Microsoft found that the new virus caused Windows black screen to fail to start

Black Screen is a strategy used by Microsoft to deal with Windows pirated users. However, recently, Microsoft detected a Trojan virus that would cause the computer to black out and fail to boot.

It is reported that the Trojan virus is Backdoor:Win32/Yonsole.A, which is a new malicious virus software that will destroy the Windows boot process and prevent the system from starting. The infected computer will be remotely controlled by the attacker. , execute various instructions.

Microsoft security officer Chun Feng said in a blog post that the newly discovered Trojan can accept and execute remote server commands and modify the master boot record (MBR) of the infected computer. The MBR changes are very similar. In ‘Stoned& rsquo; virus modification of DOS. However, after being infected by Yonsole, the MBR only displays a dotted line in the middle of the screen and cannot be started again. Chun Feng also released the MBR code of the Yonsole virus and the screenshot that the system black screen could not be started on the blog.
New Virus MBR Code

Start Screen Screenshot

This virus will affect multiple Windows versions, will embed itself into services.exe, and download a DLL file to, For example, f00165500k.cmd, this DLL file contains the backdoor function and may be detected as Backdoor:Win32/Yonsole.B. Backdoor:Win32/Yonsole.A installs the downloaded DLL file as a Service DLL on your computer to ensure it is loaded every time Windows starts. In Windows 2000 and Windows NT, the virus will embed the DLL file in the C:WinntSystem32 folder; on Windows XP, Windows Vista, and Windows 7, the DLL file will be embedded in the C:WindowsSystem32 folder.