How to remove 300y.cmd

300y.cmd , kavo.exe

Files size 122,961 bytes

MD5: 0B84167B5767D61D39969ABCE5D581745

SHA-1: 5A998F224223590A736E7A6756FAF56C560F6CE0

=================================================

Files Created

%System%\kavo.exe

%System%\cvsdfw.exe

%System%\kavo0.dll (0-9)

%System%\otrewe0.dll (0-9)

%Windir%\tt.exe

%Temp%\ker1.tmp

%Temp%\ker2.tmp

%Temp%\ker3.tmp

%Temp%\ker4.tmp

X:\300y.cmd

X:\autorun.inf

%Temp% = C:\Documents and Settings\[UserName]\Local Settings\Temp\

%System% =C:\Windows\system32\

%Windir% = C:\Windows\

X:\ = C:\ - Z:\

Registry Modifications

Key Added

HKLM\SOFTWARE\Classes\CLSID\MADOWN

Values Added

HKLM\SOFTWARE\Classes\CLSID\MADOWN\urlinfo = "a5dvgt.n"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

kava = "%System%\kavo.exe"

anhtaas = "%System%\cvsdfw.exe"

Values modified

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ Folder\Hidden\SHOWALL\CheckedValue = "0"

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\Hidden = "2"

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ShowSuperHidden = "0"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDriveTypeAutoRun = "91"

Remote Host

221.1.222.109 port 80

URLs to be download/data identified

hxxp://adeui.com/jj/cc.rar

hxxp://ngfres.com/jj/cc.exe

hxxp://ngfres.com/jj/ff.rar

=======================================================

วิธีกำจัด/แก้ virus : 300y.cmd, kavo.exe

=======================================================

Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGame 2.0.5