How to remove b0ykd.exe

b0ykd.exe , cyban.exe

File size 180,315 bytes

MD5: 0x37873CB9D368F911B4B938D869814F6B

SHA-1: 0x67C835EE6218BA4DE6B27D9CC57B8D8D56DF3111

===================================================

Files Added

%System%\cyban.exe

%System%\cyban0.dll (0-9)

%System%\ieban0.dll (0-9)

X:\b0ykd.exe

X:\autorun.inf

%System% = C:\Winnt\System32

X:\ = C:\ - Z:\

Registry Modifications

Keys Added

HKLM\Classes\CLSID\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\Programmable

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\TypeLib\{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0

HKLM\SOFTWARE\Classes\TypeLib\{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Browser Helper Objects\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

Values Added

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID\

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32\

(Default) = "%System%\ieban1.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib\

(Default) = "{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32\

(Default) = "%System%\ieban1.dll"

HKLM\SOFTWARE\Classes\TypeLib\{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR\

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS\

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\

(Default) = "IEHelper 1.0 Type Library"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\

(Default) = "{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1]

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run]

cybansos = "%System%\cyban.exe"

Values modified

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ Folder\Hidden\SHOWALL\CheckedValue = 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\Hidden = 0x00000002

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ShowSuperHidden = 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDriveTypeAutoRun: 0x00000091

=======================================================

วิธีกำจัด/แก้ไข virus : b0ykd.exe , cyban.exe

=======================================================

Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGames

หลังจากกำจัด virus ได้แล้ว แนะนำให้ติดตั้งโปรแกรมเพิ่มเติม เพื่อป้องกันการเรียกใช้ autorun

เช่น

Program Advice

NoAutoRun (.REG)

http://www.mediafire.com/?ammmxwhqmnm

or

Panda USB Vaccine

http://www.mediafire.com/download.php?qig0nmnm4ld

or

KB971029, KB967715 (Disable AutoRun)

http://hotzone-it.blogspot.com/2009/08/kb971029-fix-autorun-microsoft.html

or

CPE17 AutoRun Killer

http://www.mediafire.com/download.php?hxoyjj0hyfh