<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[rwjgpget的专栏]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/rwjgpget</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; rwjgpget]]></copyright><item><title><![CDATA[新病毒尼姆达的防御]]></title><link>https://blog.youkuaiyun.com/rwjgpget/article/details/13404</link><guid>https://blog.youkuaiyun.com/rwjgpget/article/details/13404</guid><author>rwjgpget</author><pubDate>Mon, 08 Oct 2001 18:29:00 +0800</pubDate><description><![CDATA[尼姆达是一种邮件型病毒，以.eml的形式存在，它利用了OUTLOOK的漏洞，当你点击（单击）带毒邮件文件时或用OUTLOOK浏览邮件时，系统自动提取邮件中的README.EXE,README.EXE将在windows 的temp目录下产生mep****.tmp,mep****.tmp.exe(具有隐藏属性，外表是一个IE图标，让人以为是一个.HTML，)。可用查看进程信息的工具查看正在运行的进程，]]></description><category></category></item><item><title><![CDATA[变速齿轮的原理]]></title><link>https://blog.youkuaiyun.com/rwjgpget/article/details/13402</link><guid>https://blog.youkuaiyun.com/rwjgpget/article/details/13402</guid><author>rwjgpget</author><pubDate>Sat, 08 Sep 2001 11:48:00 +0800</pubDate><description><![CDATA[变速齿轮通过修改API函数GETTICKCOUNT和TIMEGETTIME骗过了游戏和程序的定时器导致游戏和程序速度看起来被改变。下面以GETTICKCOUNT为例进行分析：原本的GETTICKCOUNT汇编：kernel32!gettickcount     mov gs,[bffcaea18]                                    mov eax,gs:]]></description><category></category></item></channel></rss>