Demystifying the gray pigeon virus: a complete plan to prevent hunting

How to prevent "grey pigeons"

Gray Dove itself is not spreadable, and it is generally spread through four ways: web pages, emails, IM chat tools, and illegal software.

Web page transmission refers to that the virus producer implants the gray pigeon virus into the web page, and the user browses and infects; email transmission refers to the gray pigeon being bundled in the email attachment for transmission; IM chat tool transmission refers to the propagation of the gray pigeon through the instant chat tool Web page link or file; illegal software transmission means that the virus producer bundles the gray pigeon virus into various illegal software, and the user downloads, decompresses, and installs the infection.

The gray pigeon virus has been rampant for several years, with tens of thousands of variants, because the virus has very good stealth characteristics, which makes people unpredictable. A few days ago, the reporter interviewed anti-virus manufacturers such as Jinshan, Rising, and Jiang Min. They suggested that netizens should pay attention to the following points when using computers:

1. Pay attention to installing the IE browser patch. Many gray pigeons are intentionally placed by the attacker on the website with the vulnerable attack program, and the vulnerable machines will be poisoned when they visit these websites.

2. Upgrade anti-virus software in a timely manner. The use of pirated anti-virus software (or a genuine ID used on multiple computers) cannot be upgraded normally, and in particular needs to be checked.

3. Don't run suspicious programs sent by friends or strangers, don't be deceived by the other party's lies.

4. Turn off the automatic playback function of all disks to avoid poisoning by inserting poisonous U disks, mobile hard disks, and digital memory cards.

How to hunt "grey pigeons"

Because the gray pigeon itself is very concealed, it is difficult to find the gray pigeon invasion with the tools that come with the Windows system. So how do we find the gray pigeon virus that has been implanted in the computer? Generally speaking, you can use the anti-virus software to kill the "Gray Pigeon" virus, but because the "Gray Pigeon" is constantly changing, you need to update it frequently, and even if it is updated, it is difficult to keep up with the speed of the "Gray Pigeon" variant. Therefore, computer users can also download some special killing tools. If the "Gray Pigeon" cannot be completely removed even after downloading the special killing tool, it is recommended that computer users can use manual antivirus methods to remove the "Gray Pigeon" Trojan.

Manual antivirus method

Manual anti-virus requires the help of tool software: Ice Blade. If you ca n’t tell which one is a virus based on the process list, you can start Ice Blade, and open the task manager to compare. The extra process in Ice Blade may be the gray pigeon virus. If the process name is a fake word or notepad icon, it needs to be focused on (see Figure 1).

Select the G_server2007 process, right-click to end the process, and then directly browse to the folder indicated by the program name on the left according to the prompt point, find g_server2007.exe and g_server2007.DLL They are all different, and should be searched according to the path suggested by the ice blade. Some versions have _hook.dll, you can view the file date, which should be generated at the same time.) Right-click and delete it completely.

　 link

"Gray Pigeon" Life

In 2004, 2005, and 2006, the "Gray Pigeon" Trojan became famous for being selected as the top ten viruses of the year by domestic antivirus manufacturers for three consecutive years, and gradually became the focus of the media and Internet users. Since its appearance in 2001, the gray pigeon has mainly experienced three stages: the imitation period, the rapid development period, and the era of the national hacker.

"Gray Pigeon" initially mainly imitated the "Ice River" Trojan. It was not released as a finished product in the early days. More often, it appeared on the Internet in the form of technical research and using source code sharing.

Due to the lack of fame as the "glacier", only a small number of infections appeared at that time, but its open source approach also gradually increased its spread.

Because the source code is open, there are more and more versions of "Grey Pigeon". At that time, most security vendors identified the "gray pigeon" server reported and monitored by users as a "hacker program", and determined to kill, to a certain extent, curbed the development speed of gray pigeons.

From 2004 to 2005, a large number of business actions were realized on the Internet, e-commerce has become one of the choices for ordinary netizens to consume, and online games are blooming in China. Under such circumstances, a large number of Trojan horses and viruses spread through IM (Instant Messaging Software) unscrupulously steal online banking accounts, online game accounts, and passwords from user systems, posing new challenges to the Chinese Internet. Grey pigeons have also gradually entered the maturity period, and a large number of variants have been derived from the Internet.