System vulnerability attack

From June 5438 to February 2000, a female ghost virus was widely circulated on the Internet. After the outbreak in Taiwan Province Province and Hongkong, the virus has quietly landed in China. At present, the report from Shanghai Chuangyuan Technology Department shows that the virus has appeared all over the country, and the number of epidemic situations in some areas has increased significantly. It is reported that when the virus broke out in Taiwan Province Province, some people died after being sent to hospital for treatment due to shock, and two others were seriously delirious and delirious due to shock, and returned to normal after rehabilitation. Some users in Shanghai also reported the outbreak of the virus.

The "female ghost" virus is also known as the "terror female ghost" virus, and its international standard is named joke-ghost. In Taiwan Province Province, because its icon is the logo of McDonald's, it also has an alias of "McDonald's". In fact, strictly speaking, "female ghost" is not a virus, but a prank program, which belongs to the category of prank (fake news) or joke program, and does not have the characteristics of virus "self-replication, self-propagation and destruction of computer software and hardware". However, judging from its harm degree and social impact, anti-virus software companies still regard it as a virus to prevent its further spread, so as to prevent adverse social impact.

There are many practical programs similar to female ghosts, among which "earthquake" and "delete system" are widely circulated on the Internet. Generally, such programs will not actually destroy the computer, copy and spread themselves, and will not change the system registry to achieve the purpose of long-term residence. It is usually spread in the form of an email attachment, and the sender is usually a good friend of the recipient. The reason why the female ghost virus has attracted the attention of all parties is not because of its influence on computers, but because it has a great intimidating and frightening effect on people who use computers. When the source file of female ghost virus is executed, only a rough horror story about a gourmet killing his wife will be displayed on the screen. After reading it, the user can close the program and continue to do other things. However, five minutes after the first execution, a scary full-screen female ghost image and scary sound effects will suddenly appear on the screen, which will often make the unsuspecting users stunned, and in severe cases, they will be delirious. Therefore, some medical experts pointed out that it is very dangerous for this kind of prank virus to suddenly appear on the screen. If the user who opens the program suffers from heart disease or epilepsy, it may get sick immediately, and if no one takes care of it, it will easily lead to death. Relevant persons further pointed out that there have been cases of sudden death due to external shocks in the past, so computer users are strongly advised not to use similar prank programs to play tricks on others. According to foreign reports, female college students in Taiwan Province Province were frightened and eventually died because they turned on the program in the middle of the night.

Look at this female ghost virus, which is more destructive than some other prank programs. One of the most important reasons is that programmers know human psychological habits very well. The lame horror story told by the female ghost virus at first only played a foreshadowing role, and users will not forget it in a short time whether they believe it or not after reading it. Programmers make full use of psychological hints and set the image of female ghost to attack 5 minutes after the ghost story is finished. The sudden appearance of female ghost image, accompanied by horrible screams, can really play a frightening role when I am close to forgetting but still have some memories, relaxed and unprepared. Recently, more and more phenomena show that the writers of some new viruses circulating on the Internet have begun to make use of people's psychological characteristics to create a destructive trend. For example, the early popular "love bug" virus was named "love letter" by the author, which somewhat utilized the color of human psychological characteristics. Imagine that although a user has been warned by anti-virus experts not to open emails of unknown origin, most people will be driven to open emails by strong curiosity in the face of "love letters" sent to you by others. Moreover, the spread of this prank program has its own characteristics compared with the way of virus spread, that is, computer users have joined the spread link. Because this kind of program usually does not have the function of virus self-replication and spread, the spread of this kind of program is artificial. Unlike viruses that automatically spread to other users without users' knowledge, some users often deliberately spread viruses to other users. Some users are often driven by a certain mentality to "recommend" others or simply send them directly to other users. This is the difference between such programs and real viruses in the way of transmission.

However, we should not ignore that although this joke program has not caused damage to the computer, some people with ulterior motives will still regard it as a continuation of a new virus. If the female ghost virus is combined with the functions of self-replication and self-transmission, it can achieve greater destructive power and appeal than it is now. The application of some new technologies will also promote the spread of the virus. For example, the female ghost virus is written in VBS or JAVA programs. If the female ghost virus infects the operating system, it will modify the system configuration and files, which will enhance the concealment and actual damage, and the damage result is unimaginable.

So how do you detect whether you are infected with female ghost virus? A simple way is to find out whether there is a file named MC.EXE or McDonald's icon on the hard disk, or press CTRL-ALT-DEL at the same time under the Windows operating system to see if there is a process named MC in the process. The deletion method is also very simple, which can be avoided by deleting files stored on the hard disk or clicking "End Process" in the process. But this method is only effective if the user is infected with the original female ghost file. Any user who knows a little about computer use can use some software to change or modify the icon of the file to other names, which brings certain difficulties to the users of female ghost virus. Therefore, you can use the latest anti-virus software "Safety Star 1+E" of Shanghai Chuangyuan Computer Information Security Co., Ltd. for prevention and treatment, or call Shanghai Chuangyuan's hotline technical support number 800-810-16 to seek the help of professional technical engineers.

The prevention and treatment methods of this kind of virus are the same as the common anti-virus methods. In the process of using the computer, remember: don't open the mail of unknown origin, even the mail of familiar friends, it is best to open it after you find out; Try to avoid using OUTLOOK series, a mail program that comes with Microsoft operating system. Because Microsoft has added a lot of support for new technologies to the program. On the one hand, these new technologies can bring users convenient operation and more personalized configuration, but these advanced functions are very dangerous for ordinary users, such as automatic preview and automatic signature. Many email viruses are written for these functions of Outlook. In other words, these viruses only occur when users use Outlook series software to receive emails, such as Kak virus and Mesa virus. Users are advised to use some non-Microsoft mail systems to receive emails, such as Foxmail, which is very famous in China. Because this kind of email program does not support Java Script and VB Script languages, it is less likely to be infected with these viruses. It is recommended that users often use anti-virus software to check the virus in the system and monitor it in real time. Even users who have the habit of using anti-virus software need to pay attention to keep the software updated frequently to kill more updated viruses. In addition, don't use pirated anti-virus software. Some software destroys the function of the original program or carries viruses. Computer users also need to care about the news released by mainstream media and online media, get the latest virus situation and characteristics, and strengthen their self-protection ability. Don't panic when you encounter a virus, keep a cool head, turn it off immediately, and minimize the loss, then use professional antivirus software or seek technical support and solutions from professional software manufacturers.

Female ghost virus back door. Girlhood 2

Note: Press f8 to enter safe mode to clear.

Manual removal method:

First, the search file name is "(key value not set)." , "? 9? 0. ","mm2.jpg "file. And delete them. [Start]-[Search]-".

Secondly, use the registry editor REGEDIT to restore the key values:

The default value of HKEY _ class _ rootpegfileshellopcommand is "c: progra ~1inter ~1iexplore"-no home.

Restore the following key values in the startup item: change the default value of HKEY _ local _ MachinesoftwareCrosoftWindowsCurentVersionRun to (no key value is set) (corresponding to the generated file (no key value is set). . ) is changed to "HKEY _ Local _ Machine Software Microsoft TwindowCurrentVersionRunServices". The default value is changed to ""with a space in the middle (corresponding to the generated file (? 9? 0.) space. ) changed to ""in the middle. There is no room.