诗圣杜甫(国外英语资料).docVIP

诗圣杜甫(国外英语资料) Trojan.Win32.ShutDown (shutdown) virus: The degree of vigilance., Trojan virus, spread through the network, Dependency system: WIN9X/NT/2000/XP. This is a Trojan horse written in VC language. After running, it copies several files to the system, and modifies the registry to realize the boot from the phone. Viruses will search windows, process viewer, registry editor, Windows task manager, and other programs can not run properly. After booting for 1200 seconds (20 minutes), the virus tried to forcibly shut down the users computer and gave the user a great deal of trouble. Virus analysis: First, copy yourself into the following files: C:WINDOWSsystem32winvor.exe C:WINDOWSview.exe C:system32.exe The C:Documents and SettingsAll Users start menu program starts start.pif Two, modify the following key to achieve its self registration purposes: One HKEY_LOCAL_MACHINESoftwareMicrosoft WindowsCurrentversionRun Add data item: RUNEXE Data value: %WINDIR%VIEW.EXE Two HKEY_CLASSES_ROOTtxtfileshell Opencommand (default) Data value: C:WINDOWSsystem32winvor.exe Three. Check to see if the current system has the following window, and if they do, end them: Process viewer, Registry editor, Windows task manager Four. Check whether the current system has the following processes, and if so, end them: Taskmgr.exe., Regedit.exe., Cmd.exe. Five, in the C root directory named autorun.inf file, the file will cause users to access C and the C:system32.exe (virus file operation). Six. Create a thread that will remain dormant for 1200 seconds after the execution of the thread and then close the local computer. Manual method: (antivirus software can be checked in security mode) Delete the following files. - disease poison: (a UNLOCKER software not delete the file after unlocking - delete) C:WINDOWSsystem32winvor.exe C:WINDOWSview.exe C:system32.exe The C:Documents and SettingsAll Users start menu program starts start.pif - repair the registry at run - input REGEDIT One HKEY_LOCAL_MACHI