Jiang Min's August 10 virus broadcast: Beware of the account and password of online game thieves "Perfect World International Edition" Players
Jiang min reminds you today that among today's viruses, Trojan/PSW. GamePass. tip "online game thieves" variants tip and TrojanDownloader. Small. lge "Small dot" variants lge deserve attention.
Virus name: Trojan/PSW. Game
causes the files to become unavailable, at the same time, it may cause false positives of other anti-virus software. These files can be deleted directly.
9. encrypted files or directories.
For encrypted files or directories, perform virus scanning and removal after decryption.
10. shared directory.
There are two scenarios: Local shared directory and remote share
The huge market demand will inevitably lead to a large number of excellent products. The three well-known anti-virus security vendors rising, Kingsoft and Jiangmin are outstanding representatives of many anti-virus software products in China. However, such a huge domestic anti-virus security software market is an opportunity for any anti-
Virus performance:Network traffic is full of crazy to send data to an IP in Hong Kong, while in top of a random 10-letter process, see/proc inside the information, then LS,CD and other common commands, CPU utilization is also top. After the process is killed, a new process is randomly generated.Find steps:First,/proc/_pid/cmdline inside are forged information, PS display content is the same, basically for t
Many people think that the virus can be completely cleared if the operating system is re-installed. However, I do not know that after the operating system is re-installed, due to security settings and patch installation failure, the virus is most likely to be infiltrated, therefore, some necessary supplementary measures are critical.
1. Do not rush to access the network
After Windows is installed, do not im
The virus registers itself as an NT service in order to boot up:
[Tomdemoservice/tomdemoservice] [Running/auto Start] Delete method:
1, first delete the file can be considered tools POWERRMV or XdelboxC:\CONFIG. Exe
C:\CONFIG.dll is ignored if it does not exist.
C:\CONFIG_key.dll is ignored if it does not exist.
C:\CONFIGhook.dll is ignored if it does not exist.
C:\CONFIG.log is ignored if it does not exist.
2, restart the computer into Safe mode, w
out of the folder, it will be copied to another folder.# encoding=utf-8from time import sleepimport os, shutilusb_path = "/Volumes/"content = os.listdir(usb_path) # os.listdir(路径)返回路径下所有文件以及文件夹的名称while True: new_content = os.listdir(usb_path) #每隔三秒扫描一次/Volumes/ if new_content != content: # 如果发现异常,即多出一个文件夹,则退出 break; sleep(3)x = [item for item in new_content if item not in content]# 找到那个新文件夹,返回包括新文件夹string类型名称的列表,这个表达方法很pythonicshutil.copytree(os.path.join(usb_path, x[0]), ‘/User
"Ad download server 36864" (Win32.Hack. agent.000064) is a pop-up window for reading the specified website and obtaining and downloading other malware on the client's computer.
Win32.PSWTroj. JHOnline.139264.
I. "ad download server 36864" (Win32.Hack. agent.000064) Threat Level:★
1. Obtain the volume serial number of "C: \" on the client computer, perform an algorithm with the string specified by the virus, and calculate A string. (8-bit file name)
2.
A new mobile phone virus named MMarketPay. A has already spread in China. Currently, about 0.1 million mobile phones are infected, involving 9 app stores in China.
This virus was discovered by TrustGo and named it 'mmarketpay. a'-the malware will automatically buy software from the domestic App Store (M-Market. TrustGo provides evidence that the applications of the following third-party app stores have been
1, as shown below we will see the notification interface will have a firewall or virus protection and so on prompts.
2, now we just press the
win+x key to open the System function menu, and then we find "Control Panel";
3, into the Control Panel we click on the switch "small icon" or "Large Icon", select "Security and Maintenance" details as shown in the following figure;
4, then we find "change security and maintenance Setti
appeared in the "Panda incense" pattern, the company's external financial settlement completely paused, the general manager for this was furious.
Data show that China currently has more than 10 million small enterprises, and in recent years the prevalence of Soho-type home entrepreneurial small companies are countless, these enterprises in the early days, often in the network security, there is no fortification, most companies rely on a single versi
-time monitoring programs (virus firewalls) at the same time ).
Misunderstanding 9: Install anti-virus software and personal firewall.
Many people regard the Real-time Monitoring Program of anti-virus software as a firewall. Some anti-virus software calls real-time monitoring a "vi
frequently experienced blue screens and crashes, the "pandatv incense" pattern also appeared in the computer, the company's external financial settlement completely paused, the general manager was so open.
According to data, there are more than 10 million small enterprises in China, and there are countless small SOHO family-style entrepreneurial companies that have been prevalent in recent years. Because these enterprises are in the early stages of t
infected with all the size of 27KB-10MB executable files, infected in the infected folder generated:_desktop.ini (File attributes: System, hidden. )
5, the virus will try to modify the%sysroot%\system32\drivers\etc\hosts file.
6, the virus by adding the following registry key to achieve the virus boot automatically run:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
OnlySetInfectedMark
; Read all virus block tables
Mov eax, ebp; read function number
Call edi; read the block table to esi (@ 9)
The following is a complete modification to handle the Winzip self-extracting file error. when you open the self-extracting file,
The virus will not be infected. First, the virus obtains the ToRawData pointer of the 2nd block tab
First of all, no matter what virus you have, if you do not understand the meaning or suspected of a virus, please refer to my plan to try first:
4. Start = "Run =" Input: msconfig= "OK =" start = "all disabled (D) =" OK
5. Start = "Run =" Input: regedit= "OK =" hkey_local_machine\software\microsoft\windows\currentversion\run\= "Right can be deleted all
6. Start = "Run =" Input: regedit= "OK =" hkey_loca
in DOS mode
mov eax, [ecx+28h]
MOV (FILEMODIFICATIONTIME-@6) [esi], eax; Save the obtained file time and date
; exit the virus program
Quitmyvirusfilesystemhook:
Popad; restore all registers
ret; exit from file hook program for virus settings
; Destroying the computer BIOS
Iskillcomputer:
To obtain the current date from the BIOS CMOS
mov al, 07h
Out 70h, AL
In Al, 71h
Xor al, 26h;
Through the U disk transmission of the virus Sxs.exe power has always been very large, once n a computer was his downfall ~ ~ Its variant is also increasingly refurbished, the pattern white ~ ~ Computer engine room and poisoned ... Each letter has hidden files, the icon is Conan head Sxs.exe and autorun, virus system into the xeklsk.exe.
Hidden files cannot be displayed through Folder options.
After repeate
With the rising of the virus can not be worse, with Kabbah upgrade to May 25 after the ability to find, but note that Kabbah will infect Word documents, pictures together delete!
Because a lot of documents are urgent and important, if lost on the problem is serious, so do not understand the computer do not use Kaspersky, because he is too professional.
Fortunately, the source file is not many, I deleted a few, the specific removal method on the Intern
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.