Recently, many people dove gray, and I say this guy is.
as many friends reaction to gray pigeons do nothing, thought,
minesota twins jerseys, or write about their own way in killing the little gray dove right experience
After
in the Trojan, other can be on your computer as follows:
【1】 on the remote computer file management: Die Fang Windows Explorer, the file can copy, paste, delete, rename, remote run and so on, you can upload and download files or folders, easy to use.
【2】 Remote Control Command: view remote system information, view clipboard, process management,
cheap barcelona jersey, window management, plug-in functionality, service management, shared management, agency services, MS-Dos simulation!
【3】 capture screen: not only with the remote computer screen, following the capture,
barcelona jerseys, but also the local mouse and keyboard to a remote mass action to achieve real-time control!
【4】 video surveillance, to monitor the remote control head! , As well as listening and sending voice!
【5】 telnet (HyperTerminal).
【6】 listen and send voice! can voice dialogue process and the remote host ~ ~
【7】 plug features: Users can add their own needs and the use of plug-ins (such as stealth server plug-ins, use server-side hidden processes, services, documents, etc..)
【8】 registry Simulator: Remote Registry operation as easy as operating the local registry ~ ~
【9】 command radio: You can automatically broadcast on-line order hosts, such as shutdown, reboot, open web pages, screen eligible machines, point N of a button you can let off the machine, or other operations at the same time!
【10】 start the server service to support a variety of key combinations to send, you can easily manage remote servers!
【11】 remote server automatic update feature: remote server can be automatically upgraded to the latest version, without the user manual upgrade, completely eliminates the tedious work of re-security updates! 【12】
automatic on-line a variety of ways: special on-line, DNS name resolution, fixed IP, etc., the user freedom of choice!
view of the above,
mlb jerseys, so in time to kill it after the emergency
the gray pigeons and the N number of friends of the rehabilitation program, participate in a variety of non-poor, anti-virus software may not be able to kill the time urgency
manually kill it, or sometimes necessary, we can borrow: Hijackthis
\repair most of the contents of a maliciously modified
with HijackThis1991zww can scan to O23, can scan items to gray pigeons services
common are as follows:
O23 - Service: Gray_Pigeon_Server - Unknown - C: \ WINDOWS \ G_Server.exe
O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C: \ WINDOWS \ G_Server.exe
O23 - Service: Gray_Pigeon_LanServer - Unknown - C: \ WINDOWS \ LanServer.exe
O23 - NT Services: IEXPLORE_Server (IEXPLORE Server) - Unknown owner - C: \ WINDOWS \ IEXPLORE_Server.exe
O23 - Service: SYSTEM $ (SYSTEM $ Server) - Unknown owner - C: \ WINDOWS \ setemy.bat
O23 - Service: Network Connections Manager (NetConMan) - Unknown owner - C: \ WINDOWS \ uinstall.exe
O23 - Service: winServer - Unknown owner - C: \ WINDOWS \ winserver.exe
scanning to its service entry can be easily handled, that is, we must remember that, like ~ ~ ~
X.exe run will copy itself to the Windows directory, and then released from the body and X_Hook.dll X.dll to the windows directory. X.exe, X.dll X_Hook.dll three documents complement each other and formed a gray pigeon service side, there will be more gray dove release a file named XKey.dll used to record the keyboard. Note, X.exe this name is not fixed, it can be customized, such as when the file name A.exe custom server, the resulting file is A.exe,
kobe bryant jerseys, A.dll and A_Hook.dll
common are as follows:
C: \ windows \ IEXPLORE_Serverkey.dll
C: \ windows \ IEXPLORE_Server.dll
C: \ windows \ IEXPLORE_Server.exe
C: \ windows \ IEXPLORE_Server_hook.dll
C: \ WINDOWS \ G_Server.exe
C: \ WINDOWS \ G_Server.dll
C: \ WINDOWS \ G_Serverkey.dll
C: \ WINDOWS \ G_Server_hook.dll
So whether you are in a gray pigeons, or whether it is a variant of
as long as the first scan with Hijackthis, fix it (not sure, or do not understand, it can come to the forums above)
then KILLBOX fill path, it deleted all other files
to simply introduce the following KILLBOX
KillBox to delete any file is actually a weapon, whether it is the EXE or DLL file and other documents, and regardless of the file is being run, or by the system call, KillBox simple steps will file can be deleted (my personal signature which can be downloaded)
below to:
O23 - Service: Gray_Pigeon_Server - Unknown - C: \ WINDOWS \ G_Server.exe
, for example, the steps for a simple description:
one: first use Hijackthis to fix the O23 item (fix it in the service)
two: Open the following registry in safe mode, search: G_Server, find related stuff, and delete (in the registry to clean it up)
three: Remove virus file
fill the path with killbox and delete: (The following files are not there, not even a)
C: \ WINDOWS \ G_Server.exe
C: \ WINDOWS \ G_Server.dll
C: \ WINDOWS \ G_Serverkey.dll
C: \ WINDOWS \ G_Server_hook.dll
this point, the virus has been completely cleared
we can apply this model Delete the following files:
copied directly to the file path to delete in Killbox (service name is mentioned, 4th Floor, X, because it is uncertain, so the X instead)
C: \ windows \ service name. dll
C: \ windows \ service name. exe
C: \ windows \ service name. bat
C: \ windows \ service name key.dll
C: \ windows \ service name _hook.dll
C: \ windows \ service name _hook2.dll
If prompted the file is not found, all right,
cheap nba jerseys, because it may itself does not exist
deleted if found to be a