Prefacebefore we have learned the virus-free technology to kill the signature code, but Trojan people are not feeling or very mysterious, then let me for you to uncover the mystery of the Trojan Horse. first, the basic knowledge1.1. Trojan virusTrojan Horse (Trojan) the name
Trojan. DL. win32.autorun. yuz, Trojan. win32.inject. gh, Trojan. win32.agent. zsq, etc.
EndurerOriginal2007-10-231Version
Pe_xscan 07-08-30 by Purple endurer2007-10-22 13:13:44Windows XP Service Pack 2 (5.1.2600)Administrator user group
C:/Windows/system32/winlogon.exe * 604 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | Windows NT logon applicat
package after decompression, without installation, directly double-click the main program to run. Shell Trojan Kill tool's main interface as shown in the figure, the main interface provides a scan button, the user clicks this button can run Trojan killing operations, and the main interface of the default display is "Security prompts."
Figure 4 Shell Trojan
In addition, Trojan. psw. win32.qqpass, Trojan. psw. win32.gameol, etc. 2EndurerOriginal 2008-06-161Version(Step 1)Download fileinfo, bat_do from the http://purpleendurer.ys168.com.Use fileinfo to extract the information of the red files in the log, add or drag the red files in the log into bat_do, select all, use RAR to compress the backup, delay the deletion, and change the file name, delayed deletion.Dow
hijacking item] on the left, find the project corresponding to O26 on the right, right-click, select Delete from the pop-up menu.In [advanced functions]-> [IE and OS repair], click [repair ].
Some Virus File Information:
File Description: C:/Windows/anistio. exeAttribute: ---An error occurred while obtaining the file version information!Creation Time:Modification time:Access time:Size: 16201 bytes, 15.841 KBMD5: e32230ed6197e2e21796eb66e6b013f5Sha1:
,dll Trojan is tattered a heap, therefore, a mature DLL will find ways to protect its loader not so easy to be destroyed. Do you remember the story of a glove? The DLL is crawling on the Wolf Loader on the Jackal.
Loader can be a variety of, Windows Rundll32.exe is also a number of DLLs used to do the loader, this trojan generally without dynamic embedding technology, it directly hangs Rundll32 process, wit
. The virus overwrites the original system file. Therefore, the operating system cannot be restored even if the antivirus software kills the virus.
Misunderstanding 2: anti-virus software is dedicated to virus detection and removal, while Trojan killing is dedicated to
Many friends have encountered such a phenomenon: open a Web site, the results of the page has not been shown, anti-virus software began to alarm, prompted detection Trojan virus. Experienced friends will know that this is a Web page malicious code, but their open is clearly a regular website, no regular website will put the v
1. We recommend that you use XDelBox to delete the following files:Copy the paths of all files to be deleted, right-click the files to be deleted list, select import from clipboard, and restart DeleteC: program filescommon filessystemserv.exe2.
Special sentence for spare partAdd a response.end will have a different effect, that is, after inserting a sentence all the code is invalid, in a sentence here to stop, also reduce the size of Webshell.
Seven steps of the Webshell
, manually update the Kaspersky Virus database.
If the website is infected with Trojans, it cannot be opened as long as it is indexphp.
Generally, computer viruses or Trojans or viruses may damage the system. generally, anti-virus software cannot solve these problems, we recommend that you use system repair tools such as Kingsoft Network security or Kingsoft first aid kit to fix the problem.We recommend th
Trojan? Because the gray pigeon is a rebound trojan, the Trojan can bypass Skynet and other firewall interception, after the horse, the server is the end of the control can be actively connected to the console (client), that is, once the control-side connected to the Internet, in the control side where the controlled end will be "automatic on-line" (Figure 2).
187 of them have been found in the app store.
Some versions of the Porn clicker Trojan can check the anti-virus software on the device. If anti-virus software is detected, the malicious function of the Trojan will not be triggered. Once the installation is complete, the trojan
The heart of the victim cannot be possessed, and the heart of the Defender cannot be possessed! Today, when hackers are prevalent, increasing the level of defense is the top priority. However, we cannot just stick to the slogan, but must adopt
There should be a special generator, encountered a lot of
Do not write analysis of the ...
Workaround:
1, download Sreng2.zip and Icesword120_cn.zip (hereinafter referred to as the Ice blade)
After downloading, put the desktop directly.
2.
Encounter Trojan-Spy.Win32.Delf.uv, Trojan. psw. win32.xyonline, Trojan. psw. win32.zhengtu and so on 1
EndurerOriginal
1Version
Last night, a netizen said that his computer was infected with viruses. Kingsoft drug overlord kept prompting to find winform2.dll. After a period of time, the countdown shutdown dialog box will pop up, asking me to remotely assist him
Trojan. psw. win32.gameol, Trojan. win32.undef, Trojan. DL. win32.undef, etc. 1
Original endurerVersion 1st
Today, a friend's computer was very slow. Please help me with the repair.
Start the task manager and find a strange process named kcodn32.exe.
Pe_xscan is used to scan log analysis and the following suspicious items are found:
/=Pe_xscan 08-08-01 by Purple
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.