Virus broadcast on April 25: Downloader and QQ thief variant

The "downloader" variant HO (Win32.Troj.Downloader.ho) is a Trojan horse virus that will connect to the specified site to download other viruses.

The "QQ Thief" variant DYY (Win32.Troj.QQPass.dyy) is a Trojan horse that steals users' QQ accounts.

1. "Downloader" variant HO (Win32.Troj.Downloader.ho) threat level: ★

The virus is a Trojan downloader. When it finds that the IE of the infected computer is available, it will automatically connect to multiple malicious sites and download other multiple Trojan viruses. The downloaded viruses are some hacking Trojan viruses, which are virtual to the user's network. Property poses a serious threat. In addition, this variant will infect the removable disk of the computer to achieve the purpose of spreading the virus, which may cause the spread of the virus. It is recommended that users be vigilant and protect the safety of the computer.

After the virus runs, it will copy itself as BinNice.bak and release a BinNice.dll virus file. Inject into the system process explorer.exe, connect to multiple malicious sites such as h ** p: //7y7.us/s**n/csrss.exe, and download the virus. Release the Ghost.pif and autorun.inf virus files to the removable disk to spread itself.

2. The variant of "QQ Thief" DYY (Win32.Troj.QQPass.dyy) threat level: ★

The virus is a maliciously modified version of "QQ Thief", similar to the previous "QQ Thief" malicious behavior, it is derived from the user's QQ account, it will lurk in the system of the infected computer, waiting to find the QQ login window , Intercept the user's QQ account and password information, and send the stolen information to Trojan growers, resulting in the loss of personal property of the user's network. In addition, it can also forcibly terminate the monitoring process of some anti-virus software, which reduces the security performance of the computer and is vulnerable to other viruses.

After the virus is running, it will release multiple virus files such as wiusvt.exe, modify the registry, and start automatically with the boot. End the protection process of multiple antivirus software such as rfwmain.exe and RavMon.exe.

Kingsoft Anti-Virus Engineer's suggestion

1. Establish good safety habits. Do not open some unrecognized e-mails and attachments, do not go to some unfamiliar websites, and do not execute files that have not been processed by anti-virus software after downloading from the Internet, these can ensure your computer is more secure.

2. At present, viruses that steal password information from users' games, instant messaging tools, etc. appear frequently, so users must strengthen security precautions to avoid losses to you.