Today, some people uploaded some Wanke Cloud snap-up software from the group, and in the afternoon, they found that some people's were discovered"Playing with guest coins" was stolen！！！！
Thousands of people have already been stolen from playing guest coins, please check your wallets quickly!!!!!
As shown in the figure above, the exe software is bundled with a virus, and after running the software, the program will release the virus to c:/system sll (automatically created hidden folder), as shown in the figure below:
As long as you click Run, you can't clean up and kill it with 360 website guards, computer butlers, Kingsoft drug tyrants, etc.! The Trojan is written by a .net program, and the following is the configuration file of the sll.exe virus, as shown in the figure below:
The domain name of the backdoor is: safe.hgzvip.net
Interim Solution:
1: Open Task Manager or open 360 Security Guard or QQ Computer Manager, and find a network connection in more tools
(Take 360 Security Guard as an example)
See if there are any sll.exe processes!!!!!! , if any, end the process first!!!!!!!!!!
2: In the PC Control Panel - Appearance and Personalization - File Explorer Options, Settings, Show Hidden Files, Folders and Drives
3: Click "My Computer" to find the System Sll folder under the C drive,Remember to compress the backup!! Be sure to compress the backup first, it will be regarded as retained evidence, and then,Try deleting or renaming the folder！！！！！
If there is a stolen guest coin, please reply to the post, report and call the police together to see if it can be dealt with!!!
1: As for the reason for the theft of the guest coin, it may be that the virus Trojan uploaded the wallet key first, and then recorded the keystroke log and uploaded it to the designated server!
2: Some people also say that it was the virus Trojan that stole the wallet key and then brute-force cracked the password.
3: The official document is replaced by the thief, and the password will be sent to the server of the account thief when the user transfers money!
|
Posted on 12/4/2017 8:57:35 PM
|
|
|
|
Posted on 12/5/2017 9:07:30 AM
|
Posted on 12/6/2017 2:14:26 PM
|
