ไฟล์ที่ใ้ช้ทดสอบ : CRACK.FontExpert-2009-10.0.45100.exe
----------------------------------------------------------------------
sfd.exe
153 KB (156,672 bytes)
MD5: 7AB8D214866E7F3389CA94526D9B6330
SHA-1: A3651E43BF6390DD276E72848A06437EF003CCDD
Sfb.exe
215 KB (220,672 bytes)
MD5: 4F74B040B0D5D98AE3018293FAE794C2
SHA-1: 7584AACA1CF7ED88827A4788A71A3B73529E9868
Sfc.exe
148 KB (152,064 bytes)
MD5: D77AFF0EDB85F7F56D2962A4DFEA9DA4
SHA-1: 3C316C8BDD0AFD776E7C3AFD77FDB30A19769072
msa.exe
148 KB (152,064 bytes)
MD5: D77AFF0EDB85F7F56D2962A4DFEA9DA4
SHA-1: 3C316C8BDD0AFD776E7C3AFD77FDB30A19769072
======================================================
| a-squared | 4.5.0.50 | 2010.02.24 | - |
| AhnLab-V3 | 5.0.0.2 | 2010.02.24 | - |
| AntiVir | 8.2.1.172 | 2010.02.23 | - |
| Antiy-AVL | 2.0.3.7 | 2010.02.24 | - |
| Authentium | 5.2.0.5 | 2010.02.24 | - |
| Avast | 4.8.1351.0 | 2010.02.23 | - |
| AVG | 9.0.0.730 | 2010.02.24 | - |
| BitDefender | 7.2 | 2010.02.24 | - |
| CAT-QuickHeal | 10.00 | 2010.02.24 | - |
| ClamAV | 0.96.0.0-git | 2010.02.24 | - |
| Comodo | 4043 | 2010.02.24 | - |
| DrWeb | 5.0.1.12222 | 2010.02.24 | - |
| eSafe | 7.0.17.0 | 2010.02.23 | - |
| eTrust-Vet | 35.2.7323 | 2010.02.23 | - |
| F-Prot | 4.5.1.85 | 2010.02.23 | - |
| F-Secure | 9.0.15370.0 | 2010.02.24 | - |
| Fortinet | 4.0.14.0 | 2010.02.21 | - |
| GData | 19 | 2010.02.24 | - |
| Ikarus | T3.1.1.80.0 | 2010.02.24 | - |
| Jiangmin | 13.0.900 | 2010.02.23 | - |
| K7AntiVirus | 7.10.981 | 2010.02.23 | - |
| Kaspersky | 7.0.0.125 | 2010.02.24 | Packed.Win32.Krap.as |
| McAfee | 5901 | 2010.02.23 | FakeAlert-MA.gen |
| McAfee+Artemis | 5901 | 2010.02.23 | FakeAlert-MA.gen |
| McAfee-GW-Edition | 6.8.5 | 2010.02.23 | - |
| Microsoft | 1.5406 | 2010.02.23 | TrojanDownloader:Win32/Renos.KO |
| NOD32 | 4892 | 2010.02.24 | Win32/Kryptik.CQA (Last update) |
| Norman | 6.04.08 | 2010.02.23 | - |
| nProtect | 2009.1.8.0 | 2010.02.24 | - |
| Panda | 10.0.2.2 | 2010.02.23 | Suspicious file |
| PCTools | 7.0.3.5 | 2010.02.23 | - |
| Prevx | 3.0 | 2010.02.24 | Medium Risk Malware Dropper |
| Rising | 22.34.01.03 | 2010.02.11 | - |
| Sophos | 4.50.0 | 2010.02.24 | Mal/FakeAV-CO |
| Sunbelt | 5696 | 2010.02.24 | - |
| Symantec | 20091.2.0.41 | 2010.02.24 | Suspicious.Insight |
| TheHacker | 6.5.1.6.208 | 2010.02.24 | Trojan/FakeAV.gen |
| TrendMicro | 9.120.0.1004 | 2010.02.24 | - |
| VBA32 | 3.12.12.2 | 2010.02.23 | - |
| ViRobot | 2010.2.23.2198 | 2010.02.23 | - |
| VirusBuster | 5.0.27.0 | 2010.02.24 | - |
-------------------------------------------------------------------------------
Files Created
%Temp%\Sfc.exe
%Temp%\Sfd.exe
%Temp%\Sfb..bat
%WinDir%\msa.exe
%system%\sshnas21.dll
%Temp% = C:\Documents and Settings\[UserName]\Local Settings\Temp\
%WinDir% = C:\Windows\
%System% = C:\Windows\System32\
Registry Modifications
Keys added
HKCU\Software\ROUA3O12PW
HKCU\Software\TOY5KNQ8OC
HKCU\Software\XML
Values added
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
TOY5KNQ8OC : "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Sfd.exe"
HKCU\Software\TOY5KNQ8OC\
Sk2: "xC7aKZ+O6wyPlq1krRM4sG7m2LFGsYtHjHOagBf10Ek/n4gL8s8xs9LeD5KQVh3/j+XFbG3/8Bu5aiMqJVRVcQF7oop6V/nqCjgd83M9F4qOfs643eYxlxdOozwYgVD/95cSbnPGmAgVyQBmtbRWERa5lEWedN4LRl+dUrJAIwPZUYH14pK+/NJlrNxLjI/AC20YeKmx9tVrtKj7YuOVesbvrfIg/JPmwh4/6oQ0njTnXpebMGbAyeY="
HKCU\Software\TOY5KNQ8OC\
Sk0: "tSLPLpWL7R22spR48AI743bz2Kge8sERzUagpDG5iARkissz9o4nudbCQ6mwH0e/kK6NSCO54Qy7IAEUAlgbIyQrrJFeRretC3pBtTwLfL3BUK2YmKdwy0wP+mREmBu3qeV4TyHp6lc/8xIj6ehCR1T2ygeXbopFSi+wcuZzVX7WA8yjo9XhuJU5/pNqmcfKB2V7Y7qn2tZwrqT3eKKXPIf9sbxy38uNoUF1xYIsnQ3hFA=="
HKCU\Software\TOY5KNQ8OC\
Sk1: "tSbFNJuL/h22spR48AI743bz2Kge8sEeyVi7rDe7ghMhx8cxtMM6rsHIXa/qBkChgvGQSnOomXTeInlsZ1oGJTxl/soFQ//uV2wIsDIefbzBT+aPj6cx11ELryRfxAfh1NNeBib3uHpWiFcm77lAS0ithBveOJURRz6rY+ZxCjaQEduyrdTmo4559JNpxYvGGmwxY6z6xdJ15uLtZODZWf39sa5lx53p30M="
HKCU\Software\TOY5KNQ8OC\Sb4: 0x00015180
HKCU\Software\TOY5KNQ8OC\Sb5: 0x00000002
HKCU\Software\TOY5KNQ8OC\Sb2: 0x01CAB5F3
HKCU\Software\TOY5KNQ8OC\Sb3: 0x468EE250
HKCU\Software\TOY5KNQ8OC\Sb6: 0x00000001
HKCU\Software\TOY5KNQ8OC\Sb0: 0x01CAB52C
HKCU\Software\TOY5KNQ8OC\Sb1: 0x5FCF2580
---------------------------------------------------------------
วิธีกำจัด/แก้ : sfd.exe , sfb.exe , sfc.exe , msa.exe
---------------------------------------------------------------
วิีธีที่ 1 Download Fix Tool : PeeTechFix-SSHNAS21 version 1.3.00
---------------------------------------------------------------
วิธีที่ 2 Manual delete
1. กด Ctrl+Alt+Del แล้ว เลือก End Process ไฟล์ sfd.exe , msa.exe
2. Click ที่ Start > Run พิมพ์ %temp% แล้ว Enter
3. Delete ไฟล์ sfd.exe , sfb.exe , sfc.exe , msa.exe
4. Delete ไฟล์ sshnas21.dll ใน C:\WINDOWS\system32\sshnas21.dll
5. เปิด Hijack This แล้ว Fix Checked ที่บรรทัดนี้
O4 - HKCU\..\Run: [TOY5KNQ8OC] %Temp%\Sfd.exe
6. Click ที่ Start > Run พิมพ์ regedit.exe แล้ว Enter แล้ว Delete Key ตามนี้
HKCU\Software\ROUA3O12PW
HKCU\Software\TOY5KNQ8OC
HKCU\Software\XML
HKCU = HKEY_CURRENT_USER
No comments:
Post a Comment