virus name: Worm/Downloader.fn

Chinese name: "desktop ghost" variant fn

virus length: 24873 bytes

virus type: worm

risk level: ★★

impact platform: win9x/me/nt/2111/XP/. After running, the "desktop ghost" variant fn copied itself to the "%SystemRoot%\\system32\\" directory of the infected computer system and renamed it "c1n1me.exe". Modify the registry to realize the automatic running of the worm. Start the "iexplore.exe" program, inject virus code into it and call Run to hide yourself and prevent being killed. Destroy the registry key, so that users can't enter safe mode. Create "autorun.inf" file and Trojan horse main program "MSDOS.pif" file in the root directory of all drive letters, so as to double-click the drive letter to start the fn virus program of "desktop ghost" variant. Modify the registry, image hijacking, resulting in a large number of security software can not run. Secretly monitor the title of the window opened by the user in the background, and once the QQ chat window is found, it will be sent to friends as a file to realize the spread of instant messaging tools. Finding and forcibly closing a large number of security software greatly reduces the security of infected computers. In addition, the "desktop ghost" variant fn will also connect to the hacker's designated site in the background, download malicious programs and automatically call and run them on the infected computer. Among them, the downloaded malicious programs may be online game Trojans, advertising programs (rogue software), backdoors, etc., which bring different degrees of losses to infected computer users.

virus name: TrojanSpy.Banker.krx

Chinese name: "online banking thief" variant krx

virus type: spy trojan

virus length: 1911544 bytes

danger level: ★★

impact platform: win9x/me/nt/2111. 2113

TrojanSpy.Banker.krx, a variant of "online banking thief", is one of the newest members of the "online banking thief" Trojan family. It is written in Delphi language and has been shelled. After running, krx, a variant of "online banking thief", copied itself to the folder designated by the infected computer system. Modify the registry to realize the automatic operation of Trojan horse. Monitor the user's keyboard and mouse operation in the background of the infected computer, steal the information such as account number, password and website address entered by the user, and send the stolen confidential information to the server designated by the hacker. Search for a valid email address from the infected computer, and use the infected computer to send poisonous emails. Connecting the hacker's designated site in the background of the infected computer, downloading malicious programs and automatically calling them to run greatly reduces the security on the infected computer.

In view of the above viruses, Jiangmin Anti-virus Center advises computer users:

1. Please immediately upgrade Jiangmin's anti-virus software, start a new generation of intelligent hierarchical high-speed anti-virus engine and all kinds of monitoring, so as to prevent the prevailing viruses, Trojans, harmful programs or codes from attacking users' computers.

2. Users of Jiangmin KV online edition should upgrade the control center in time, and suggest relevant managers to check and kill viruses on the whole network at an appropriate time to ensure the information security of enterprises.

3. Turn on the BOOTSCAN function in an all-round way, kill virus before the system starts, and remove malignant viruses with self-protection and anti-virus software.

4. Jiangmin antivirus software adopts window protection and process protection technology to prevent viruses from shutting down the antivirus software process, ensure the security of the antivirus software itself, and better protect the security of users' computers.

5. "Webpage security experts" can detect whether malicious webpages are infected on users' computers. If malicious webpages are detected, users can automatically report them to the National Computer Virus Emergency Center for processing according to the prompts. Web security experts download address:/avtools/avtools _ webexpert.htm

6. Jiangmin antivirus software "Mobile Storage Access Antivirus" can prevent viruses from invading users' computers by using mobile devices (such as USB flash drives and mobile hard disks) and completely protect the security of computer systems.

7. "Jiangmin Secret Protection" can effectively protect account passwords such as online banking, payment platform, online securities trading and online games, and fully protect users' private information.

8. Users who are suspected to have been poisoned can use Jiangmin to check the virus online for free. Free online drug search address:/chadu.asp.