China DOS Union

To tackle the Logo_1 (Viking) virus here, I spent a lot of effort writing a batch script. Due to limited capabilities, there are still many unclear points. Please give me your advice!!

@echo off

net share c$ /del
net share d$ /del
net share e$ /del
net share f$ /del
net share admin$ /del
net share ipc$ /del

wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate
wmic process where name="0Sy.exe" call terminate
wmic process where name="1Sy.exe" call terminate
wmic process where name="2Sy.exe" call terminate
wmic process where name="3Sy.exe" call terminate
taskkill /fi "imagename eq 4Sy.exe"
taskkill /fi "imagename eq 5Sy.exe"
taskkill /fi "imagename eq 6Sy.exe"
taskkill /fi "imagename eq 7Sy.exe"
taskkill /fi "imagename eq 8Sy.exe"
taskkill /fi "imagename eq 9Sy.exe"
wmic process where name="VM_STI.ESE" call terminate
wmic process where name="svchsOt.exe" call terminate
wmic process where name="svchs0t.exe" call terminate
wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate

del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\0Sy.exe
del c:\windows\1Sy.exe
del c:\windows\2Sy.exe
del c:\windows\3Sy.exe
del c:\windows\4Sy.exe
del c:\windows\5Sy.exe
del c:\windows\6Sy.exe
del c:\windows\7Sy.exe
del c:\windows\8Sy.exe
del c:\windows\9Sy.exe
del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\svchsO.exe
del c:\windows\svchs0.exe

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v load
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Soft\DownloadWWW /v auto
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down0
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down1
pause
taskkill /fi "imagename eq cmd.exe"
taskkill /fi "imagename eq cmd.exe"




Just now, the test showed that it ran normally at startup, but the problem immediately appeared. This virus spreads through the local network. Even if it's okay at startup, it will be affected by other machines in the network after a while.
What should I do? I can't run it every ten minutes!

Last time, I cleared each machine in the network one by one (nearly eighty units, it was tiring~~~), and it was okay for a while
Less than a day later, it came back again!!

What should I do? Everyone, help me out ah!!!

[ Last edited by chineselgs on 2006-6-10 at 13:47 ]

Hey, actually your batch processing mainly uses three sentences. My suggestion is to buy a legitimate antivirus software, don't always try to find one on the Internet to make do with. For antivirus software on the Internet, it's not easy for you to find the latest updatable antivirus in China, and some foreign ones have incomplete virus databases at all. I think the virus you encountered, the antivirus software should be able to control it even if it can't kill it.

Originally posted by bagpipe at 2006-6-10 08:54:
My suggestion is to buy a genuine antivirus software. Don't always try to find one on the Internet to make do. For antivirus software on the Internet, those in China you are...

One of my friends used the genuine Rising, but it couldn't kill those hateful trojans. Later, he had to find some trojan removal tools on the Internet to solve the problem. Sometimes he even had to manually remove them to completely get rid of the trojans. Even the genuine antivirus software was of no avail. Why spend so much money on it?!

Originally posted by bagpipe at 2006-6-10 08:54 AM:
Alas, in fact, your batch processing mainly uses three sentences. My suggestion is to buy a genuine anti-virus software, don't always want to find one on the Internet to make do with. For anti-virus software on the Internet, the domestic ones you are...

Woohoo~~
I have used genuine Rising, Kingsoft, and also cracked and updated Kaspersky, all with the latest virus databases!!!!

But none of them can solve the problem! Facing the boss's gloomy face, I really want to quit my job!!!

I know I'm very stupid, I don't know anything about DOS, so I came here to ask you all. Unexpectedly, after two days, no one has paid attention to me~

Facing this virus, the anti-virus software can kill it, but it often comes back after killing it

I haven't slept well these days, so worried!!!

Actually, I suggested that he buy a legitimate antivirus software just for prevention against damage and viruses. If you deliberately go to some improper websites and download some unknown software, I think no matter what Trojan horse removal and antivirus software you install, it won't help. This is about how you view such things. There's no absolute thing about which virus to kill and which software to use. The security of the machine and the network depends on your own maintenance. It's unwise to completely rely on those software... Just looking at the楼主's these few lines:
del c:\windows\poco_.exe
del c:\windows\bitcomet.exe
del c:\windows\Vagaa.exe
del c:\windows\KuGoo.exe
It can be seen that the楼主 has quite a lot of BT - type download software on his machine.

Originally posted by bagpipe at 2006-6-10 12:33 PM:
Actually, I suggested that he buy a genuine antivirus software only for the prevention of some damage and viruses. If you just go to some inappropriate websites and download some unknown software, I think no matter what kind of Trojan查杀 and antivirus software you install...

Those are the things I used to shut down those stupid birds. These things consume a lot of resources, and I can't always follow behind them to see what they are doing. Alas, I have no way!
Dude, what you said is also true. The machines here are all equipped with restoration, but this virus is too awesome. It spreads through QQ, enters the system, first kills the antivirus software, then kills the restoration software. It creates several ESE files and starts downloading Trojans. The machine gets stuck to death and will definitely be ruined soon. I have checked and tried many methods online, including those solutions provided by Kingsoft and Rising's official websites, but none worked. The machines here originally all had Kingsoft Antivirus Enterprise Edition installed, and they were updated once a week. Since being infected, more than half of the antivirus software has been destroyed (cold~~), and more than a dozen systems have been ruined (the restoration software was destroyed, so the system naturally went OVER). I'm in tears!!

Please provide the Chinese text that needs to be translated.

Virus Name: Worm.Viking.m
Chinese Name:
Viking (also known as Weijin)
Threat Level: ★★★(Yellow)
Virus Type: Worm
Affected Systems:
Win 9x/ME,Win 2000/NT,Win XP,Win 2003
"Five Crimes of the 'Viking' Virus
First Crime: Infecting System Files
Causing system damage and being difficult to manually remove;
Second Crime: Downloading Malignant Trojans
Stealing accounts for games like Warcraft and Legend, using Gray Bird to open backdoors to completely control the system, and viruses like QQRobber;
Third Crime: Multi - way Network Spreading Methods
Spreading through infected files and LAN sharing;
Fourth Crime: Forcibly Disabling Well - known Domestic Anti - virus Software
Reducing security and easily infecting other viruses;
Fifth Crime: Multiple Variants
Within a few days, multiple variants have appeared."

I heard that there are a few internet cafes in my area that got paralyzed because of it, and they're now closed for rectification~~~

Hehe, it seems I'm not the only one in a hurry~~

Hehe! For preventing virus infections within the local area network, the most important point is to strengthen internal management! No antivirus software is absolutely safe!

Suggestions:
1. First, the owner cuts off the external network connection on the router or the internet server! Then restore or thoroughly disinfect each computer one by one before connecting to the external network!
2. Explain to each computer user not to visit bad websites, otherwise they will bear the consequences! Publish the computer usage management system! Popularize network security knowledge!
3. Block and filter some bad website addresses in the router settings, and close all ports of some chat tools!
4. Not all computers in the whole company need to access the external network. Some computers that do not need to access the external network can be set in the router to only work on the internal network, or set the time for accessing the external network!
5. Use some network behavior management software such as "Network Law Enforcer" "Network Sentinel" to restrict employees' internet behavior!
6. Refuse all P2P download software from running in the company network! It can be done from technical or management aspects!
7. If funds allow, it is best to buy a hardware firewall!
8. Segment the internal network! This way, it won't cause the entire network to be infected at the same time!

Don't say I'm a foreign admirer. I have a legitimate domestic antivirus software but I don't use it. Installing it is like a decoration on the desktop and I find it troublesome. The virus scanning is good but the virus killing... Domestic software does need to be supported, but when merchants make antivirus software, it should just be antivirus software and not look like adware. (It seems to be reminding XXX antivirus is running all the time) Sorry, just personal opinion

[ Last edited by fastslz on 2006-6-10 at 13:48 ]

Originally posted by afnspy at 2006-6-10 01:31 PM:
Hehe! For preventing virus infection within the LAN, the most important point is to strengthen internal management! No antivirus software is absolutely safe!
Suggestion:
1. The owner has already done it once, and it exhausted me...

What you said I have done once, and it exhausted me~ The result is that the fault remains the same the next day~

In addition, there are many things I dare not say or do. I'm just an employee, and I can't afford to offend those bosses! Let alone restrict anything~~ Alas, it's difficult.

For now, let's first get this damn virus resolved, and then make plans. I really don't want to do this!~~~!!!!!!!!!

chineselgs, I have uploaded two special kill tools for you. The download address is: http://bagpipe.ys168.com
After you download it, disconnect the network first, then enter safe mode for virus removal, clean up some basic startup items in the registry in safe mode, then enter normal mode to perform virus removal again, uninstall all useless software, and if there are no viruses, repair the system disk with --SFC /SCANNOW. Now I can only wish you good luck...........

Thank you very much, upstairs!!!

It seems that the problem is not as simple as initially thought. There's no way, so I have to carry out a comprehensive treatment. I'll stay up all night tonight to see the effect.

One day, a Trojan horse infected a financial computer in my company! The manifestations were that many programs couldn't run, and the D drive couldn't be opened by double-clicking! After starting Super Rabbit, it was found that there was a suspicious program in the startup items.
Project name: TProgram
Command line: C:\windows\smss.exe
After killing smss.exe with Super Rabbit, it was generated again when restarted! Moreover, an error report of smss.exe running would pop up! This window couldn't be closed! Sometimes it would crash (the financial computer was on Windows 98 system, no way).
Using Feer Trojan Horse Strong Clear Assistant PowerRMV (http://www.wenkai.com/down/powermv.zip)
It could open the D: drive, and found two suspicious files: autorun.inf and command.com. Checked the "Suppress file generation again" project in the assistant, then cleared it! After restarting, there was no such problem again!

[ Last edited by afnspy on 2006-6-10 at 17:01 ]