Virus Trojan scan and removal: compilation of the dedicated kill tool for QQ Trojan Horse stealingI. Preface as I have compiled a general kill tool framework in article 004th "virus Trojan
is not completely clear, you must delete the DLL, while removing the service, restart, in the removal of the cleanup, because the virus conversion requires a lot of time, in the start-up can not immediately release the DLL to This is also the best time to purge.
It is recommended that users use Jinshan cleanup experts to add these random 8-digit DLLs and EXE to the delete list of the file shredder and delete the files once and for all. After the reb
= 600;}">
At this time should use 360 security guards to the killing, or login to the 360 Security Center website (
www.360.cnDownload the Kill tool (download address:
Http://dl.360safe.com/killer_ati2evxx.exe)。 can also use the 360 kill Daquan, (download address:
Http://dl.360safe.com/360compkill.exe)。
At present, the use of web pages to hang horses and third-party software vulnerabilities intrusion co
1. Virus description:
The virus is transmitted through a USB flash drive. After running the task, copy the virus to the system directory and release a gray pigeon Trojan. To enhance concealment, the generated virus files include the recycle bin and security
Installation
Pro
According to the process name killing
This method is implemented by the Taskkill command under the WinXP system, before using this method, first you need to open the process list interface of the system to find the specific process name corresponding to the virus process.
Then click on the "Start → run" command, in the pop-up system run box, run the "cmd" command, and then enter the DOS command line in the "TASKKILL/IMAAA" format of the string comma
When the computer works in abnormal state, such as the emergence of Win7 system slow, unresponsive, high CPU occupancy rate phenomenon, may be a Trojan horse or virus program in the system, can be killed by the following several aspects.
1, the use of anti-virus software
Can the emirate first upgrade anti-virus softw
Recently, a friend suffered 8749 virus, pain, finally from the poison PA official found this software, we can try
Brief introduction: Clear av terminator/8749 virus, fix "image hijacking", Fix autorun.inf, fix safe mode.
Update Description:
October 16: Special kill added Function: New variant of the killing
August 15: Special
package after decompression, without installation, directly double-click the main program to run. Shell Trojan Kill tool's main interface as shown in the figure, the main interface provides a scan button, the user clicks this button can run Trojan killing operations, and the main interface of the default display is "Security prompts."
Figure 4 Shell
stick to maintain the status of poisoning, first unplug the USB flash drive, and then start the Kill tool, so that it began to monitor, then insert a USB flash drive, kill the tool will automatically start Avira:Figure 7 At this point, if you click on the "safe to open the USB flash drive", will open the USB flash drive, you can find that the USB flash drive has no vir
appeared in the "Panda incense" pattern, the company's external financial settlement completely paused, the general manager for this was furious.
Data show that China currently has more than 10 million small enterprises, and in recent years the prevalence of Soho-type home entrepreneurial small companies are countless, these enterprises in the early days, often in the network security, there is no fortification, most companies rely on a single version of anti-
Virus Trojan scan: manual scan of QQ Trojan Horse stealingI. Preface
In previous articles "virus Trojan scan and removal 002nd: manually killing pandatv incense", I basically detected and killed the "pandatv incense" virus without
computer suddenly in a very slow day, it is possible that your computer is controlled, that is, your computer in the Trojan Horse, launched the Trojan program.
Attention matters
Once you find an illegal shared letter or folder on your computer, quickly remove the share
Once you find one of your disks. Fugen directory (especially c: disk) There are some strange executable files, cut the random click, bec
to my network disk download http://ycosxhack.ys168.com/, "Virus Kill" directory, file name "Ps.rar", with instructions.3, this time each function module optimization, each function module can be used alone.4, taking into account the high efficiency and simplicity of the code, in some places invoke the CMD program, and because of the addition of the environment variable to make the code more versatile!
The
thread code is placed in it VirtualAllocEx (Rphandle,null,cb,mem_commit,page_execute_readwrite); Writes the remote thread's code to the remote process's address space writeprocessmemory (RPHANDLE,REMOTETHR, (LPVOID) remote,cb,null); The parameters required by the remote thread are also written to the address space of the remote process writeprocessmemory (Rphandle,remotepar, (LPVOID) rp,cb,null); Create a remote monitoring thread CreateRemoteThread (rphandle,null,0, (Lpthread_start_rout
Any viruses and Trojans exist in the system, can not completely and process out of the relationship, even if the use of hidden technology, but also can find clues from the process, therefore, viewing the process of the system activity is the most direct way to detect the virus Trojan. But the system runs at the same time so many processes, which is the normal system process, which is the process of Trojans,
Latest virus Combination Auto.exe, game theft Trojan download manual killing
The following is a virus-enabled code Microsofts.vbs
Copy Code code as follows:
Set lovecuteqq = CreateObject ("Wscript.Shell")
Lovecuteqq.run ("C:\docume~1\admini~1\locals~1\temp\microsofts.pif")
Trojan Name:
Before use, please break the network, delete the system directory of SysLoad3.exe and 1.exe,2.exe,..., 7.exe, with IceSword delete the temporary directory of the several dynamic libraries. You can run this recovery program when there are no iexplore.exe and Notepad.exe processes in the task Manager.
Special note: Run the process, do not run other programs, it is possible that you run the program is poisonous!!
[b] Two: The following are analysis and manual removal methods:
Yesterday afternoo
PsKill Msns.exe
echo "Kill Msns the virus that paralyzed the network ... jb51.net"
echo "shuts down process 10 ..."
echo "shuts down process 9 ..."
echo "shuts down process 8 ..."
echo "shuts down process 7 ..."
echo "shuts down process 6 ..."
echo "Kill Msns the virus that paralyzed the network ... jb51.net"
Attrib-h-
(Szsearch, stfindfile); if ( hFindFile! = Invalid_handle_value) {do {//the path to the complete program to be detected lstrcat (Szfindfile, stfindfile.cfilename);//Use Special Code detection Target program is not a virus program if (! Checksig (Szfindfile)) {printf ("%s is not a virus program \ n", szfindfile);} Remove the program name and keep only "e:\" szfindfile[3] = ' stfindfile '; ret = FindNextFile
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.