| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.48 | 2010.01.08 | Trojan-Downloader.Win32.FraudLoad!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.01.07 | - |
| AntiVir | 7.9.1.130 | 2010.01.07 | TR/Dldr.FraudLoad.gie.2 |
| Antiy-AVL | 2.0.3.7 | 2010.01.06 | - |
| Authentium | 5.2.0.5 | 2010.01.07 | - |
| Avast | 4.8.1351.0 | 2010.01.07 | Win32:Rootkit-gen |
| AVG | 8.5.0.430 | 2010.01.04 | - |
| BitDefender | 7.2 | 2010.01.08 | Trojan.FakeAv.ABH |
| CAT-QuickHeal | 10.00 | 2010.01.07 | - |
| ClamAV | 0.94.1 | 2010.01.07 | - |
| Comodo | 3505 | 2010.01.08 | TrojWare.Win32.TrojanDownloader.FraudLoad.~IAA |
| DrWeb | 5.0.1.12222 | 2010.01.07 | - |
| eSafe | 7.0.17.0 | 2010.01.07 | - |
| eTrust-Vet | 35.2.7223 | 2010.01.07 | - |
| F-Prot | 4.5.1.85 | 2010.01.07 | - |
| F-Secure | 9.0.15370.0 | 2010.01.08 | Trojan-Downloader:W32/FraudLoad.JP |
| Fortinet | 4.0.14.0 | 2010.01.07 | W32/FraudLoad.GIE!tr.dldr |
| GData | 19 | 2010.01.07 | Trojan.FakeAv.ABH |
| Ikarus | T3.1.1.80.0 | 2010.01.07 | Trojan-Downloader.Win32.FraudLoad |
| Jiangmin | 13.0.900 | 2010.01.07 | - |
| K7AntiVirus | 7.10.941 | 2010.01.07 | Trojan-Downloader.Win32.FraudLoad.gie |
| Kaspersky | 7.0.0.125 | 2010.01.08 | Trojan-Downloader.Win32.FraudLoad.gie |
| McAfee | 5854 | 2010.01.07 | - |
| McAfee+Artemis | 5854 | 2010.01.07 | - |
| McAfee-GW-Edition | 6.8.5 | 2010.01.08 | Trojan.Dldr.FraudLoad.gie.2 |
| Microsoft | None | 2010.01.07 | - |
| NOD32 | 4752 | 2010.01.07 | Win32/TrojanDownloader.FakeAlert.AED |
| Norman | 6.04.03 | 2010.01.07 | - |
| nProtect | 2009.1.8.0 | 2010.01.07 | - |
| Panda | 10.0.2.2 | 2010.01.07 | Suspicious file |
| PCTools | 7.0.3.5 | 2010.01.08 | - |
| Prevx | 3.0 | 2010.01.08 | High Risk Cloaked Malware |
| Rising | 22.29.03.04 | 2010.01.07 | - |
| Sophos | 4.49.0 | 2010.01.07 | Mal/FakeAV-BT |
| Sunbelt | 3.2.1858.2 | 2010.01.07 | - |
| Symantec | 20091.2.0.41 | 2010.01.08 | - |
| TheHacker | 6.5.0.3.139 | 2010.01.08 | Trojan/Downloader.FraudLoad.gie |
| TrendMicro | 9.120.0.1004 | 2010.01.07 | - |
| VBA32 | 3.12.12.1 | 2010.01.06 | - |
| ViRobot | 2010.1.7.2126 | 2010.01.07 | - |
| VirusBuster | 5.0.21.0 | 2010.01.07 | - |
------------------------------------------------------------------------
smss32.exe , winlogon32.exe
File size 25,600 bytes
MD5: DF2E807765B3FCCDAEDA9095AB3CF4A7
SHA-1: C9CF1643AA9F5008BD897E771C5BCADB93439E9
IS2010.exe
File size 1,334,272 bytes
MD5: 661FAC1767AE78606D649A65163F0726
SHA-1: 1B2B101AA8C9769F7A895DC1F4064597C020CCE9
==================================================
Files Created (Last version)
%System%\smss32.exe
%System%\winlogon32.exe
C:\s
%System%\helper32.dll
%System%\IS15.exe
%System%\41.exe
%System%\19169.exe
%System%\15724.exe
%System%\26500.exe
%System%\6334.exe
%System%\18467.exe
%System%\29358.exe
%System%\11478.exe
%ProgramFilesDir%\InternetSecurity2010\IS2010.exe
%ProgramFilesDir%\Internet Security 2010.lnk
%StartMenuDir%\Start Menu\Internet Security 2010.lnk
%AppDataDir%\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
Keys added
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\90\0\5
HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\1127
HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\1127\Shell
HKCU\Software\IS2010
Values added
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
smss32.exe = "C:\WINDOWS\system32\smss32.exe"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_WS2IFSL\0000\Control\
ActiveService = "WS2IFSL"
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018\
PackedCatalogItem = 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 73 77 73 6F 63 6B 2E 64 6C 6C 00 6B 74 6F 70 5C 61 76 73 64 61 2E 64 6C 6C 00 06 7B 06 00
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019\
PackedCatalogItem = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 68 65 6C 70 65 72 33 32 2E 64 6C 6C 00 00 6B 74 6F 70 5C 61 76 73 64 61 2E 64 6C 6C 00 06 7B 06 00
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WS2IFSL\0000\Control\
ActiveService = "WS2IFSL"
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018\
PackedCatalogItem = 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 73 77 73 6F 63 6B 2E 64 6C 6C 00 6B 74 6F 70 5C 61 76 73 64 61 2E 64 6C 6C 00 06 7B 06 00
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019\
PackedCatalogItem = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 68 65 6C 70 65 72 33 32 2E 64 6C 6C 00 00 6B 74 6F 70 5C 61 76 73 64 61 2E 64 6C 6C 00 06 7B 06 00
HKCU\Software\
8636065b-fef0-4255-b14f-54639f7900a4 = "8636065b-fef0-4255-b14f-54639f7900a4"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Internet Security 2010 = "C:\Program Files\InternetSecurity2010\IS2010.exe"
HKCU\Software\Microsoft\Windows Live\Toolbar\RP\
DR = 'g.ceipmsn.com/8se 61 2 tv0014000080640206|tmen-ww|bmth|ag65'
HKCU\Software\IS2010\
LastVFC = "25"
HKCU\Software\IS2010\
VirList = "54|24|34|48|47|7|24|14|37|37|10|31|31|12|5|8|55|34|44|7|8|5|45|41|30|22"
HKCU\Software\IS2010\LastD: "8"
HKCU\Software\IS2010\LastScan: "08.01.2010 10:28"
Values modified
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Userinit = "C:\WINDOWS\system32\winlogon32.exe"
HKLM\SYSTEM\ControlSet001\Control\ServiceCurrent\ 0x00000012
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
Protocol_Catalog9\Num_Catalog_Entries = 0x00000013
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\
Next_Catalog_Entry_ID = 0x0000040D
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\
Serial_Access_Num = 0x00000012
HKLM\SYSTEM\ControlSet001\Services\WS2IFSL\Start: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Control\ServiceCurrent\: 0x00000012
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\
Num_Catalog_Entries = 0x00000013
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\
Next_Catalog_Entry_ID = 0x0000040D
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\
Serial_Access_Num = 0x00000012
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL\Start = 0x00000001
--------------------------------------------------------------------------
วิธีกำจัด Fake Alert : Internet Security 2010
--------------------------------------------------------------------------
ผม Run ไฟล์ cmd.exe , regedit.exe , chrome.exe , notepad.exe ไม่สามารถเรียกใช้งานได้
ต้อง Rename จึงจะเรียกใช้งานได้ และการเ้ข้า webpage บาง web จะ error
Download freeware for remove or Fix Tool
จะเร็วกว่าการใช้โปรแกรม scan ครับ
or
ตัวอย่างจากการทดสอบด้วย SUPERAntiSpyware
Update New (08/02/2010)
SetupIS2010.exe
Files size 1.53 MB (1,612,288 bytes)
MD5: 20A6AA0334EC0F64295D9A9A08C04B50
SHA-1: BBBFDEABDF695D52CCAEE654C7B63CCE7E65C438
No comments:
Post a Comment