How to remove w9uxx92.exe

Update 28/09/2009 : แก้ไขค่า CRC32, MD5, SHA1
w9uxx92.exe ผมได้จากการทดสอบ Run ไฟล์ cahpcg.cmd ไปได้สักพักหนึ่ง
CRC32: 594A2ED4
MD5: 620094AF6DC5D97A0E7AC47519914E63
SHA1: FEC46DAAEBDC3EA4B35ACF59F1D60422126EAB25
==============================================
Aliases:
a-squared 4.5.0.24 2009.09.24 Worm.Win32.Taterf!IK
AhnLab-V3 5.0.0.2 2009.09.24 -
AntiVir 7.9.1.25 2009.09.24 TR/Vundo.Gen
Antiy-AVL 2.0.3.7 2009.09.24 -
Authentium 5.1.2.4 2009.09.24 -
Avast 4.8.1351.0 2009.09.23 -
AVG 8.5.0.412 2009.09.24 Win32/Heur
BitDefender 7.2 2009.09.24 -
CAT-QuickHeal 10.00 2009.09.24 -
ClamAV 0.94.1 2009.09.24 -
Comodo 2424 2009.09.24 -
DrWeb 5.0.0.12182 2009.09.24 -
eSafe 7.0.17.0 2009.09.24 Suspicious File
eTrust-Vet 31.6.6758 2009.09.24 -
F-Prot 4.5.1.85 2009.09.23 -
F-Secure 8.0.14470.0 2009.09.24 -
Fortinet 3.120.0.0 2009.09.24 -
GData 19 2009.09.24 -
Ikarus T3.1.1.72.0 2009.09.24 Worm.Win32.Taterf
Jiangmin 11.0.800 2009.09.24 -
K7AntiVirus 7.10.853 2009.09.24 -
Kaspersky 7.0.0.125 2009.09.24 -
McAfee 5750 2009.09.23 -
McAfee+Artemis 5750 2009.09.23 Suspect-29!E74911601ABE
McAfee-GW-Edition 6.8.5 2009.09.24 Heuristic.LooksLike.Win32.Trojan.B
Microsoft 1.5005 2009.09.23 -
NOD32 4454 2009.09.24 -
Norman 6.01.09 2009.09.24 OnLineGames.KGCC
nProtect 2009.1.8.0 2009.09.24 -
Panda 10.0.2.2 2009.09.23 Suspicious file
PCTools 4.4.2.0 2009.09.24 -
Prevx 3.0 2009.09.24 Medium Risk Malware
Rising 21.48.34.00 2009.09.24 Packer.Win32.Agent.GEN
Sophos 4.45.0 2009.09.24 -
Sunbelt 3.2.1858.2 2009.09.24 Worm.Win32.AutoRun
Symantec 1.4.4.12 2009.09.24 -
TheHacker 6.5.0.2.016 2009.09.24 -
TrendMicro 8.950.0.1094 2009.09.24 -
VBA32 3.12.10.11 2009.09.24 Malware-Cryptor.Win32.Emo.2
ViRobot 2009.9.24.1952 2009.09.24 -
VirusBuster 4.6.5.0 2009.09.23 -
---------------------------------------------------------------------------
Create files
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\herss.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\cvasds0.dll (0-9)
X:\w9uxx92.exe
X:\autorun.inf

URL to be downloaded
http://aas52.com/1mg/am1.rar > %Temp%\am1.rar > am1.exe

Registy Modified
Keys added
HKLM\SOFTWARE\Classes\CLSID\MADOWN

Values added
HKLM\SOFTWARE\Classes\CLSID\MADOWN\urlinfo: "dsa2der.f"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
cdoosoft: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\herss.exe"

Values modified
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Hidden: 0x00000002
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
ShowSuperHidden: 0x00000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
NoDriveTypeAutoRun: 0x00000091
-------------------------------------------------------------------------
วิธีกำจัด virus : w9uxx92.exe
-------------------------------------------------------------------------
Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGame Version 2.0.4