Fake Alert : XP Internet Security
ไฟล์ที่ใช้ทดสอบ : feed.exe
File size: 183296 bytes
MD5 : 1fb980a43d158932d92479a186454b75
SHA1 : c4f81dd801dc0100d5361842fe0852fd02aa63a3
========================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.03.01 | - |
| AhnLab-V3 | 5.0.0.2 | 2010.02.28 | - |
| AntiVir | 8.2.1.176 | 2010.03.01 | - |
| Antiy-AVL | 2.0.3.7 | 2010.03.01 | - |
| Authentium | 5.2.0.5 | 2010.03.01 | - |
| Avast | 4.8.1351.0 | 2010.03.01 | - |
| AVG | 9.0.0.730 | 2010.02.28 | SHeur3.AXP |
| BitDefender | 7.2 | 2010.03.01 | - |
| CAT-QuickHeal | 10.00 | 2010.03.01 | (Suspicious) - DNAScan |
| ClamAV | 0.96.0.0-git | 2010.03.01 | - |
| Comodo | 4091 | 2010.02.28 | - |
| DrWeb | 5.0.1.12222 | 2010.03.01 | Trojan.Fakealert.11956 |
| eSafe | 7.0.17.0 | 2010.02.28 | - |
| eTrust-Vet | 35.2.7334 | 2010.03.01 | - |
| F-Prot | 4.5.1.85 | 2010.02.28 | - |
| F-Secure | 9.0.15370.0 | 2010.03.01 | Trojan:W32/FraudPack.CJ |
| Fortinet | 4.0.14.0 | 2010.02.28 | - |
| GData | 19 | 2010.03.01 | - |
| Ikarus | T3.1.1.80.0 | 2010.03.01 | - |
| Jiangmin | 13.0.900 | 2010.03.01 | - |
| K7AntiVirus | 7.10.984 | 2010.02.26 | - |
| Kaspersky | 7.0.0.125 | 2010.03.01 | Trojan.Win32.FraudPack.anca |
| McAfee | 5906 | 2010.02.28 | - |
| McAfee+Artemis | 5906 | 2010.02.28 | - |
| McAfee-GW-Edition | 6.8.5 | 2010.03.01 | Heuristic.LooksLike.Trojan.FraudPack.H |
| Microsoft | 1.5502 | 2010.03.01 | - |
| NOD32 | 4903 | 2010.02.28 | - |
| Norman | 6.04.08 | 2010.02.28 | - |
| nProtect | 2009.1.8.0 | 2010.02.28 | - |
| Panda | 10.0.2.2 | 2010.02.28 | - |
| PCTools | 7.0.3.5 | 2010.02.28 | - |
| Prevx | 3.0 | 2010.03.01 | Medium Risk Malware |
| Rising | 22.37.00.04 | 2010.03.01 | - |
| Sophos | 4.50.0 | 2010.03.01 | Mal/EncPk-NP |
| Sunbelt | 5713 | 2010.03.01 | - |
| Symantec | 20091.2.0.41 | 2010.03.01 | Trojan.FakeAV |
| TheHacker | 6.5.1.7.216 | 2010.03.01 | - |
| TrendMicro | 9.120.0.1004 | 2010.03.01 | - |
| VBA32 | 3.12.12.2 | 2010.03.01 | - |
| ViRobot | 2010.2.27.2206 | 2010.02.27 | - |
| VirusBuster | 5.0.27.0 | 2010.02.28 | - |
---------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Files Added
C:\Documents and Settings\Administrator\Local Settings\Application Data\av.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\47p8UgR3F
Keys added
HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\shell
HKCU\Software\Classes\.exe\shell\open
HKCU\Software\Classes\.exe\shell\open\command
HKCU\Software\Classes\.exe\shell\runas
HKCU\Software\Classes\.exe\shell\runas\command
HKCU\Software\Classes\.exe\shell\start
HKCU\Software\Classes\.exe\shell\start\command
HKCU\Software\Classes\secfile
HKCU\Software\Classes\secfile\DefaultIcon
HKCU\Software\Classes\secfile\shell
HKCU\Software\Classes\secfile\shell\open
HKCU\Software\Classes\secfile\shell\open\command
HKCU\Software\Classes\secfile\shell\runas
HKCU\Software\Classes\secfile\shell\runas\command
HKCU\Software\Classes\secfile\shell\start
HKCU\Software\Classes\secfile\shell\start\command
Values deleted
HKCU\Software\Microsoft\Internet Explorer\Recovery\Active\
{65196854-258B-11DF-A7F6-00219701E52A}: 0x00000000
Values Added
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
Values modified
HKCU\Software\Classes\.exe\shell\open\
command\: ""C:\Documents and Settings\Administrator\Local Settings\Application Data\av.exe" /START "%1" %*"
HKCU\Software\Classes\.exe\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\DefaultIcon\: "%1"
HKCU\Software\Classes\.exe\: "secfile"
HKCU\Software\Classes\.exe\Content Type: "application/x-msdownload"
HKCU\Software\Classes\secfile\shell\open\
command\: ""C:\Documents and Settings\Administrator\Local Settings\
Application Data\av.exe" /START "%1" %*"
HKCU\Software\Classes\secfile\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\DefaultIcon\: "%1"
HKCU\Software\Classes\secfile\: "Application"
------------------------------------------------------------------------
วิธีกำจัด /แก้ไข : Fake Alert : XP Internet Securiry
------------------------------------------------------------------------
วิธีที่ 1
Download Fix Tool : PeeTechFix-MultipleRogue
------------------------------------------------------------------------
วิธีที่ 2 Manual Delete
Download Fix Tool : Fix XP Internet Security
(ExplorerXP.com , RegAssassin.com, Nod32 Recovery Tool)
1. กดปุ่ม Ctrl + Alt +Del เรียก Task Manager แล้ว End Process ไฟล์ av.exe
2. เปิด ExplorerXP.com จากนั้นเข้าไป delete ไฟล์ตามนี้
C:\Documents and Settings\[UserName]\Local Settings\Application Data\av.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\47p8UgR3F
3. เปิด RegAssassin.com โดย Copy key นี้
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\secfile
แล้ว Paste ลงในช่อง จากนั้นกดปุ่ม Delete
4. เปิดโปรแกรม NOD32 Recovery Tool แล้ว Fix now เพื่อ Reset firewall , Security center
5. restart คอมพิวเตอร์
-------------------------------------------------------------------------
หมายเหตุ :
ถ้าไม่ Rename โปรแกรมก่อน เมื่อเรียกไฟล์ .exe ขึ้นมาทำงาน ไฟล์ av.exe จะถูกเรียกขึ้นมาอีกครั้ง
หลังจากที่ End process ไปแล้ว
อาการ เปิดหน้าต่างแล้วขึ้น Open with
เมื่อไฟล์ av.exe ถูกลบไปแล้ว เวลาเราเปิดโปรแกรม .exe จะขึ้นหน้าต่างดังภาพ
เมื่อเราลบ key > HKCU\Software\Classes\.exe โปรแกรม .exe ต่างๆก็สามารถเปิดได้
ตามปกติครับ
การทำงานXP Internet Security จะเหมือนๆกับ Antivirus XP 2010 ตัวล่าสุดครับ
No comments:
Post a Comment