The mobile phone prompts that there is a new message, and you can't see it when you open the inbox.

If your message disappears for no reason, look!

Cell phone poisoning! The symptom is to automatically send a text message to a number 159, about once a day, and there are several numbers at the end of the text message. Found this number from Beijing. Or the inbox message will disappear automatically after the phone is turned off. Solution:

1, use appman to view the smserv process and close it.

2. Use Fileman to enter drive C and delete the following files.

Under c: \ system \ data \ smserv.app, starter.exe, smserv.rsc, smserv_caption.rsc

Analysis of 80 1009.mdl rogue software (LOGO. C: \ system \ recogs \

Analysis of rogue software in this software.

The installation file contains

Logo.exe 4252 bytes.

Themes.dat 2 1528 bytes

According to the documents, it seems very likely that the original theme rogue software is also these two documents.

Enter these two files into the installation package, and run LOGO.EXE after the installation.

Most people may think that LOGO.EXE is a display image similar to BINPDA.EXE.

But you will find that nothing is displayed after running.

In fact, this LOGO.EXE solved the problem. DAT file, this file is a ZIP file.

It contains six files,

Zagmdl.mdl will be saved as file 80 1009.mdl in c:\system\recogs\ for automatic startup.

The other five files will be saved in c:\system\data\, and some * * files will be generated after the program runs.

The safest way is to check the machine. However, it should be possible to delete the following files. Deleted files have not been found yet.

The problem of sending information

c:\system\data\smserv.app。

c:\system\data\smserv.rsc

c:\system\data\starter.exe

c:\ system \ recogs \ 80 1009 . MDL

c:\system\data\updater.app

c:\system\data\updater.rsc

c:\system\reptm.txt

c:\system\logs.txt

C:\system\data\smserv.app。

c:\system\data\Tid.txt

Rogue software running mode, the phone will automatically load c:\system\recogs\ and e:\system\recogs\ to find the automatic start.

Program and start it.

80 1009.mdl will call starter.exe to run the background process.

Starter.exe will call smserv.app to send information automatically.

Because it is only a simple analysis, there is no analysis of the content of the information sent and to whom.

==========================================================

How to prevent it

When downloading the software, you'd better read the comments of the following netizens first. If this is your first download, you should be careful.

You can unlock the program with UNMAKESIS first to see if there is any program that runs automatically after installation. If there is, it is better to find out whether it is rogue software.

Then see if the installer has put the files into e:\system\recogs\ and c:\system\recogs\ to realize automatic operation.

Usually in the next theme, be careful when you do the next theme!