How to remove a2g21.exe

a2g21.exe , mwfubaob.exe

files size 111,826 bytes

MD5: 317DD28F342E0941347BDEE1FF384F42

SHA-1: 81282F8E16A7E47E76B56CCFD627262BF7855DEB

==================================================

a-squared 2009-11-03 -

AhnLab 2009-11-03 -

AntiVir 2009-11-03 TR/Crypt.ZPACK.Gen

Antiy 2009-11-02 -

Arcavir 2009 2009-11-03 Trojan.Gamethief.Magania.Clfv

Authentium 2009-11-02 -

AVAST! 2009-11-03 Win32:Rootkit-gen [Rtk]

AVG 2009-11-03 Win32/Heur

BitDefender 2009-11-03 -

CA (VET) 2009-11-02 -

ClamAV 2009-11-03 -

Comodo 2009-11-03 -

CP Secure 2009-10-30 -

Dr.Web 2009-11-03 Trojan.PWS.Wsgame.12661

F-Prot 2009-11-02 -

F-Secure 2009-11-03 Trojan-GameThief.Win32.Magania.clfv [AVP]

Fortinet 2009-11-03 -

GData 2009-11-03 -

Ikarus 2009-11-03 Worm.Win32.Taterf

JiangMin 2009-11-02 -

Kaspersky 2009-11-03 Trojan-GameThief.Win32.Magania.clfv

KingSoft 2009-11-03 -

McAfee 2009-11-02 Generic PWS.ak

Microsoft 2009.11.03 -

Norman 2009-11-03 OnLineGames.KGCC

nProtect 2009-11-03 -

Panda 2009-11-02 -

Quick Heal 2009-11-03 -

Rising 2009-11-03 -

Sophos 2009-11-03 Mal/EncPk-JS

Sunbelt 2009-11-02 -

Symantec 2009-10-31 -

The Hacker 2009-11-02 -

Trend Micro 2009-11-03 -

VBA32 2009-11-02 -

ViRobot 2009-11-03 -

VirusBuster 2009-11-02 -

-------------------------------------------------------------------------

Files created

C:\Documents and Settings\Administrator\Local Settings\Temp\herss.exe

C:\Documents and Settings\Administrator\Local Settings\Temp\cvasds0.dll (0-9)

X:\a2g21.exe

X:\mwfubaob.exe

X:\autorun.inf

(X:\ = C:\ - Z:\)

Registry Modifications

Key Added

HKLM\SOFTWARE\Classes\CLSID\MADOWN

Values Added

HKLM\SOFTWARE\Classes\CLSID\MADOWN\urlinfo :"dsa2whj.a"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\

cdoosoft = "%Temp%\herss.exe"

Values modified

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ Folder\Hidden\SHOWALL\CheckedValue: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\Hidden: 0x00000002

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ShowSuperHidden: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDriveTypeAutoRun: 0x00000091

Remote Host

218.59.144.140 port 80

URLs to be download / data identified

http://www.sinaj29.com/1mg/am1.rar

http://www.sinaj29.com/1mg/am.ra

=======================================================

วิธีกำจัด/แก้ virus : a2g21.exe , mwfubaob.exe

Add in AVDB-011 (New virus : 05/11/2009 )

=======================================================

Download : PeeTechFix-Win32/PSW.OnlineGame 2.0.5