Broiler mining
Publish: 2021-04-10 14:51:36
1.
a new customer recently consulted with sine security company, saying that his server often fails to open the website of the card, and the remote connection to the server is extremely slow. Sometimes the Ping value reaches 300-500, and he often switches. After listening to the customer's words,
will generally judge that he has been attacked by CC + DDoS mixed traffic, It's strange to say that there is no traffic attack on the computer room. It's not a traffic attack, but it also causes the server card and website to fail to open. What kind of attack is this? In order to solve the problem of
client server card, we immediately arranged a security engineer to carry out security detection and deployment on his Linux server
{rrrrrrr}
mining Trojan horse is also designed. If the mining process is forced to stop by customers, it will automatically start to continue mining to achieve uninterrupted mining.
careful inspection shows that it is through setting the hourly task plan, remotely downloading shell mining Trojan horse, and then executing, Check whether the current process exists or not. If not, start the Trojan horse to mine
a detailed security inspection was carried out on the client's Linux server. It was found that fortunately, there was no encrypted server data, and the worm was infected with the disease through the security detection and analysis of our security engineers, we found that the server uses Apache Tomcat environment, the open architecture of the platform is JSP + Oracle database, and Apache Tomcat uses the version of 2016, which leads to the serious remote command execution vulnerability of Apache, Through this vulnerability, the intruder can directly invade the server and get the administrator permission of the server,
virus. If the data was encrypted, the loss would be great. The client was a platform, and the client's data was very important. After finding out the mining Trojan horse,
do customers need to know how the server is attacked? Was the Trojan horse uploaded? It can prevent the attack
in the later stage
sine security engineer immediately repairs the Apache vulnerability and clears the Trojan horse. So far, the problem has been solved, the client server
runs stably, and the network station opens normally
2. What's going on, man? Report it. Before, when the traffic ore was very hot, my server was also hacked and became a broiler. Then I went to find his information, took a screenshot and reported the traffic ore, and helped me deal with it. If you see what's happened to you, go to them and deal with it.
3.
세 &# 51032; &# 49345;
4. Sapphire is the first brand of a card, followed by Dylan
depending on the price, if the price difference is about 200 yuan, you can consider Xunjing or Yingtong.
depending on the price, if the price difference is about 200 yuan, you can consider Xunjing or Yingtong.
5. What is a computer "broiler". It's a remote computer controlled by someone else. Broiler can be a variety of systems, such as win, Linux, UNIX, etc; It can also be a company; Enterprises; Schools and even government and military servers. Generally speaking, broiler is a Win2K system server with port 3389 on, so it's best to turn off Port 3389 when it's unnecessary
broilers are generally sold by hackers at prices ranging from 0.08 yuan, 0.1 yuan to 30 yuan
to log in broiler, you must know three parameters: IP, user name and password of remote computer
when it comes to broilers, we should talk about remote control. Remote control software such as grey pigeon, Shangxing, etc
broiler is not a kind of food. It's a machine that can be remotely controlled by Trojan horse or by leaving a back door. Now many people call a machine with webshell permission a broiler
no one wants their computer to be controlled by others, but many people's computers are almost undefended, and they are easy to be completely controlled by remote attackers. Therefore, your computer becomes the meat on other people's chopping board, and people can eat it as they want, which leads to the name of broiler (machine)<
[edit this paragraph] how to detect whether you become a broiler
pay attention to the following basic situations:
1: QQ, MSN abnormal login reminder (the system prompts that the last login IP does not match)
2: when logging in Online games, it is found that the equipment is missing or does not match the last offline location, or even can not log in with the correct password
3: sometimes you suddenly find that your mouse doesn't work. When you don't move the mouse, the mouse will move, and you will click the relevant button to operate
4: when you surf the Internet normally, you suddenly feel very slow, and the hard disk light is flashing, just like you usually files
5: when you are ready to use the camera, the system prompts that the device is in use
6: when you are not using network resources, you find that the network card light is flashing. If you set it to display after connecting, you will also find the network card icon in the lower right corner of the screen flashing
7: out of line service
8: users with broadband connection receive abnormal packets when they are not connected after the hardware is turned on There may be a program background connection)
9: the firewall loses control of some ports
10: restart the computer ring the process of surfing the Internet
11: some programs, such as antivirus software firewall, will flash when they are unloaded (the unloading interface will flash by, and then the report is completed.)
12: after the program (QQ ` antivirus) that some users trust and often use is unloaded. The catalog file still exists and is automatically generated after deletion
13: the above phenomenon is basically subjective and not very accurate, but it needs your attention
14: you can also check whether there are suspicious ports by inputting netstat - an under CMD
next, we can use some software to observe the network activity to check whether the system is invaded
1. Pay attention to check the working status of firewall software
for example, Jinshan net dart. In the network status page, the currently active network connections will be displayed. Check the related connections carefully. If you find that you're not using software to connect to a remote computer, be careful
2. It is recommended to use tcpview to clearly view the current network activity
General Trojan connections can be viewed through this tool
here, the general Trojan connection is different from some carefully constructed rootkit Trojans, which adopts more advanced hiding technology and is not easy to be found
3. Use Jinshan cleaning experts to conct online diagnosis, especially pay attention to the process items of comprehensive diagnosis
cleaning experts will evaluate the safety of each item, and need to be very careful when encountering unknown items< How to prevent your computer from becoming a "broiler"
1. Close the high-risk port:
first, click "start" menu / settings / control panel / management tool, double-click to open "local security policy", Select "IP security policy on local computer", right-click in the blank position of the right pane, and the shortcut menu will pop up. Select "create IP security policy", and a wizard will pop up. Click the next button in the wizard to name the new security policy; Then press "next" to display the "secure communication request" screen, remove the hook on the left side of "activate default corresponding rules" on the screen, and click "finish" to create a new IP security policy
in the second step, right-click the IP security policy, remove the hook on the left side of "use add Wizard" in the "properties" dialog box, and then click the "add" button to add a new rule, then the "new rule properties" dialog box will pop up, and click the "add" button on the screen to pop up the IP filter list window; In the list, first remove the hook on the left of "use add Wizard", and then click the "add" button on the right to add a new filter
the third step is to enter the "filter properties" dialog box. The first thing you see is addressing. Select "any IP address" for the source address and "my IP address" for the destination address; Click the "Protocol" tab, select "TCP" in the "select protocol type" drop-down list, then enter "135" in the text box under "this port", and click "OK" (as shown in the left figure). In this way, a filter is added to shield the TCP 135 (RPC) port, which can prevent the outside world from connecting to your computer through port 135
click "OK" and return to the dialog box of filter list. You can see that a policy has been added. Repeat the above steps and continue to add TCP ports 137, 139, 445, 593 and UDP ports 135, 139, 445 to create corresponding filters for them
repeat the above steps to add the shielding strategy of TCP ports 1025, 2745, 3127, 6129 and 3389, establish the filter of the above ports, and finally click "OK"
Step 4: in the "new rule properties" dialog box, select "new IP filter list", then click the circle on the left to add a dot to indicate that it has been activated, and finally click the "filter action" tab. In the "filter action" tab, remove the hook on the left side of "use add Wizard", click "add" button to add "block" action (right figure): in the "security measures" tab of "new filter action properties", select "block", and then click "OK" button
Step 5: enter the "new rule properties" dialog box, and click "new filter action"
a dot will be added to the circle on the left side to indicate that it has been activated. Click "close" to close the dialog box; Finally, return to the new IP security policy properties dialog box, check the left side of the new IP filter list, and press OK to close the dialog box. In the local security policy window, right-click the newly added IP security policy and select assign
after restarting, the above network ports in the computer will be closed, and viruses and hackers can no longer connect to these ports, thus protecting your computer
2. Update the anti-virus software in time.
generally, broiler hunters use "grey pigeon" virus to control your computer. It is recommended to use grey pigeon killing software to kill the virus
3. Frequently check the system
frequently check the antivirus software, firewall directory, service, registry and other related items on your computer
hackers often use users' trust to hide or implant Trojans into these programs
be alert to DLLs with system properties that appear in these directories It may be used for DLL hijacking)
be alert to the pagefile.sys which appears at the root of the disk. It can also be used to hide files. To check whether the drive letter of the system's page file corresponds to them)
4. There is a huge risk of pirating Windows XP
if your operating system is installed by other technicians, or it may be pirated XP, such as * * version of the computer installation company, tomato Garden XP, rain forest XP, tornado XP, etc. Many of these systems are installed unattended. The installation procere is very simple. You put the CD into the computer, go out for tea, and then you may find that the system has been installed
What are the biggest defects of such a system? However, the administrator password of this system is empty, and automatically log in. That is to say, anyone can try to log into your system with an empty password. Distance is not an obstacle to the Internet at all
5. Use mobile storage devices carefully
before the development of Internet, the spread of virus depended on floppy disk, and then gave way to the network. Nowadays, the public more and more frequently use mobile storage devices (mobile hard disk, U disk, digital memory card) to transfer files. These mobile storage devices become an important channel for Trojan horse transmission. Computer users usually call this kind of virus [1] [2] [3] U disk virus or auto virus. It means that the action of inserting a USB flash disk can make the virus spread from one USB flash disk to another computer
6. Safe access to the Internet
one of the most important reasons for broilers is to browse unsafe websites. It is very difficult for ordinary users to distinguish which websites are safe and which ones are not. And there is also the possibility that the original normal website is invaded and implanted with Trojan horse, and there is also the risk of downloading Trojan horse when visiting any webpage after being attacked by ARP
there are always opportunities to download Trojans on the Internet, which can only rece the risk
the security of browser needs special attention. The vulnerability of browser and browser plug-in is the favorite of hackers. The vulnerability of flash player is plug-in vulnerability. This vulnerability is cross browser platform, and it may exist in any situation where flash player is used< If you find that IE often asks whether you are running some ActiveX controls, or generating inexplicable files, or asking about debugging scripts, you must be alert. You may have been caught. There are two typical cases of Internet intrusion:
one is that the browser's default home page or title is modified when browsing some web pages with malicious code, which is light; There is also the problem that you can format your hard disk or make your windows open continuously until you run out of resources and crash. This situation is much worse. The data you have not saved or put on your hard disk may be partially or completely lost
the second is the potential Trojan horse attack, or worm like virus attack, so that your machine can constantly send your privacy to the outside world, or use your name and email address to send garbage, further spread the virus; And then there is
broilers are generally sold by hackers at prices ranging from 0.08 yuan, 0.1 yuan to 30 yuan
to log in broiler, you must know three parameters: IP, user name and password of remote computer
when it comes to broilers, we should talk about remote control. Remote control software such as grey pigeon, Shangxing, etc
broiler is not a kind of food. It's a machine that can be remotely controlled by Trojan horse or by leaving a back door. Now many people call a machine with webshell permission a broiler
no one wants their computer to be controlled by others, but many people's computers are almost undefended, and they are easy to be completely controlled by remote attackers. Therefore, your computer becomes the meat on other people's chopping board, and people can eat it as they want, which leads to the name of broiler (machine)<
[edit this paragraph] how to detect whether you become a broiler
pay attention to the following basic situations:
1: QQ, MSN abnormal login reminder (the system prompts that the last login IP does not match)
2: when logging in Online games, it is found that the equipment is missing or does not match the last offline location, or even can not log in with the correct password
3: sometimes you suddenly find that your mouse doesn't work. When you don't move the mouse, the mouse will move, and you will click the relevant button to operate
4: when you surf the Internet normally, you suddenly feel very slow, and the hard disk light is flashing, just like you usually files
5: when you are ready to use the camera, the system prompts that the device is in use
6: when you are not using network resources, you find that the network card light is flashing. If you set it to display after connecting, you will also find the network card icon in the lower right corner of the screen flashing
7: out of line service
8: users with broadband connection receive abnormal packets when they are not connected after the hardware is turned on There may be a program background connection)
9: the firewall loses control of some ports
10: restart the computer ring the process of surfing the Internet
11: some programs, such as antivirus software firewall, will flash when they are unloaded (the unloading interface will flash by, and then the report is completed.)
12: after the program (QQ ` antivirus) that some users trust and often use is unloaded. The catalog file still exists and is automatically generated after deletion
13: the above phenomenon is basically subjective and not very accurate, but it needs your attention
14: you can also check whether there are suspicious ports by inputting netstat - an under CMD
next, we can use some software to observe the network activity to check whether the system is invaded
1. Pay attention to check the working status of firewall software
for example, Jinshan net dart. In the network status page, the currently active network connections will be displayed. Check the related connections carefully. If you find that you're not using software to connect to a remote computer, be careful
2. It is recommended to use tcpview to clearly view the current network activity
General Trojan connections can be viewed through this tool
here, the general Trojan connection is different from some carefully constructed rootkit Trojans, which adopts more advanced hiding technology and is not easy to be found
3. Use Jinshan cleaning experts to conct online diagnosis, especially pay attention to the process items of comprehensive diagnosis
cleaning experts will evaluate the safety of each item, and need to be very careful when encountering unknown items< How to prevent your computer from becoming a "broiler"
1. Close the high-risk port:
first, click "start" menu / settings / control panel / management tool, double-click to open "local security policy", Select "IP security policy on local computer", right-click in the blank position of the right pane, and the shortcut menu will pop up. Select "create IP security policy", and a wizard will pop up. Click the next button in the wizard to name the new security policy; Then press "next" to display the "secure communication request" screen, remove the hook on the left side of "activate default corresponding rules" on the screen, and click "finish" to create a new IP security policy
in the second step, right-click the IP security policy, remove the hook on the left side of "use add Wizard" in the "properties" dialog box, and then click the "add" button to add a new rule, then the "new rule properties" dialog box will pop up, and click the "add" button on the screen to pop up the IP filter list window; In the list, first remove the hook on the left of "use add Wizard", and then click the "add" button on the right to add a new filter
the third step is to enter the "filter properties" dialog box. The first thing you see is addressing. Select "any IP address" for the source address and "my IP address" for the destination address; Click the "Protocol" tab, select "TCP" in the "select protocol type" drop-down list, then enter "135" in the text box under "this port", and click "OK" (as shown in the left figure). In this way, a filter is added to shield the TCP 135 (RPC) port, which can prevent the outside world from connecting to your computer through port 135
click "OK" and return to the dialog box of filter list. You can see that a policy has been added. Repeat the above steps and continue to add TCP ports 137, 139, 445, 593 and UDP ports 135, 139, 445 to create corresponding filters for them
repeat the above steps to add the shielding strategy of TCP ports 1025, 2745, 3127, 6129 and 3389, establish the filter of the above ports, and finally click "OK"
Step 4: in the "new rule properties" dialog box, select "new IP filter list", then click the circle on the left to add a dot to indicate that it has been activated, and finally click the "filter action" tab. In the "filter action" tab, remove the hook on the left side of "use add Wizard", click "add" button to add "block" action (right figure): in the "security measures" tab of "new filter action properties", select "block", and then click "OK" button
Step 5: enter the "new rule properties" dialog box, and click "new filter action"
a dot will be added to the circle on the left side to indicate that it has been activated. Click "close" to close the dialog box; Finally, return to the new IP security policy properties dialog box, check the left side of the new IP filter list, and press OK to close the dialog box. In the local security policy window, right-click the newly added IP security policy and select assign
after restarting, the above network ports in the computer will be closed, and viruses and hackers can no longer connect to these ports, thus protecting your computer
2. Update the anti-virus software in time.
generally, broiler hunters use "grey pigeon" virus to control your computer. It is recommended to use grey pigeon killing software to kill the virus
3. Frequently check the system
frequently check the antivirus software, firewall directory, service, registry and other related items on your computer
hackers often use users' trust to hide or implant Trojans into these programs
be alert to DLLs with system properties that appear in these directories It may be used for DLL hijacking)
be alert to the pagefile.sys which appears at the root of the disk. It can also be used to hide files. To check whether the drive letter of the system's page file corresponds to them)
4. There is a huge risk of pirating Windows XP
if your operating system is installed by other technicians, or it may be pirated XP, such as * * version of the computer installation company, tomato Garden XP, rain forest XP, tornado XP, etc. Many of these systems are installed unattended. The installation procere is very simple. You put the CD into the computer, go out for tea, and then you may find that the system has been installed
What are the biggest defects of such a system? However, the administrator password of this system is empty, and automatically log in. That is to say, anyone can try to log into your system with an empty password. Distance is not an obstacle to the Internet at all
5. Use mobile storage devices carefully
before the development of Internet, the spread of virus depended on floppy disk, and then gave way to the network. Nowadays, the public more and more frequently use mobile storage devices (mobile hard disk, U disk, digital memory card) to transfer files. These mobile storage devices become an important channel for Trojan horse transmission. Computer users usually call this kind of virus [1] [2] [3] U disk virus or auto virus. It means that the action of inserting a USB flash disk can make the virus spread from one USB flash disk to another computer
6. Safe access to the Internet
one of the most important reasons for broilers is to browse unsafe websites. It is very difficult for ordinary users to distinguish which websites are safe and which ones are not. And there is also the possibility that the original normal website is invaded and implanted with Trojan horse, and there is also the risk of downloading Trojan horse when visiting any webpage after being attacked by ARP
there are always opportunities to download Trojans on the Internet, which can only rece the risk
the security of browser needs special attention. The vulnerability of browser and browser plug-in is the favorite of hackers. The vulnerability of flash player is plug-in vulnerability. This vulnerability is cross browser platform, and it may exist in any situation where flash player is used< If you find that IE often asks whether you are running some ActiveX controls, or generating inexplicable files, or asking about debugging scripts, you must be alert. You may have been caught. There are two typical cases of Internet intrusion:
one is that the browser's default home page or title is modified when browsing some web pages with malicious code, which is light; There is also the problem that you can format your hard disk or make your windows open continuously until you run out of resources and crash. This situation is much worse. The data you have not saved or put on your hard disk may be partially or completely lost
the second is the potential Trojan horse attack, or worm like virus attack, so that your machine can constantly send your privacy to the outside world, or use your name and email address to send garbage, further spread the virus; And then there is
6. Mining? Mining as you understand it should be a broiler. Mining is all done by high-end computers. When low-end computers run software, they will have super high calorific value. Just install anti-virus software. Domestic software will kill foreign mining machines
7. 1. About occupation: choose the school you want to play most, not the most popular one at present. Fairway is changing at any time. If you choose a sect that seems to be the most beautiful at present, it is likely that your whole fairway career will be spent in the process of witnessing the failure of the sect. There is no school, there are only players. Smart players will play any school in a wild way, and clumsy players will play any school in a mess. 2. On mental skill: when you upgrade, don't let your mental skill fall too far behind the character level. It's not about you alone, but about the interests of your teammates. In a sense, it is a kind of fraud to form a team with others. Don't think that others can't see your mental skill level, many of your skills will affect you. 3. On dignity: respect for others is won by good character, not by money or force. The only way to win by money is the flattery of the powerful villain, and the only way to win by force is the distress of countless people greeting your ancestors every day. 4. About addiction: the game world is like a drama. We are all actors. When you turn on the computer, you should be fully involved and play your role. But when you turn off the computer, you have to return to reality and be yourself. We are human beings. Don't let the game play you. 5. About Yuanbao: this game can be played without money, but it's hard to play well without money. Charging money is OK, but do according to your ability. There will always be oer in the game. At that time, you will lose all your money. So, before you charge money, please simulate the scene of the day when the game ends in your brain, which may calm you down. 6. About teacher worship: it's a lifetime happiness to find a responsible teacher. But do not expect to give you a lot, because you will not have much harvest as a disciple, so there is no obligation to pay a lot for you. It's normal to ask someone to help you with a task; It's reasonable to let you upgrade; It's too much to care about money and things; It's unreasonable to let them fight for you; It's shameful to be attached to power in the name of apprenticeship... 7. About apprenticeship: it's a lifetime pleasure to receive a good apprentice who is sensible. But if you want to accept an apprentice, you have to do your ty well, such as helping the apprentice to do tasks he can't accomplish, answering questions he doesn't understand... If you can't do these things, I advise you not to be someone else. 8. About brothers: friendship is exchanged with sincerity, which can't be contained in just two words. The brotherhood gathered by shouting in the world is like a house made of sand, which can't stand the test of wind and rain. 9. About marriage: do not rule out the game will sprout true love, but always remind yourself that this is just a game, all things may be false, so that you can withdraw at the end of the relationship. When you break up, JJYY or someone who swears can only make people laugh at you. 10. About luck: the game is like a comprehensive lucky draw. The result has nothing to do with character, only with luck. Many people's so-called "experience" is actually nonsense. Don't play games if you can't bear the blow of not winning a prize for a long time. It's as ridiculous to scold GM if you can't dig a good gem as it is to scold a doctor if you can't give birth to a son. 11. About life skills: learn life skills as early as possible, because proficiency and help are not what you can do with time. Don't start digging until you're equipped. When the price of equipment goes up, some people will curse life players, but have you ever thought that when you brush treasure to make money, they are mining in the field. When you fight monsters and upgrade, they are doing tasks to brush tribute. There is always a reward for paying. What they lose in the morning will be found in the evening. 12. About Gangs: you must be careful when you join a gang. A suitable guild is heaven for you, otherwise it is hell for you. If you are lucky to join a suitable guild when you are young, it is a lifetime happiness for you. The development of a gang depends on the efforts of everyone in the gang. If you join a gang, you have to contribute to it, just as you, as a family member, have to contribute to your family. Don't feel that the gang owes you a lot just because you've done a few tributes, clamor for officials and "elites", and don't stay out of the gang's affairs and be transparent in the gang just because you're a member of the gang. It's the happiest time to grow up with a guild. It takes a long time to experience the experience. If you can do this, you will find that being a tribute is actually a kind of enjoyment. 13. On prevention of fraud: there are three types of people who are cheated: one is careless, the other is greedy for small profits, and the last one is injured by system loopholes. However, the first two kinds of people live in large numbers, accounting for 99%. Always pay attention to all kinds of fraud prevention experience and system information, pay attention to the list of cheaters released by others on the channel at any time, and always remind yourself that "the sky will not drop pie" can minimize the probability of being cheated. It's a virtue to be able to announce the name of a liar in the world after being cheated. 14. About common sense: always paying attention to and playing games is the best way to gain experience. It's better to seek others than yourself. Regular study can help you avoid many detours. 15. On anti-theft: you should know that the anti-theft system of each game is not perfect, so you should do your best to take anti-theft measures. For example, to bind account security, to lock precious items, do not use the money stored in the warehouse, Yuanbao ready to use and flush. We can't stop the theft of system vulnerabilities, but we can't blame others for the losses caused by our own fluke. Learn to keep a low profile and don't show off your wealth. Being on the wealth list means being on the "chicken list" of thieves. If you don't have anything to do, you should take out valuable items. Those who get rich deserve to be stolen. 16. About wealth: accumulating wealth depends on diligence, wisdom, and judgment that can explore business opportunities. As long as you learn more, do more and think more, you will find many ways to make money; At the same time, we should learn to save money and spend it on the edge. If you are not a RMB player, you should be a model of making money. If you play the game well, you will be a good player. Finally, remember not to be a liar. Not only do you worry about your life, but also your ancestors will be affected by the money you spend. 17. About quality: Although the game is a virtual world, people with low quality will still be despised. Don't think it's very dignified and dignified to abuse on the loudspeaker. In fact, many people are secretly laughing at you, that is, losing money and shame. How stupid you are. When you meet someone who helps you, please say "thank you" and don't let your love be ignored. 18. About revenge: the spirit of chivalry is to uphold justice and punish evil. If you are bullied, you should take revenge by chance. If you are not strong enough, you can ask your friends for help or enhance your equipment within your ability. But remember to grasp the propriety, do not fall into too deep, if it can not be exceeded, please try to "laugh". After all, we play games to spend money happily. If we spend money to get angry, it's the opposite. 19. About the sense of responsibility: in case of fraud releasing false information (plug-in, swipe Yuanbao, Yuanbao platform, etc.), report it in time. What we can do in the fight against swindlers and robbers is limited to this. Don't hold the attitude of "it's none of your business, hang up high". If the swindlers and robbers can't be stopped effectively, you are likely to be the next victim. 20. On public morality: we should not do evil and good. Don't inlge your behavior just because the game is a virtual world. Bullying, self-interest, rudeness and vulgarity... The reason why a noble person is noble is that he can restrain himself with a noble code of conct both before and after others. We come here to escape the noise and troubles of the real world, so why not build it into a harmonious and happy paradise? I wish you a happy fairway!!
8. VBS virus is easy to write, but it is very effective to spread through the U disk. The VBS virus that many people encounter is generally movemenore g.vbs, instaler.vbs, helper.vbs, and you need to open the hidden system file settings to see in the U disk. When you hide, you don't know that you have been infected with the virus. This virus will generally use your computer as a broiler after it infects the computer, So many people can't find it at all, so we need to use special tools to kill the U disk regularly, so as to judge whether the computer is infected with some malicious Trojans
performance of infected USB flash disk:
the virus will create two hidden directories and a shortcut file under the root directory of the infected USB flash disk, and the names of the two hidden directories are "-" and "windows services" respectively. All the files in the original U disk are stored in the directory named "-" and three virus files are stored in the directory named "windows services". The file names are movemenore g.vbs, installer.vbs and helper.vbs
infection path:
after the U disk is infected, insert it into the new computer. Just click the shortcut in the U disk to imitate your normal files, and the infection will be triggered to the new computer. Generally, the virus will be copied to the computer% appdata% & # 92; Windows services directory, and then add boot, if there is a new U disk inserted on the trouble to infect the new U disk< First, display and hide system files, open any folder, click Tools - Folder Options - and then select view, uncheck
Hide protected operating system files, hide files and folder, select Show hidden files
2. Find the location of the three files, open them in the USB flash drive, and delete them directly. The files in the computer system are in C: &# 92; Users\ Administrator\ AppData\ Roaming\ Windows services folder, but not every computer is this folder C:\ Users\**** Use your own name here; AppData\ Roaming\ WindowsServices\ The folder is displayed in Chinese, so if you can't find a small partner, just the path and change it to your user name. 3. Pay attention to the U disk to pull out the computer first, and then delete these virus files in the computer. There are three files in Windows services, movemenore g.vbs, installer.vbs, helper.vbs, to delete< Second, software cleaning
USB killer tool in U-disk antivirus software can directly scan all VBS viruses in the computer and U-disk to remove all VBS viruses, which is more convenient than manual operation. Manual operation is suitable for use when there is no network
you can see the result of VBS virus list and virus clear when you click start scanning and wait for the scanning to complete.
performance of infected USB flash disk:
the virus will create two hidden directories and a shortcut file under the root directory of the infected USB flash disk, and the names of the two hidden directories are "-" and "windows services" respectively. All the files in the original U disk are stored in the directory named "-" and three virus files are stored in the directory named "windows services". The file names are movemenore g.vbs, installer.vbs and helper.vbs
infection path:
after the U disk is infected, insert it into the new computer. Just click the shortcut in the U disk to imitate your normal files, and the infection will be triggered to the new computer. Generally, the virus will be copied to the computer% appdata% & # 92; Windows services directory, and then add boot, if there is a new U disk inserted on the trouble to infect the new U disk< First, display and hide system files, open any folder, click Tools - Folder Options - and then select view, uncheck
Hide protected operating system files, hide files and folder, select Show hidden files
2. Find the location of the three files, open them in the USB flash drive, and delete them directly. The files in the computer system are in C: &# 92; Users\ Administrator\ AppData\ Roaming\ Windows services folder, but not every computer is this folder C:\ Users\**** Use your own name here; AppData\ Roaming\ WindowsServices\ The folder is displayed in Chinese, so if you can't find a small partner, just the path and change it to your user name. 3. Pay attention to the U disk to pull out the computer first, and then delete these virus files in the computer. There are three files in Windows services, movemenore g.vbs, installer.vbs, helper.vbs, to delete< Second, software cleaning
USB killer tool in U-disk antivirus software can directly scan all VBS viruses in the computer and U-disk to remove all VBS viruses, which is more convenient than manual operation. Manual operation is suitable for use when there is no network
you can see the result of VBS virus list and virus clear when you click start scanning and wait for the scanning to complete.
9.
Is a download will be automatically implanted in the computer malicious mining Trojan horse and modify the user DNS configuration, forced to insert advertising Trojan horse tool. Downloading is not recommended
start the script to execute the request URL regularly. The Trojan writer only needs to set the URL to be downloadable, and the user will be attracted
10. What key did you press? If your computer can't be turned on, look at the following, because it can't be turned on, you press this button, which has nothing to do with your computer's failure to turn on (the failure to turn on caused by the card crash is not caused by the setting problem, so it's useless to enter the BIOS)
can't turn on the machine or can't get in when it's turned on, is it related to the improper operation before you turn it off? For example: playing games, watching videos, operating big things, using the computer for a long time caused by the card, right? Or download the inappropriate things, or delete the system files, or power off, the fault will not happen for no reason, right
press the power button to turn on and off the machine repeatedly, and try to put it on for a period of time. If you really can't, you can't just re install the system. If you can't, you can spend 30 yuan to go to the maintenance office and find a maintenance person to help you
as long as your computer doesn't get stuck, has a blue screen, and is shut down suddenly, it won't turn on like this
please ask me if you have any questions.
can't turn on the machine or can't get in when it's turned on, is it related to the improper operation before you turn it off? For example: playing games, watching videos, operating big things, using the computer for a long time caused by the card, right? Or download the inappropriate things, or delete the system files, or power off, the fault will not happen for no reason, right
press the power button to turn on and off the machine repeatedly, and try to put it on for a period of time. If you really can't, you can't just re install the system. If you can't, you can spend 30 yuan to go to the maintenance office and find a maintenance person to help you
as long as your computer doesn't get stuck, has a blue screen, and is shut down suddenly, it won't turn on like this
please ask me if you have any questions.
Hot content