焦
焦皮
QAZ
W32.HLLW.Qaz.A, or the QAZ Worm
There's a new Trojan horse in town called Qaz.trojan (W32.HLLW.QAZ.A).
This malicious code spreads within a network of shared computer systems,
infecting the Notepad.exe file.
Trojan horses are often not one but many smaller programs bundled together,
and one malicious program particular to the Qaz.trojan will open port 7597,
allowing a hacker to come along later and gain access to the infected computer.
Qaz.trojan requires a user on an infected system to open the Notepad.exe file.
Qaz.trojan ranks as a 5 on the ZDNet Virus Meter.
How It Works
Although it may have originally spread as an e-mail,
a download from a Web site, or through IRC chatrooms,
Qaz.trojan now spreads within local-area networks.
If the user of an infected system opens Notepad,
the virusis run.
Qaz.trojan will look for individual systems that share a networked drive,
then seeks out the Windows folder and infects the Notepad.exe file on those systems.
Qaz.trojan first renames Notepad.exe to Note.com then creates the virus-infected file Notepad.exe.
This new Notepad.exe has a length of 120,320 bytes.
Qaz.trojan rewrites the System Registry to load itself every time the computer is rebooted.
Users monitoring their open ports may notice unusual traffic on TCP port 7597 if a hacker
connects to the infected computer.
Qaz trojan就是前几天黑客用来攻击微软公司所使用的木马！他感染notepad.exe，并且可以自动感染其他共享机器，他会开放被感染机的7597端口，以便日后黑客进入被感染机。
ps:转载,目前兄弟我还不知道有什么好方法可以彻底清除这个
木马的,那位高手知道,请多多指教..谢谢
W32.HLLW.Qaz.A, or the QAZ Worm
There's a new Trojan horse in town called Qaz.trojan (W32.HLLW.QAZ.A).
This malicious code spreads within a network of shared computer systems,
infecting the Notepad.exe file.
Trojan horses are often not one but many smaller programs bundled together,
and one malicious program particular to the Qaz.trojan will open port 7597,
allowing a hacker to come along later and gain access to the infected computer.
Qaz.trojan requires a user on an infected system to open the Notepad.exe file.
Qaz.trojan ranks as a 5 on the ZDNet Virus Meter.
How It Works
Although it may have originally spread as an e-mail,
a download from a Web site, or through IRC chatrooms,
Qaz.trojan now spreads within local-area networks.
If the user of an infected system opens Notepad,
the virusis run.
Qaz.trojan will look for individual systems that share a networked drive,
then seeks out the Windows folder and infects the Notepad.exe file on those systems.
Qaz.trojan first renames Notepad.exe to Note.com then creates the virus-infected file Notepad.exe.
This new Notepad.exe has a length of 120,320 bytes.
Qaz.trojan rewrites the System Registry to load itself every time the computer is rebooted.
Users monitoring their open ports may notice unusual traffic on TCP port 7597 if a hacker
connects to the infected computer.
Qaz trojan就是前几天黑客用来攻击微软公司所使用的木马！他感染notepad.exe，并且可以自动感染其他共享机器，他会开放被感染机的7597端口，以便日后黑客进入被感染机。
ps:转载,目前兄弟我还不知道有什么好方法可以彻底清除这个
木马的,那位高手知道,请多多指教..谢谢