This is the world the first can overlay the hard drive for cent area of worm virus, did not adopt the calculator of the protection measure, once is infect with, cent of hard drive the area will be overlay, causing the hard drive lock dead, the hard drive can't use, all datas were all seal to save.

The anti- virus engineer of the rising authority tells the large customer formally:From more and more several authority data and be close to 100 pieces of damaged circumstances that victimize the customer hard drive to see, the destructive powers of" the hard drive cutthroat" are to is the most cruelty since history, are also fatal to the breakage degrees of the customer data.

Virus type:Worm virus
Go into action time:Random
Spread the way:Network/ mail
Infect with the object:Network
Main virus document size:17,408 word stanzas
Break the way:Destroy the hard drive data
Watch out for the degree:★★★★★

Virus introduction:

On the dawn of December 27, the rising global anti- virus monitor net leads off to intercept and seize one all new malignant worm virus in the domestic, and named after it to" the hard drive cutthroat"( Worm.OpaSoft).The destructive power of this virus surmounted the obvious CIH of notorious reputation completely:It can movement in Windows95 above of all operate systems of edition, recover the customer computes all on board hard drives in of all data moment clearance and can't.Moreover that virus can also make use of the network loophole and the share catalogues to carry on the network infection, dissemination the ability is far far strong in CIH!

Will make duplicate the oneself to the system catalogue to descend first when" the hard drive cutthroat" virus circulate, then modify the registration form to carry on from the start.The virus will clip to carry on the crary network dissemination through the loophole and the share documents of the 9 X system, even the network share document clips the share password, the virus also can infect.If is the NT series system, then the virus will pass to share the document to clip to infect with the network.The virus will obtain current time, if the virus has already circulate for two days, then the virus will write in the virus document under the C dish, the virus' document will rewrite the hard drive area form for cent, be the heavy of system, will appear the virus information, and break hard drive up all datas, and can't recover.

The virus detection and clearance:

This virus would like and next characteristic, if the customer discovers to have these characteristics in the calculator, then winning this virus very probably:

A, the virus circulate will make duplicate the oneself to the WINDOWS install the catalogue next( if is to recognize tacitly to install then the virus copy the catalogue of the virus is:C:\ WINDOWS), named after:Mqbkup.exe.Can use the DOS dish leading system, delete this document directly in the DOS, or convenient kill the poisonous software to carry on the memory to kill the poison in the system of WINDOWS.

Two, the virus will rewrite the Windows gearing catalogue under of document of Win.ini, join the run therein= c:\ windows\ mqbkup.exe contents, the customer can use to edit this document of direct editor of software, deleting this contents.

Three, the virus will establish the document of Boot.exe,15 words of 19 documents of msdos.sys of word stanza,1706 documents of Mslicenf.com of word stanzas,88 documents of Boot.ini of word stanzas,4096 words stanzas in the C dish the document of Autoexe.bat of the stanza, the customer can delete these five documents directly.

Four, virus would in the registration form of from the start item:HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ join in the Run the key value mqbkup or mqbkupdbs, the customer can use the registration form editor tool directly be worth that key direct deletion.

Five, customer if won that virus, the screen of hour of then heavy will appear the information of the following contents up:NOTICE:
Illegal Microsoft Windows license detected!
You are in violation of the Digital Millennium Copyright Act!
Your unauthorized license has been revoked.
for more information, please call us at:
1-888-NOPIRACY
on our website, at:
www.bsa.org
Business Software Alliance
Promoting a safe & legal online world.
However after customer sees this information, then the hard drive data have already is break, can't recover.