFICATIONTIME-@6) [esi], eax; Save the obtained file time and date
; exit the virus program
Quitmyvirusfilesystemhook:
Popad; restore all registers
ret; exit from file hook program for virus settings
; Destroying the c
1 computer virus Overview
Computer Virus (CV. It is a special program, and the problems caused by viruses are software faults. This program can infect itself to other programs and disrupt the normal operation of the
Sometimes Win8 's own virus protection program is too sensitive to cause the deletion of things or interception of the program, and sometimes restore the system because in Safe mode can not restore success need to close the virus protection program. In this case, we need to
file offsets. The structure is as follows:#define Namelen 20#define signlen 32typedef struct sign{ char Szvirusname[namelen]; LONG Lfileoffset; BYTE Bvirussign[signlen + 1];} _sign, *psign;Use this data structure to define a global variable that holds the signatures of the two viruses, defined as follows:Sign Sign[2] = {{ //setup.exe "setup.exe", 0x0c040, "\x2a\x2a\x2a\xce\xe4\x2a\xba\xba\x2a\xc4\xd0 \x2a\xc9\xfa\x2a\xb8 " " \xd0\x2a\xc8\xbe\x2a\xcf\xc2\x2a\xd4\xd8\x2a\
In our network life, computer viruses pose a major threat to us. We are very concerned about how to prevent viruses. In fact, the prevention of computer viruses is not simply a few words. Some of us have very many mistakes in our understanding, next let's take a look at some of the mistakes we encounter when dealing with computer viruses.1. the DIR operation on t
relocation process, compared with the use of interrupts, but also to prevent the application of trace analysis.CIH virus has two innovations, one is the virus infection when looking for the infected object files in the white space between the blocks, the virus's own various data structures and code to write to it (if the white space is not contagious, which is why some files are not infected with one of th
In our network life, computer viruses pose a major threat to us. We are very concerned about how to prevent viruses. In fact, the prevention of computer viruses is not simply a few words. Some of us have very many mistakes in our understanding, next, let's take a look at the top 15 mistakes we made in the face of computer viruses.
The DIR operation on the infecte
Virus program source code instance analysis-example code of CIH virus [2] can be referred to below
Virus program source code instance analysis-CIH virus [2]
OriginalAppEXE SEGMENT ; PE format executable file headerFileHeader:Db
Because the running program is protected by Windows, viruses are often killed and cannot be deleted even if they are found. Antivirus software kills the virus how to do? It used to be recommended to kill in Safe mode or DOS mode. Now there is a new method called "Specify the debugger in the image File Execution option", and it should be possible to disinfect it in this way. The principle is to modify the re
, resulting in system crash and data loss in severe cases. The phenotype of virus programs reflects the true intention of virus designers.Features: infection, concealment, destruction, DerivationComputer Virus vigilanceBecause computer viruses are a file (Program) that can b
family. For example, the family names of the famous CIH virus are unified "CIH ", in addition, the family name of the recently popular wannacache worm is "Sasser ".
A virus suffix is a variant of a virus. It is used to distinguish a variant of a specific family of viruses. Generally, 26 letters are used for representation, such as Worm. sasser. B Refers to B, a
Summary of computer viruses in the network, such as mail viruses, worms and Trojans and other types of viruses and the characteristics of the relationship between the common message virus and the example. At the same time, according to the current computer virus development trend, put forward some prevention suggestion
network security, mainly to prevent hacker intrusion and malicious attacks. Especially for online transactions, it is best to use anti-virus software with the firewall. At the same time, it is best to Upgrade anti-virus software once a day. Rising now provides at least three versions of virus database updates every week. The rising fire wall has a dedicated pass
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.