UNDERCODE COMMUNITY

🦑 Virus types

100 views19:31

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FIX YOUR PC INFECTED

1. Scanning method of anti-virus software

This is probably the first choice for most of our friends, and I am afraid that it is the only choice. Nowadays, there are more and more types of viruses, and the methods of concealment are becoming more and more clever. Virus software developers pose challenges.

2. Observation method

This method can only be accurately observed when you understand the symptoms of some virus outbreaks and where you usually live. When the hard disk is booting, it often crashes, the system boot time is long, the running speed is very slow, the hard disk cannot be accessed, and special sounds or prompts appear. When the above failures occur in the first point, we must first consider that It ’s strange, but you ca n’t go all the way through. I did n’t talk about software and hardware failures, and those symptoms may also appear! We can observe from the following aspects for those caused by viruses:

a, memory observation

This method is generally used for viruses found under DOS. We can use the "mem / c / p" command under DOS to check the memory usage of each program, and find the memory occupied by viruses (generally not occupied separately, but attached Among other programs), the memory occupied by some viruses is also relatively hidden. You cannot find it with "mem / c / p", but you can see that there is less than 1k or a few K in the total basic memory of 640K.

b. Registry observation method

This kind of method is generally applicable to the so-called hacker programs that have recently appeared, such as Trojan horse programs. These viruses are generally modified or activated in the registry to achieve automatic startup or loading. Generally, they are implemented in the following places:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion

Wait, for details, please refer to my other article-"Troubleshooting Trojans", where there will be a more detailed analysis of the possible registration areas.

c. System configuration file observation method

This type of method is also generally suitable for hacker programs. Such viruses are generally hidden in system.ini, wini.ini (Win9x / WinME) and the startup group. There is a "shell =" item in the system.ini file In the wini.ini file, there are "load =" and "run =" items. These viruses generally load their own programs in these items. Note that sometimes some original programs are modified. We can run the msconfig.exe program in Win9x / WinME to check one by one. For details, please refer to my article "Troubleshooting Trojan Horses".

d. Character string observation method

This method is mainly aimed at some special viruses. When these viruses invade, they will write corresponding feature codes. For example, CIH virus will write a string like "CIH" in the invaded file. Of course, we cannot easily find , We can use the hexadecimal code editor to edit the main system files (such as Explorer.exe). Of course, it is better to back up before editing, after all, it is the main system file.

e. Hard disk space observation method

Some viruses will not damage your system files, but only generate a hidden file. This file generally has little content, but it takes up a lot of hard disk space. Sometimes it is too large to allow your hard disk to run general programs, but you I ca n’t see it. At this time, we have to open the resource manager, and then set the properties of the content we view to a file that can view all the properties ...

written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

123 views19:31