XP Security Tool
XP Smart Security 2010
Vista Smart Security 2010
-------------------------------
ave.exe
File size: 202240 bytes
MD5 : 4529b997f057e74f3345b9b4afd427cc
SHA1 : 36eec230d939cbcab55db466cf02147dbd6346e8
========================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.03.21 | Gen.Heur!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.03.20 | - |
| AntiVir | 8.2.1.196 | 2010.03.19 | - |
| Antiy-AVL | 2.0.3.7 | 2010.03.19 | - |
| Authentium | 5.2.0.5 | 2010.03.21 | W32/FakeSec.B.gen!Eldorado |
| Avast | 4.8.1351.0 | 2010.03.20 | Win32:Trojan-gen |
| Avast5 | 5.0.332.0 | 2010.03.20 | Win32:Trojan-gen |
| AVG | 9.0.0.787 | 2010.03.20 | Generic17.JQZ |
| BitDefender | 7.2 | 2010.03.21 | Gen:Heur.Krypt.26 |
| CAT-QuickHeal | 10.00 | 2010.03.19 | - |
| ClamAV | 0.96.0.0-git | 2010.03.20 | - |
| Comodo | 4337 | 2010.03.21 | - |
| DrWeb | 5.0.1.12222 | 2010.03.21 | Trojan.Fakealert.14113 |
| eSafe | 7.0.17.0 | 2010.03.18 | - |
| eTrust-Vet | 35.2.7376 | 2010.03.19 | - |
| F-Prot | 4.5.1.85 | 2010.03.21 | W32/FakeSec.B.gen!Eldorado |
| F-Secure | 9.0.15370.0 | 2010.03.21 | Gen:Heur.Krypt.26 |
| Fortinet | 4.0.14.0 | 2010.03.20 | - |
| GData | 19 | 2010.03.21 | Gen:Heur.Krypt.26 |
| Ikarus | T3.1.1.80.0 | 2010.03.21 | Gen.Heur |
| Jiangmin | 13.0.900 | 2010.03.21 | - |
| K7AntiVirus | 7.10.1002 | 2010.03.19 | - |
| Kaspersky | 7.0.0.125 | 2010.03.21 | Trojan.Win32.FraudPack.aoxt |
| McAfee | 5926 | 2010.03.20 | - |
| McAfee+Artemis | 5926 | 2010.03.20 | Artemis!4529B997F057 |
| McAfee-GW-Edition | 6.8.5 | 2010.03.20 | Heuristic.LooksLike.Trojan.FakeRean.H |
| Microsoft | 1.5605 | 2010.03.21 | - |
| NOD32 | 4961 | 2010.03.20 | a variant of Win32/Kryptik.DBC |
| Norman | 6.04.09 | 2010.03.20 | - |
| nProtect | 2009.1.8.0 | 2010.03.20 | - |
| Panda | 10.0.2.2 | 2010.03.20 | Adware/XPDefenderPro |
| PCTools | 7.0.3.5 | 2010.03.21 | - |
| Prevx | 3.0 | 2010.03.21 | High Risk Fraudulent Security Program |
| Rising | 22.39.06.01 | 2010.03.21 | Trojan.Win32.Generic.51FB9D04 |
| Sophos | 4.51.0 | 2010.03.21 | Mal/FakeAV-BT |
| Sunbelt | 6002 | 2010.03.21 | VirTool.Win32.Obfuscator.hg!a (v) |
| Symantec | 20091.2.0.41 | 2010.03.21 | Trojan.FakeAV!gen21 |
| TheHacker | 6.5.2.0.241 | 2010.03.21 | Trojan/FakeAV.gen |
| TrendMicro | 9.120.0.1004 | 2010.03.21 | - |
| VBA32 | 3.12.12.2 | 2010.03.19 | - |
| ViRobot | 2010.3.19.2236 | 2010.03.20 | - |
| VirusBuster | 5.0.27.0 | 2010.03.20 | - |
--------------------------------------------------------------------------------
...
Files Added
C:\Documents and Settings\[UserName]\Local Settings\Application Data\ave.exe
C:\Documents and Settings\[UserName]\Local Settings\Application Data\48531I0
Keys added
HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\shell
HKCU\Software\Classes\.exe\shell\open
HKCU\Software\Classes\.exe\shell\open\command
HKCU\Software\Classes\.exe\shell\runas
HKCU\Software\Classes\.exe\shell\runas\command
HKCU\Software\Classes\.exe\shell\start
HKCU\Software\Classes\.exe\shell\start\command
HKCU\Software\Classes\secfile
HKCU\Software\Classes\secfile\DefaultIcon
HKCU\Software\Classes\secfile\shell
HKCU\Software\Classes\secfile\shell\open
HKCU\Software\Classes\secfile\shell\open\command
HKCU\Software\Classes\secfile\shell\runas
HKCU\Software\Classes\secfile\shell\runas\command
HKCU\Software\Classes\secfile\shell\start
HKCU\Software\Classes\secfile\shell\start\command
Values deleted
HKCU\Software\Microsoft\Internet Explorer\Recovery\Active\
{65196854-258B-11DF-A7F6-00219701E52A}: 0x00000000
Values Added
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\DisableNotifications: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\DisableNotifications: 0x00000001
Values modified
HKCU\Software\Classes\.exe\shell\open\
command\: ""C:\Documents and Settings\[UserName]\Local Settings\
Application Data\ave.exe" /START "%1" %*"
HKCU\Software\Classes\.exe\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\.exe\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\.exe\DefaultIcon\: "%1"
HKCU\Software\Classes\.exe\: "secfile"
HKCU\Software\Classes\.exe\Content Type: "application/x-msdownload"
HKCU\Software\Classes\secfile\shell\open\
command\: ""C:\Documents and Settings\Administrator\Local Settings\
Application Data\ave.exe" /START "%1" %*"
HKCU\Software\Classes\secfile\shell\open\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\runas\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\: ""%1" %*"
HKCU\Software\Classes\secfile\shell\start\command\IsolatedCommand: ""%1" %*"
HKCU\Software\Classes\secfile\DefaultIcon\: "%1"
HKCU\Software\Classes\secfile\: "Application"
------------------------------------------------------------------------
วิธีกำจัด /แก้ไข : Fake Alert : XP Securiity Tool
------------------------------------------------------------------------
วิธีที่ 1
Download Fix Tool : PeeTechFix-MultipleRogue
------------------------------------------------------------------------
วิธีที่ 2 Manual delete
Download Fix Tool : Fix XP Security Tool
(ExplorerXP.com , RegAssassin.com, Nod32 Recovery Tool)
1. กดปุ่ม Ctrl + Alt +Del เรียก Task Manager แล้ว End Process ไฟล์ ave.exe
2. เปิด ExplorerXP.com จากนั้นเข้าไป delete ไฟล์ตามนี้
C:\Documents and Settings\[UserName]\Local Settings\Application Data\ave.exe
C:\Documents and Settings\[UserName]\Local Settings\Application Data\48531I0
3. เปิด RegAssassin.com โดย Copy key นี้
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\secfile
แล้ว Paste ลงในช่อง จากนั้นกดปุ่ม Delete
4. เปิดโปรแกรม NOD32 Recovery Tool แล้ว Fix now เพื่อ Reset firewall , Security center
5. restart คอมพิวเตอร์
-------------------------------------------------------------------------
หมายเหตุ :
ถ้าไม่ Rename โปรแกรมก่อน เมื่อเรียกไฟล์ .exe ขึ้นมาทำงาน ไฟล์ ave.exe จะถูกเรียกขึ้นมาอีกครั้ง
หลังจากที่ End process ไปแล้ว
และเมื่อไฟล์ ave.exe ถูกลบไปแล้ว เวลาเราเปิดโปรแกรม .exe จะขึ้นหน้าต่างดังภาพ
ถ้า Rename โปรแกรมเป็น .com จะเปิดได้ครับ
และเมื่อเราลบ key > HKCU\Software\Classes\.exe โปรแกรม .exe ต่างๆก็สามารถเปิดได้
ตามปกติครับ
การทำงานของ XP Seciruty Tool ตัวล่าสุดนี้จะเหมือนๆกับ XP Internet Security , Antivirus XP 2010 ครับ
No comments:
Post a Comment