Behavioral analysis of the W32 Lirva CMM

You might as well write the analysis and research of the Trojan virus, win32 only represents the platform of the virus attack, win32 refers to the 32-bit windows system, which means that the virus can attack under 32-bit windows.

This win32 doesn't say what kind of virus it is.

Some viruses under the win32 platform can be easily checked and killed with antivirus software, and some are not (even formatting the hard disk, reinstalling the system is not good), you must figure out what virus it is, if you find it difficult to figure it out, it is recommended that you upgrade the antivirus software to the latest version and try it as follows.

Look it up in the system virus database, there should be one in 360.

It's not about scolding.

You don't understand what win32 means.

Win32 is.

Under win32 operating system.

The virus is just a general term.

The back is generally.

and so on.

It's quite an IP address.

The first place is only.

You right-click to open the hand-rolled disk, and the display pin shows all the remaining pieces of the text. Open it and make a note of what is written in it. exe. Exit to delete it and what it wrote. exe file. Each disc should be cleared like this.

If you're using Norton's antivirus, the easiest way to do this is to restart your computer, put F8 into safe mode, and run Norton to do a "full-disk" antivirus. Or delete the following files in safe mode:

1. The extension in the fonts folder in the windows directory is .com.

2. Delete: 3. Find the files in the partition where the system is located and delete them all.

4. Close the partition where the system is located, such as the sharing of the C drive.

5. Delete the "admin" account in Start-Settings-Control Panel-User Account.

6. Clean up the registry:

The hkey local machine software Microsoft Windows CurrentVersion Run has.

tempcom"=c: windows fonts [random name].com"

Delete the data above.

Note: The data above 6 is based on the assumption that the system disk is C disk and the operating system is XP

If the system disk is C and the operating system is 2000, the data is as follows:

tempcom"=c: winnt fonts [random name].com"

As long as it can be detected, it can be killed, and the so-called can't be killed because the virus is running; Running programs cannot be modified or deleted.

Start anew, press and hold F8, enter safe mode, and you can easily kill viruses with antivirus software.

The virus was discovered in the middle of this year and has the following characteristics:

Create a directory: %windir% inet10050, copy yourself here and change the name to:

WinIr% refers to: Windows 98 XP or WinNT directory 2000.

Created in the following registry:

hkey_current_user\software\microsoft\windows nt\currentversion\run

xp_system" =windir%\inet10050\"

browser helper objects\

Add :

load = windir%\inet10050\

And send spam emails with viruses.

After F8 enters safe mode, delete the file: Windows Inet10050

Use the registry cleaner tool to put the following locations with:"xp_system" =windir%\inet10050\"can be deleted.

Hello: C++ is mainly an introduction to classes (i.e., things in object-oriented thinking) compared to C, and it is actually a bit difficult to connect classes with inverse thinking. In other words, C is as procedural oriented as assembly, and it is difficult to understand object-oriented C++ with procedural-oriented assembly.

For example, when you see a function, you can immediately think of what the corresponding assembly is, but when you see C++, this function may be included in a class as a member function, and it may be a bit cumbersome to convert it into an assembly.

Therefore, it is recommended that the landlord learn C is a must, C++ is optional, even if you use C++ for development, in fact, you will rarely use object-oriented thinking, unless it is MFC or the like.

For other questions, please consult the computer butler business platform!

C, of course, is the basis for some high-level programming languages. The program of simultaneous assembly combined with C is highly efficient.

The only difference between C and C++ is that C is process-oriented and C++ is object-oriented. C++ adds a chapter of classes (object-oriented) to C. There's no need to dwell on it at all.

Straight to C. Reverse technology and win32 technology have nothing to do with C++.

Assembly and C of course, then C++

C is the most important programming language.

You should first find which is the virus plug-in program in the process of the task manager, as long as the program has been in the process, you can't kill the virus, after finding the file name, enter the safe mode and then kill the virus, if the virus program is not a system file it is better to delete it.

Try it with a driver! Kill it again in safe mode! Norton Accounts for System Pull!