“dead pig downloading 147456” (Win32.Troj.EncodeXor.a.147456), this is a downloading procedure. It adopts the method which the double advancement simultaneously moves to realize protects oneself, and will destroy the massive security software's normal operation. Afterward in backstage downloading massive other wooden horse procedure.
¡¡¡¡“wooden horse resistance module 4224” (Win32.Hack.Rootkit.4224), this is a viral actuation document. It is one of some wooden horse's composition modules. It will restore system's SSDT table, will let have the active defense function to kill the poisonous software expiration.
¡¡¡¡First, “dead pig downloading 147456” (Win32.Troj.EncodeXor.a.147456) Threat rank: ¡ï¡ï
¡¡¡¡This virus is the wooden horse downloading procedure, its principle is not complex, but the aggressivity is strong. Because it after entering the computer, the reflection will kidnap the nearly all present mainstream security software crazily, will cause the computer to lose the defense capability completely.
¡¡¡¡After this poison enters the computer, table of contents releases viral document SiZhu.exe in %WINDOWS% \ system32 under the \ (Chinese sound with “dead pig”, this filename some are inelegant, but may also see viral author's goal, is kills user's security software), simultaneously, it disseminates this document's transcription with a AutoRun.inf document the complete disk partition under the root directory. Does this, can help it to infect the user to insert to toxicant on computer's migration storage devices and so on U plate, realizes the large-scale infection.
¡¡¡¡Then, it revises the registry start item, is realized oneself starting self-starting, and adopts simultaneously moves many advancement ways, the avoidance user manual looks up kills.
¡¡¡¡Then, it establishes the reflection to kidnap, to attempt to let the Jinshan poisonous tyrant, mainstreams and so on Caba Siji, auspicious star, NOD32, Symantec, wheat coffee kill the poisonous software, as well as Jinshan cleans up the expert, 360 security bodyguards and so on safe auxiliary software paralysis.
¡¡¡¡If succeeded destroyed the security software, the virus will connect long-distance address http:/ /whh.9 ** 6.org which assigned, downloaded a viral tabulation, again according to tabulation in address downloading massive wooden horse procedure. It downloads in the wooden horse procedure, majority is the net tours, the net silver to rob the number wooden horse, possibly to user's hypothesized property, the bank deposit, the commercial secret and so on will pose the threat inestimably.
¡¡¡¡Reported about this virus's multianalysis that may consult http://vi.duba.net/virus/win32-troj-encodexor-147456-50800.html in the Jinshan virus big hundred branches
¡¡¡¡Second, “wooden horse resistance module 4224” (Win32.Hack.Rootkit.4224) Threat rank: *
¡¡¡¡Although this virus may move independently, but it is unable alone to bring the profit for the viral author, poisonous tyrant counter-virus engineer thought that it belongs to some wooden horse document constituent, the goal is relieves some to kill the poisonous software the active defense function, is advantageous for wooden horse's next step the motion.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> the virus to be related
> Content
Category: Home
> the virus to be related