ArticleDirectory
Solution
People who have used Telecom broadband know that if an invalid domain name is entered, it will be hijacked by 114 (without iron and Netcom, I don't know if it will happen), and there will be annoying pop-up windows, the figure is as follows:
This is a spam advertisement page designed by a Telecommunications Company for greater benefit. This page is displayed every time a domain name is entered incorrectly or has not
Virus name: TROJAN.DELF.RSD MD5 216a3783443fc9c46fe4d32aa13c390f
After running the virus sample, automatically copy the copy to the%systemroot% directory
%systemroot%\flashplay.dll
%systemroot%\ge_1237.exe
X:\flashplay.dll
X:\readme.txt.exe
X:\autorun.inf
X refers to a non-system drive letter
%systemroot% is an environment variable,
What's inside Autorun.inf:
[Autorun]
Open=.\readme.txt.exe
Shell\1=open
software may be corrupted and unable to run.Rising "Orange August special Extraction Removal Tool" specifically for such viruses to write, you can clear the "QQ Pass (Trojan.PSW.QQPass)", "Legendary Terminator (Trojan.PSW.Lmir)", "Missimma (Trojan.psw.misc)" and other viruses and variants. Rising anti-virus software does not install the user can download the use of free.
Dedicated kill tool specifically targeted at
reason one: Youdao dictionary desktop version before the release has been a rigorous test, from the normal channel to download the Youdao dictionary installation program will never carry any virus. If you install the Youdao dictionary in the process of anti-virus software pop-up warning window, because the choice of the installation of the same Youdao toolbar, so
AboutPush RSI -page:fffff80004180621 $Push Rdi thepage:fffff80004180622 A WuPush R12 +page:fffff80004180624 A -Push R13 Apage:fffff80004180626 A AboutPush R14 thepage:fffff80004180628 A $Push R15 +page:fffff8000418062a - BayiEC - on xx xxSub RSP, 130h - page:fffff80004180631 4D 8B E8 mov r13, R8 $ $ parameter passing is such that more than four parameters - - the Zwcreatekey ( - Out phandle Keyhandle,Wuyi in Access_mask desiredaccess, the in Pobject_attributes objectattributes, - in ULO
Add the following lines to this file C:\Windows\System32\drivers\etc\hosts127.0.0.1 q.rising.cn127.0.0.1 cloudinfo.rising.com.cn127.0.0.1 rising.com.cn127.0.0.1 wan.rising.cn127.0.0.1 game.rising.cn127.0.0.1 all.rising.com.cn127.0.0.1 download.rising.com.cn127.0.0.1 shop.rising.com.cn127.0.0.1 register.rising.com.cn127.0.0.1 center.rising.com.cn127.0.0.1 z.rising.com.cn127.0.0.1 rsup10.rising.com.cn127.0.0.1 msginfo.rising.com.cnUnder Windows with rising rising anti-
The roommate's computer opened a poisoned Excel file from a school teacher without a precaution. As soon as you open the Excel file will automatically pop up a Book1.xls, and the virus will continue to infect the next local all open Excel files, plus the local network of mutual transmission files eventually many colleagues of the computer is this contains a macro virus
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.