How to remove FCO0zxc.exe

FCO0zxc.exe

MD5 : ae9525756191032f15db120e642322db

SHA1 : 3a140d223f4d0095c58b19f9a3716857a9997ca3

...

Antivirus	Version	Last Update	Result
AhnLab-V3	2010.12.16.04	2010.12.16	-
AntiVir	7.11.0.73	2010.12.16	TR/Crypt.ASPM.Gen
Antiy-AVL	2.0.3.7	2010.12.17	-
Avast	4.8.1351.0	2010.12.16	Win32:OnLineGames-FUX
Avast5	5.0.677.0	2010.12.16	Win32:OnLineGames-FUX
AVG	9.0.0.851	2010.12.17	Win32/NSAnti.J
BitDefender	7.2	2010.12.17	-
CAT-QuickHeal	11.00	2010.12.16	-
ClamAV	0.96.4.0	2010.12.16	PUA.Packed.ASPack
Command	5.2.11.5	2010.12.16	-
Comodo	7088	2010.12.17	-
DrWeb	5.0.2.03300	2010.12.17	-
Emsisoft	5.1.0.1	2010.12.16	Trojan-GameThief.Win32.Taworm!IK
eSafe	7.0.17.0	2010.12.16	-
eTrust-Vet	36.1.8046	2010.12.16	-
F-Prot	4.6.2.117	2010.12.16	-
F-Secure	9.0.16160.0	2010.12.17	-
Fortinet	4.2.254.0	2010.12.16	-
GData	21	2010.12.17	Win32:OnLineGames-FUX
Ikarus	T3.1.1.90.0	2010.12.16	Trojan-GameThief.Win32.Taworm
Jiangmin	13.0.900	2010.12.16	-
K7AntiVirus	9.73.3267	2010.12.16	-
Kaspersky	7.0.0.125	2010.12.17	-
McAfee	5.400.0.1158	2010.12.17	-
McAfee-GW-Edition	2010.1C	2010.12.16	-
Microsoft	1.6402	2010.12.16	Worm:Win32/Taterf.B
NOD32	5709	2010.12.16	a variant of Win32/PSW.OnLineGames.QMA
Norman	6.06.12	2010.12.16	-
nProtect	2010-12-16.01	2010.12.16	-
Panda	10.0.2.7	2010.12.16	Trj/CI.A
PeeTechFix	2.0.7.136	2010.12.17	Win32.PSW.OnLineGames.zxc
Prevx	3.0	2010.12.17	-
Rising	22.78.03.05	2010.12.16	-
Sophos	4.60.0	2010.12.17	Mal/Generic-L
SUPERAntiSpyware	4.40.0.1006	2010.12.17	-
Symantec	20101.3.0.103	2010.12.16	-
TheHacker	6.7.0.1.101	2010.12.15	-
TrendMicro	9.120.0.1004	2010.12.16	-
TrendMicro-HouseCall	9.120.0.1004	2010.12.17	-
VBA32	3.12.14.2	2010.12.16	BScope.Trojan-Dropper.Inject
VIPRE	7682	2010.12.17	BehavesLike.Win32.Malware.bse (vs)
ViRobot	2010.12.16.4204	2010.12.16	-
VirusBuster	13.6.98.1	2010.12.16	-

...

Files Added

%System%\FCO0szxc10.dll

%System%\FCO0szxc11.dll

%System%\FCO0szxc20.dll

%System%\FCO0zxc.exe

%UserProfile%\Microsoft\BFV3smx4pnp.dll

Keys Added

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\Programmable

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

Values Added

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID]

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32

(Default) = "%System%\FCO0szxc20.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib

(Default) = "{94AC7948-7BE1-4FB9-A7CA-67CD88362758}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32

(Default) = "%System%\FCO0szxc20.dll"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0

(Default) = "IEHelper 1.0 Type Library"

HKLME\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

(Default) = "{94AC7942-7BE1-4FB9-A7CA-67CD88362758}"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

FV3smx4pnp = "rundll32.exe "%UserProfile%\Microsoft\FV3smx4pnp.dll", Launch"

FCO0sos = "%System%\FCO0zxc.exe"

Effect : MSN /Windows live messenger error and disconnect

http://hotzone-it.blogspot.com/2010/06/msn-disconect.html

=======================================================

วิธีกำจัด/แก้ virus : FCO0zxc.exe

=======================================================

Download Fix Tool :

JupiterFix-Win32.PSW.OnlineGames

หมายเหตุ : ท่านใดที่ได้รับผลกระทบจากไวรัสตัวนี้ โืดย MSN จะ Error และ Disconnect

ก็ลองเอาไปแก้ดูนะครับ

------------------------------------------------------------------------------

หลังจากกำจัด virus ได้แล้ว แนะนำให้ติดตั้งโปรแกรมเพิ่มเติม เพื่อป้องกันการเรียกใช้ autorun

เช่น

Program Advice (Stop AutoRun function/autorun.inf)

Microsoft path : Fix autorun function

http://support.microsoft.com/kb/967715

or

Panda USB Vaccine

http://www.pandasecurity.com/homeusers/downloads/usbvaccine/

or

NoAutoRun (.REG)

http://www.mediafire.com/?ammmxwhqmnm