Description: When system initiation uses the Explorer.exe advancement autoloading virus module
4th, the advancement which carries out for the current system in takes the snapshot through function CreateToolhelp32Snapshot, then use
Process32First and in the Process32Next function traversal snapshot records the advancement tabulation, judges whether to save
In the AVP.exe advancement, the existence then through the function " SetSystemTime " the revision system time was in 2003, the month,
Japan is invariable, causes Caba the Siji expired expiration
5th, if discovered that has the LaTaleClient.exe advancement, then finished its advancement, when the user lands once more, through read
server.dat obtains the user in the server related information, through interception current user's keyboard and mouse news
Gains the network game “the rainbow island” the account number and the password, transmit URL which assigns to the viral author.
6th, this virus after realizing own code, will then finish own advancement, deleted own document.
Note: %System32% are an invariable way. The virus decides the current System folder through the inquiry operating system
Position.
%Windir% WINDODWS in table of contents
%DriveLetter% Logical driver root directory
%ProgramFiles% The system program default installs the table of contents
%HomeDrive% Current start system in district
%Documents and Settings% Current user documents root directory
%Temp% \ Documents and Settings
\ current user \ Local Settings \ Temp
%System32% System's System32 folder
In Windows2000/NT tacitly approves installs the way is C:\Winnt\System32
in windows95/98/me tacitly approves installs the way is C:\Windows\System
in windowsXP tacitly approves installs the way is C:\Windows\System32
--------------------------------------------------------------------------------
Elimination plan:
1st, uses the peaceful day defense line 2008 to be possible to eliminate this virus thoroughly (recommendation),
Welcome to peaceful day website downloading: www.antiy.com
2nd, the manual elimination please defer to the behavioral analysis deletion correspondence document, resumes the system-related establishment.
(1) uses the ATOOL unloading to pour into to related advancement bndfxdh.dll, the concrete operations are as follows:
Opens ATOOL→ the tool menu -> search to handle the DLL item -> to input bndfxdh.dll,
Click search -> click unloading, when presents “you whether can unload includes bndfxdh.dll
When loads the movement all dll document, elects “is (Y) then.
(2) deletion virus document:
%System32% \ bndfxdh.cfg
%System32% \ bndfxdh.dll
Other pages: : <<Prev * 1 * 2 * 3 * Next>>
|
You are here: hacking technology
> the virus to be related
> Content
Category: Home
> the virus to be related