ไฟล์ที่ใช้ทดสอบ : install.exe
75564734.exe (Fake alert : Security Tool)
0.98 MB (1,036,288 bytes)
MD5: D01BD3194A5D1AB2E9555491709A2680
SHA-1: D2DD65157D59B3D9F216B64332DBBFBBC8F4B977
=======================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.02.24 | Trojan.Win32.Winwebsec!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.02.24 | - |
| AntiVir | 8.2.1.172 | 2010.02.24 | Worm/Koobface.ffw |
| Antiy-AVL | 2.0.3.7 | 2010.02.24 | - |
| Authentium | 5.2.0.5 | 2010.02.24 | - |
| Avast | 4.8.1351.0 | 2010.02.24 | Win32:Trojan-gen |
| Avast5 | 5.0.332.0 | 2010.02.24 | Win32:Trojan-gen |
| AVG | 9.0.0.730 | 2010.02.24 | FakeAlert.PM |
| BitDefender | 7.2 | 2010.02.24 | Gen:Heur.Krypt.4 |
| CAT-QuickHeal | 10.00 | 2010.02.24 | - |
| ClamAV | 0.96.0.0-git | 2010.02.24 | - |
| Comodo | 4048 | 2010.02.24 | - |
| DrWeb | 5.0.1.12222 | 2010.02.24 | - |
| eSafe | 7.0.17.0 | 2010.02.24 | - |
| eTrust-Vet | 35.2.7326 | 2010.02.24 | Win32/Fraud!packed |
| F-Prot | 4.5.1.85 | 2010.02.23 | - |
| F-Secure | 9.0.15370.0 | 2010.02.24 | Trojan:W32/FraudPack.BS |
| Fortinet | 4.0.14.0 | 2010.02.21 | - |
| GData | 19 | 2010.02.24 | Gen:Heur.Krypt.4 |
| Ikarus | T3.1.1.80.0 | 2010.02.24 | Trojan.Win32.Winwebsec |
| Jiangmin | 13.0.900 | 2010.02.24 | - |
| K7AntiVirus | 7.10.981 | 2010.02.23 | - |
| Kaspersky | 7.0.0.125 | 2010.02.24 | Packed.Win32.Krap.ai |
| McAfee | 5901 | 2010.02.23 | FakeAlert-LX |
| McAfee+Artemis | 5901 | 2010.02.23 | FakeAlert-LX |
| McAfee-GW-Edition | 6.8.5 | 2010.02.24 | Worm.Koobface.ffw |
| Microsoft | 1.5406 | 2010.02.24 | Trojan:Win32/Winwebsec |
| NOD32 | 4892 | 2010.02.24 | a variant of Win32/Kryptik.CNA |
| Norman | 6.04.08 | 2010.02.24 | - |
| nProtect | 2009.1.8.0 | 2010.02.24 | - |
| Panda | 10.0.2.2 | 2010.02.23 | Suspicious file |
| PCTools | 7.0.3.5 | 2010.02.24 | Trojan.FakeAV |
| Rising | 22.34.01.03 | 2010.02.11 | - |
| Sophos | 4.50.0 | 2010.02.24 | Mal/FakeVirPk-A |
| Sunbelt | 5696 | 2010.02.24 | Trojan.Win32.Winwebsec.Gen (v) |
| Symantec | 20091.2.0.41 | 2010.02.24 | Trojan.FakeAV!gen13 |
| TheHacker | 6.5.1.6.208 | 2010.02.24 | Trojan/Krap.ai |
| TrendMicro | 9.120.0.1004 | 2010.02.24 | Mal_Krap-9 |
| VBA32 | 3.12.12.2 | 2010.02.24 | - |
| ViRobot | 2010.2.24.2200 | 2010.02.24 | - |
| VirusBuster | 5.0.27.0 | 2010.02.24 | Trojan.WinWebSec.Gen!Pac.5 |
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
วิธีกำจัด/แก้ไข : 75564734.exe (Fake alert : Security Tool)
------------------------------------------------------------------------
1. กดปุ่ม Ctrl + Alt+Del แล้ว เลือก End process ไฟล์ 75564734.exe
2. เปิดโปรแกรม ExplorerXP
แล้วเข้าไป Delete folder ชื่อ 75564734 ที่อยู่ใน
C:\Documents and Settings\All Users\Application Data\75564734\
3. ไปที่ Start > Program แล้ว Delete Security Tool (shortcut)
4. ใช้ HijackThis fix checked ที่
O4 - HKLM\..\Run: [75564734] C:\DOCUME~1\ALLUSE~1\APPLIC~1\75564734\75564734.exe
5. click ที่ Satrt > Run >พิมพ์ Regedit.exe
แล้วไป Delete Key HKLM\SOFTWARE\75564734
No comments:
Post a Comment