ไฟล์ที่ใช้ทดสอบ : xx2.exe
File size: 24120 bytes
MD5 : 3a4074dca20f8ff1aa791cd65acfc19c
SHA1 : 0c3642991ce16332d0119b1aa5a7721974403823
=======================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.03.21 | Virus.Win32.OnLineGames!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.03.20 | Win-Trojan/Vilsel.24120.C |
| AntiVir | 8.2.1.196 | 2010.03.19 | TR/Patched.aba |
| Antiy-AVL | 2.0.3.7 | 2010.03.19 | - |
| Authentium | 5.2.0.5 | 2010.03.21 | W32/OnlineGames.CT.gen!Eldorado |
| Avast | 4.8.1351.0 | 2010.03.21 | Win32:OnLineGames-FOS |
| Avast5 | 5.0.332.0 | 2010.03.21 | Win32:OnLineGames-FOS |
| AVG | 9.0.0.787 | 2010.03.21 | PSW.OnlineGames3.ABAK |
| BitDefender | 7.2 | 2010.03.21 | Trojan.Generic.3005002 |
| CAT-QuickHeal | 10.00 | 2010.03.19 | Win32.PWS.OnLineGames.GP.3.Pack |
| ClamAV | 0.96.0.0-git | 2010.03.20 | Trojan.Dropper-24368 |
| Comodo | 4341 | 2010.03.21 | TrojWare.Win32.Trojan.Vilsel.~CG |
| DrWeb | 5.0.1.12222 | 2010.03.21 | Trojan.PWS.Wsgame.17203 |
| eSafe | 7.0.17.0 | 2010.03.21 | Win32.TRATRAPS |
| eTrust-Vet | 35.2.7376 | 2010.03.19 | Win32/Zuten!generic |
| F-Prot | 4.5.1.85 | 2010.03.21 | W32/OnlineGames.CT.gen!Eldorado |
| F-Secure | 9.0.15370.0 | 2010.03.21 | Trojan-PSW:W32/OnlineGames.TYA |
| Fortinet | 4.0.14.0 | 2010.03.20 | PossibleThreat |
| GData | 19 | 2010.03.21 | Trojan.Generic.3005002 |
| Ikarus | T3.1.1.80.0 | 2010.03.21 | Virus.Win32.OnLineGames |
| Jiangmin | 13.0.900 | 2010.03.21 | TrojanDropper.Agent.ajpz |
| K7AntiVirus | 7.10.1002 | 2010.03.19 | Trojan.Win32.Malware.4 |
| Kaspersky | 7.0.0.125 | 2010.03.21 | Trojan.Win32.Vilsel.swh |
| McAfee | 5927 | 2010.03.21 | PWS-OnlineGames.ha |
| McAfee+Artemis | 5927 | 2010.03.21 | PWS-OnlineGames.ha |
| McAfee-GW-Edition | 6.8.5 | 2010.03.21 | Heuristic.BehavesLike.Win32.Trojan.A |
| Microsoft | 1.5605 | 2010.03.21 | PWS:Win32/OnLineGames.GP |
| NOD32 | 4962 | 2010.03.21 | a variant of Win32/PSW.OnLineGames.OQU |
| Norman | 6.04.09 | 2010.03.21 | W32/Suspicious_Gen2.OUDZ |
| nProtect | 2009.1.8.0 | 2010.03.21 | Trojan-Dropper/W32.Agent.24120 |
| Panda | 10.0.2.2 | 2010.03.21 | - |
| PCTools | 7.0.3.5 | 2010.03.21 | Trojan.Generic |
| Prevx | 3.0 | 2010.03.21 | Medium Risk Malware |
| Rising | 22.39.06.01 | 2010.03.21 | Trojan.Win32.Generic.51F99CFA |
| Sophos | 4.51.0 | 2010.03.21 | Troj/GamPass-X |
| Sunbelt | 6011 | 2010.03.21 | Trojan.Win32.Generic!BT |
| Symantec | 20091.2.0.41 | 2010.03.21 | Trojan Horse |
| TheHacker | 6.5.2.0.241 | 2010.03.21 | Trojan/OnLineGames.oqu |
| TrendMicro | 9.120.0.1004 | 2010.03.21 | TSPY_ONLINEG.SMN |
| VBA32 | 3.12.12.2 | 2010.03.19 | Trojan-GameThief.Win32.OnLineGames.wakk |
| ViRobot | 2010.3.19.2236 | 2010.03.20 | Trojan.Win32.Vilsel.24120 |
| VirusBuster | 5.0.27.0 | 2010.03.21 | Trojan.ATRAPS.FHO |
-------------------------------------------------------------------------------
Files Added
%Temp%\TQ41.tmp (random)
%Temp%\TQ41.tmp (Random)
%Temp%\PbIeD.DRV (Random)
%Temp%\delself.bat
%WinDir%\system\PbIeD.DRV (Random)
%Temp% =C:\Documents and Settings\[UserName]\Local Settings\Temp\
%WinDir% = C:\WINDOWS
File Modified
C:\WINDOWS\system32\dsound.dll (modified by virus)
-------------------------------------------------------------------------------
virus ตระกูล onlinegames ตัวนี้ antivirus ทุกค่ายรู้จักหมดแล้ว
แต่ว่าผลกระทบจากการที่ Antivirus ได้ delete ไฟล์ dsound.dll ที่ถูก virus modifiled ไว้
จึงทำให้ระบบ sound มีปัญหา
ตัวอย่าง หลังจาก dsound.dll ถูก delete ไป
---------------------------------------------------------------------------------
วิธีแก้ : dsound.dll missing
---------------------------------------------------------------------------------
ให้เข้าไปที่ C:\windows\system32 หาชื่อไฟล์ dsound.dllxxxx ในตัวอย่างคือ
dsound.dllPBIeD (อาจเป็นชื่ออื่นๆ) ให้ rename ไฟล์เป็น dsound.dll
หรือ Download จาก link นี้ครับ
or
FixDsound
...
No comments:
Post a Comment