Anti-Virus Attack and Defense Research: simple Trojan Analysis and Prevention part1I. preface the development of virus and Trojan Horse technologies today, because they are always complementary, you have me and I have you, so the boundaries between them are often no longer so obvious, each other often uses some of the
Teach you to judge the existence of a virus Trojan from the processAny virus and Trojan exists in the system, can not be completely and process out of the relationship, even if the use of hidden technology, but also can find clues from the process, so, to see the process of activity in the system is the most direct way
facilitate the upgrade.
10. Download the virus list from the address http://33.xi *** id ** 8.cn/soft/update.txt specified by the virus author, download other viruses according to the list information, download one at a time, delete after running, and then download.
Among the downloaded virus files, there are Trojan F
With the increasing number of network users, all kinds of virus Trojan theft program will naturally be regarded as the mouth of the delicious. In a number of stolen pioneer Trojan down at the same time, will generate an alternative to the theft of the program, one after another, a network of improper use, will soon give personal network Bank account to bring larg
Doubt your computer in the Trojan, from the process can you see it? Of course, as long as you have mastered some computer knowledge, you can quickly identify. Ctrl+alt+del Open your computer process and study together.
1. Cynical
If the user compares forestall, then above this trick is useless, the virus will be on the spot FA-rectification. As a then, the virus
Autorun. INF file (see article 006th on Anti-Virus Defense: Using WinRAR and autorun. INF). You can check in cmd:
Figure 7 view hidden files
Because I have determined that the drive C contains Autorun. INF file, but the Dir command is not seen, it indicates that it should be hidden, so here you need to use the "dir/AH" command (view the files and folders whose properties are hidden. Objects are suspicious files ). Because the properties of the
1. Virus description:
The virus is transmitted through a USB flash drive. After running the task, copy the virus to the system directory and release a gray pigeon Trojan. To enhance concealment, the generated virus files include the recycle bin and security
Installation
Pro
Virus Trojan scan: manually killing pandatvI. Preface
At the beginning of this series of studies, I chose the "pandatv incense" virus as the study object. The reason for choosing this virus is mainly because it is representative. On the one hand, it had a huge impact at the time, making computer practitioners familiar
Jiang min reminds you today that in today's virus, Trojan/Agent. mjc "proxy Trojan" variants mjc and Backdoor/Huigezi. rng "gray pigeon" variants rng are worth noting.
Virus name: Trojan/Agent. mjc
Chinese name: "proxy trojan" v
uninstall program is false to confuse users!!
The Youth Forum Deadwoods netizen detailed analysis, because the original post picture has been invalidated, I will the content slightly edits to turn over:
Today Kaspersky report found Trojan Horse (December 19)
The latest version of Jinshan Poison PA and rising anti-virus software are not yet recognized this Trojan
The safety clinic's duty doctor Sails, is inquiring some information. Then push the door into a sick man. The patient said he had recently been robbed of a number of Internet accounts associated with himself and wanted to see what was the reason for the doctor.
Zhang Fan asked the patient has not installed anti-virus software. Patients said they installed antivirus software is the latest version of Kaspersky, not only on a daily basis to update the
The boundaries between viruses, worms, and Trojans are becoming increasingly vague, so they can be understood for their potential purposes.More and more easily. Generally, a virus is transmitted by email with a certain payload. Worms use other channelsChannels, such as IM, SNMP, RSS (not yet available, but it may be faster) and other Microsoft protocols. Worm connectionIt usually brings a certain amount of load. They aim to spread as quickly as possib
Rising 1.7 virus broadcast
According to the rising Global anti-virus monitoring network introduced today, a virus is particularly noteworthy, it is: "Small Trojan variant Zpi (TROJAN.DL.WIN32.SMALL.ZPI)" Virus.
This is a trojan
Jiang Min's September 13 virus broadcast: the "little" disguised as a playback software Icon to download malicious programs at will
Jiang min reminds you today that Trojan/ASP. WebShell. c "Web thieves" Variants c and TrojanDo
Wnloader. Small. mdz the mdz variant is worth noting.
Virus name: Trojan/ASP. WebShell. c
Chi
This article contains an overview of Windows almost all common virus, Trojan process name, check your system process to see if the Recruit.
EXE→BF Evolution mbbmanager.exe→ Smart gene
_.exe→tryit Mdm.exe→doly 1.6-1.7
aboutagirl.exe→ first lover microsoft.exe→ Legendary cipher Messenger
Absr.exe→backdoor.autoupder mmc.exe→ Nimda virus
aplica32.exe→ the Dead
According to rising global anti-virus monitoring network, there are two viruses worth noting today: "Trojan. PSW. win32.XYOnline. jg) "and" QQ pass variant YRH (Trojan. PSW. win32.QQPass. yrh) "virus. The JG virus of xiyou Trojan
also destroys the key values in the registry of the operating system, so that the system cannot display hidden files.
For this virus, the anti-virus center of Jiangmin technology has urgently upgraded the virus database. You only need to upgrade it to the virus database on January 1, September 20 to intercept the
"QQ account theft 139373" (Win32.Troj. AmorBc. c.139373) is a QQ account theft Trojan. After the virus runs, the virus file is released to the program folder and self-started by using ShellExecuteHooks. By injecting the process, you can monitor the user's QQ token tool and read the LoginUinList In the QQ directory. dat obtains the user number list and deletes ewh
Wsyscheck is used for manual anti-virus/Trojan. What is image hijacking?
In some cases, the vast majority of anti-virus software may not be available after the machine is poisoned, because the virus uses the "image hijacking" in the registry ". To put it simply, when the software a.exe is infected with
Last week, the Jinshan Anti-Virus center intercepted a theft "magic Domain", "perfect World" and "Hao Side game platform" for the purpose of the Trojan virus, the virus named win32.troj.onlinegames.ms.18432, since the advent of the Thursday has been derived from a number of variants. Jinshan Customer Service Center rec
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.