Fake Alert :Antivirus XP 2010
ไฟล์ที่ใช้ทดสอบ : feed.exe
File size: 184832 bytes
MD5: b57f922c1da5b8778f5e971dc55f0b44
SHA1: 828536d03b3545207eaea21ff0e5c8af76be72ea
========================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.03.01 | Trojan.Win32.FakeAV!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.02.28 | - |
| AntiVir | 8.2.1.176 | 2010.03.01 | - |
| Antiy-AVL | 2.0.3.7 | 2010.03.01 | - |
| Authentium | 5.2.0.5 | 2010.03.01 | W32/FakeSec.A.gen!Eldorado |
| Avast | 4.8.1351.0 | 2010.03.01 | - |
| Avast5 | 5.0.332.0 | 2010.03.01 | - |
| AVG | 9.0.0.730 | 2010.03.01 | Win32/Cryptor |
| BitDefender | 7.2 | 2010.03.02 | - |
| CAT-QuickHeal | 10.00 | 2010.03.01 | (Suspicious) - DNAScan |
| ClamAV | 0.96.0.0-git | 2010.03.02 | - |
| Comodo | 4091 | 2010.02.28 | - |
| DrWeb | 5.0.1.12222 | 2010.03.02 | - |
| eSafe | 7.0.17.0 | 2010.03.01 | - |
| eTrust-Vet | 35.2.7334 | 2010.03.01 | - |
| F-Prot | 4.5.1.85 | 2010.03.01 | W32/FakeSec.A.gen!Eldorado |
| F-Secure | 9.0.15370.0 | 2010.03.02 | Suspicious:W32/Malware!Gemini |
| Fortinet | 4.0.14.0 | 2010.02.28 | - |
| GData | 19 | 2010.03.01 | - |
| Ikarus | T3.1.1.80.0 | 2010.03.01 | Trojan.Win32.FakeAV |
| Jiangmin | 13.0.900 | 2010.03.01 | - |
| K7AntiVirus | 7.10.986 | 2010.03.01 | - |
| Kaspersky | 7.0.0.125 | 2010.03.02 | - |
| McAfee | 5907 | 2010.03.01 | - |
| McAfee+Artemis | 5907 | 2010.03.01 | - |
| McAfee-GW-Edition | 6.8.5 | 2010.03.01 | Heuristic.LooksLike.Trojan.FraudPack.H |
| Microsoft | 1.5502 | 2010.03.01 | Trojan:Win32/FakeRean |
| NOD32 | 4906 | 2010.03.01 | a variant of Win32/Kryptik.CSL |
| Norman | 6.04.08 | 2010.03.01 | - |
| nProtect | 2009.1.8.0 | 2010.03.01 | - |
| Panda | 10.0.2.2 | 2010.03.01 | - |
| PCTools | 7.0.3.5 | 2010.03.02 | - |
| Prevx | 3.0 | 2010.03.02 | - |
| Rising | 22.37.00.04 | 2010.03.01 | - |
| Sophos | 4.50.0 | 2010.03.02 | Mal/FakeAV-BT |
| Sunbelt | 5716 | 2010.03.01 | - |
| Symantec | 20091.2.0.41 | 2010.03.02 | Suspicious.Insight |
| TheHacker | 6.5.1.7.217 | 2010.03.01 | - |
| TrendMicro | 9.120.0.1004 | 2010.03.01 | - |
| VBA32 | 3.12.12.2 | 2010.03.01 | - |
| ViRobot | 2010.2.27.2206 | 2010.02.27 | - |
| VirusBuster | 5.0.27.0 | 2010.03.01 | - |
---------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Files Added
C:\Documents and Settings\[UserName]\Local Settings\Application Data\av.exe
C:\Documents and Settings\[UserName]\Local Settings\Application Data\47p8UgR3F
Keys added
HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\shell
HKCU\Software\Classes\.exe\shell\open
HKCU\Software\Classes\.exe\shell\open\command
HKCU\Software\Classes\.exe\shell\runas
HKCU\Software\Classes\.exe\shell\runas\command
HKCU\Software\Classes\.exe\shell\start
HKCU\Software\Classes\.exe\shell\start\command
HKCU\Software\Classes\secfile
HKCU\Software\Classes\secfile\DefaultIcon
HKCU\Software\Classes\secfile\shell
HKCU\Software\Classes\secfile\shell\open
HKCU\Software\Classes\secfile\shell\open\command
HKCU\Software\Classes\secfile\shell\runas
HKCU\Software\Classes\secfile\shell\runas\command
HKCU\Software\Classes\secfile\shell\start
HKCU\Software\Classes\secfile\shell\start\command
Values deleted
HKCU\Software\Microsoft\Internet Explorer\Recovery\Active\
{65196854-258B-11DF-A7F6-00219701E52A}: 0x00000000
Values Added
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
Values modified
HKCU\Software\Classes\.exe\shell\open\
command\: ""C:\Documents and Settings\[UserName]\Local Settings\
Application Data\av.exe" /START "%1" %*"
HKCU\Software\Classes\.exe\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\DefaultIcon\: "%1"
HKCU\Software\Classes\.exe\: "secfile"
HKCU\Software\Classes\.exe\Content Type: "application/x-msdownload"
HKCU\Software\Classes\secfile\shell\open\
command\: ""C:\Documents and Settings\Administrator\Local Settings\
Application Data\av.exe" /START "%1" %*"
HKCU\Software\Classes\secfile\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\DefaultIcon\: "%1"
HKCU\Software\Classes\secfile\: "Application"
------------------------------------------------------------------------
วิธีกำจัด /แก้ไข : Fake Alert : Antivirus XP 2010
------------------------------------------------------------------------
วิธี่ที่ 1
Download Fix Tool : PeeTechFix-MultipleRogue
------------------------------------------------------------------------
วิธีที่ 2 Manual Delete
Download Fix Tool : Fix Antivirus XP 2010
(ExplorerXP.com , RegAssassin.com, Nod32 Recovery Tool)
1. กดปุ่ม Ctrl + Alt +Del เรียก Task Manager แล้ว End Process ไฟล์ av.exe
2. เปิด ExplorerXP.com จากนั้นเข้าไป delete ไฟล์ตามนี้
C:\Documents and Settings\[UserName]\Local Settings\Application Data\av.exe
C:\Documents and Settings\[UserName]\Local Settings\Application Data\47p8UgR3F
3. เปิด RegAssassin.com โดย Copy key นี้
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\secfile
แล้ว Paste ลงในช่อง จากนั้นกดปุ่ม Delete
หรือ download FixRegistry_exe.reg ก็ได้ครับ แก้ได้เหมือนกับ RegAssasin
4. เปิดโปรแกรม NOD32 Recovery Tool แล้ว Fix now เพื่อ Reset firewall , Security center
5. restart คอมพิวเตอร์
-------------------------------------------------------------------------
หมายเหตุ :
ถ้าไม่ Rename โปรแกรมก่อน เมื่อเรียกไฟล์ .exe ขึ้นมาทำงาน ไฟล์ av.exe จะถูกเรียกขึ้นมาอีกครั้ง
หลังจากที่ End process ไปแล้ว
อาการ เปิดโปรแกรมแล้วขึ้น Open With
เมื่อไฟล์ av.exe ถูกลบไปแล้ว เวลาเราเปิดโปรแกรม จะขึ้นหน้าต่างดังภาพ
เมื่อเราลบ key > HKCU\Software\Classes\.exe โปรแกรม .exe ต่างๆก็สามารถเปิดได้
ตามปกติครับ
การทำงานของ Antivirus XP 2010 ตัวล่าสุดนี้จะเหมือนๆกับ XP Internet Security ครับ
No comments:
Post a Comment