dharma virus

Jiang Min's August 10 virus broadcast: Beware of the account and password of online game thieves "Perfect World International Edition" Players Jiang min reminds you today that among today's viruses, Trojan/PSW. GamePass. tip "online game thieves" variants tip and TrojanDownloader. Small. lge "Small dot" variants lge deserve attention. Virus name: Trojan/PSW. GamePass. tip Chinese name: tip of the "Online Ga

Recently, some time ago, the 8749 virus on the user's IE homepage was tampered with to generate a new variant, variant B, with more destructive power. This not only can end anti-virus software on the user's computer, you can even delete files related to some anti-virus software. As a result, the anti-virus software is

Recently, some netizens reported that the computer was down and nothing except the mouse could be changed. In addition, almost none of the keyboard shortcuts are available (only the "Task Manager" is available). The most strange thing is the crazy pop-up of the optical drive. In the past, there was a virus called "Crazy Optical Drive", but "Crazy Optical Drive" is a timed attack, and the optical drive pops up once every one minute, which is inconsiste

Virus symptoms: Antivirus software is disabled, hidden files can not be displayed, start command msconfig can not run, a lot of assistive software also can not run, run EXE and SCR files after the virus infection Manual killing of the software used: Sreng Software and Xdelbox software 　　 Quote: Virus Name: trojan-downloader.win32.agent.****

Now the virus is really very powerful, so that anti-virus software can not start the normal has been very flattering. Recently I ghost.pif is this kind of virus, it in the antivirus software installation directory to forge a malicious ws2_32.dll file, resulting in anti-virus software at startup can not load the correct

failure phenomenon: The machine can be normal before the Internet, suddenly appear can be authenticated, not the phenomenon of the Internet (can not ping the gateway), restart the machine or under the Msdos window to run the command arp-d, but also to restore the Internet for a period of time. Failure Reason:This is caused by an APR virus spoofing attack. The cause of the problem is generally due to ARP Trojan attack. When using a plug-in or

Iexplore.exe is the main program for Microsoft Internet Explorer. This Microsoft Windows application allows you to surf the web and access the local Interanet network. This is not a pure system program, but if you terminate it, it may cause an unknown problem. Iexplore.exe is also part of the Avant web browser, a free Internet Explorer-based browser. Note that Iexplore.exe also may be a trojan.killav.b virus that will terminate your anti-

Jiang Min's August 11 virus broadcast: Beware of the star lock virus stealing the login password of Web Pages browsed by users Jiang min reminds you today that in today's virus, I-Worm/Locksky. ax star lock variants ax and Trojan/PSW. Moshou. aef "Warcraft" variants aef are worth noting. Virus name: I-Worm/Locksky. ax

Virus program source code instance analysis-CIH virus [3] code, you need to refer to the jmp ExitRing0Init; exit Ring0 level 　　 ; Size of the merged code CodeSizeOfMergeVirusCodeSection = offset $ 　　 ; New IFSMgr_InstallFileSystemApiHook function call InstallFileSystemApiHook: Push ebx 　　 Call @ 4 　　 @ 4: Pop ebx; get the offset address of the current command Add ebx, FileSystemApiHook-@ 4; the offset diffe

Disk drive Trojans have recently become a hot topic in the field of security, it is reported that since the March, "Disk machine" Trojan Horse has been updated several times, infection rate and destructive power is gradually increased. The virus after the operation to shut down and prevent 360 security guards and Kabbah, rising, Jinshan, Jiangmin and other security software operation, in addition to delete the system contains "360" the words of the do

Software Introduction: Chenoe Anit-virus Tools (short: C-AV) to restore the virus destroyed by the file and suppress the virus-oriented professional anti-virus software, the killing of some Trojan virus is also quite effective. With a strong pertinence and flexibility, the f

Virus Name: Worm.Pabug.ck Size: 38,132 bytes md5:2391109c40ccb0f982b86af86cfbc900 Adding Shell way: FSG2.0 Written Language: Delphi How to spread: through mobile media or Web page malicious script propagation Through the virtual machine operation, and after the Shell OD analysis, its behavior is as follows: File creation: %systemroot%\system32\gfosdg.exe %systemroot%\system32\gfosdg.dll %systemroot%\system32\severe.exe %systemroot%\system32\drivers

in use and cannot be deleted", but these files are not in use, at this point, you can try to restart the computer and enter safe mode at startup. After you enter safe mode, Windows Automatically releases control of these files and deletes them. "Security Mode" Restoration If the computer cannot be started properly, you can use "safe mode" or other startup options to start the computer. Press F8 when the computer is started, and select safe mode from the "Start mode" menu, then perform system re

Because the running program is protected by Windows, viruses are often killed and cannot be deleted even if they are found. Antivirus software kills the virus how to do? It used to be recommended to kill in Safe mode or DOS mode. Now there is a new method called "Specify the debugger in the image File Execution option", and it should be possible to disinfect it in this way. The principle is to modify the registry, so that the

Recently used Super rabbit detection of suspicious procedures Microsoft.exe, located in C:\WINDOWS\system32, in the process after the shutdown and appeared in the process, in the Safe mode after the deletion, the heavy start again! ~ ~ Is this a virus? Microsoft-microsoft.exe-Process Information Process files: Microsoft or Microsoft.exe Process name: Gaobot Virus www.sstorm.cn our permanent domain name! P

Many teachers have problems with the machine, look at the process there is a IEXPLORE.EXE, the end of the process, a few will appear, is likely to be in the gray pigeon virus, the following to paste the virus to remove the method, please machine a similar situation on the teacher in this way to antivirus Grey Pigeon virus The gray pigeon is characterized by "thr

(In fact 2000,xp all have smss.exe necessary process, but its path is c:\winnt\system32, see the Path tool can use Process Explorer this tool to see) Write a Autocommand.ini file in D disk that can be deleted, but deleted and then automatically generated. 　　 First, restore the system disk mirroring, enter the system. Found to be still poisoned 　　 Two view registry startup project run has a load item tprogram=c:\windows\smss.exe, you can delete it, and after the startup registry has this! 　　

Now the virus is really very powerful, so that anti-virus software can not start the normal has been very flattering. Recently I ghost.pif is this kind of virus, it in the antivirus software installation directory to forge a malicious ws2_32.dll file, resulting in anti-virus software at startup can not load the correct

Where is a bear cat burning incense?????Not a panda in incense, but all the EXE icon pocket into a burning 3 fragrant little panda, the icon is very cutePay in a manual way:Panda Variety Spoclsv.exe SolutionVirus name: WORM.WIN32.DELF.BF (Kaspersky)Virus alias: WORM.NIMAYA.D (Rising)win32.trojan.qqrobber.nw.22835 (Poison PA)Virus size: 22,886 bytesAdding Shell way: upackSample md5:9749216a37d57cf4b2e528c027

Virus name: BACKDOOR.WIN32.IRCBOT.ACD (Kaspersky) Virus size: 118,272 bytes Adding shell way: Pe_patch NTKRNL Sample Md5:71b015411d27794c3e900707ef21e6e7 Sample sha1:934b80b2bfbb744933ad9de35bc2b588c852d08e Discovery Time: 2007.7 Update Time: 2007.7 Communication mode: Spread by MSN Technical analysis The virus sends messages to MSN contacts and a poisoned pa