Malware Fighting: How to remove a2xa.exe

"Malware Fix รวมวิธีแก้ปัญหา virus computer โครงการทำดีเพื่อสังคม" "เนื่องจากภาระหน้าที่ทางการงาน ต้องขออภัยผู้เยี่ยมชมทุกท่านนะครับ ที่เ้ข้ามาแล้ว ไม่มีการ update virus ตัวใหม่ นะครับ"

Information

http://malwarefighting.blogspot.com

Click here for more gifs and graphics

แจ้งเตือนภัย ! Crypt0L0cker (Ransomware)
เข้ารหัสข้อมูลใน คอมพิวเตอร์ กำลังระบาดในไทย
และกำลังระบาดหนักในเกาหลี
ThaiCERT , Crytpo Prevention Tool

*ห้ามจ่ายเงินโดยเด็ดขาด เพราะจะเสียทั่้งเงินและกู้ข้อมูลไม่ได้
รบกวนคนที่เข้ามาอ่านช่วยแชร์ด้วยนะครับ
http://hotzone-it.blogspot.com/2015/07/how-to-remove-crypt0l0cker-not.html
==============================================

PeeTechFix >> JupiterFix

==============================================

Download : JupiterFix-Win32.PSW.OnlineGames 2011
(

AVDB-147

)

วิธีใช้งาน : JupiterFix-Win32.PSW.OnlineGames

ท่านสามารถตรวจสอบรายชื่อ Virus ที่โปรแกรม สามารถ Clean ได้ ใน VirusList.txt

-------------------------------------------------------------------------------------
ท่านใดที่ Download PeeTechFix tool ไปใช้แล้วมีปัญหาหรือลบไม่ออก โปรดแจ้งปัญหา ที่ email : MalwareHunter.info@gmail.com ด้วยครับ หรือส่งไฟล์ virus ให้ด้วย จะขอบพระคุณอย่างยิ่ง

-------------------------------------------------------------------------------------

Safemode Recovery (.reg) แก้ปัญหา Virus ลบ Key Safeboot แล้วเข้า safemode ไม่ได้

------------------------------------------------------------------------------------

วิธีแก้ Error message (แก้อาการเปิดไฟล์ .exe ใน USB Drive ไม่ได้)

"Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator"

วิธีแก้ ดูที่ link นี้ครับ

http://hotzone-it.blogspot.com/2010/01/fix-error-peetechfix.html

-------------------------------------------------------------------------------------

วิธีแก้ MSN /Windows Live Messenger Disconnect (จาก virus OnlineGames)

http://hotzone-it.blogspot.com/2010/06/msn-disconect.html

-------------------------------------------------------------------------------------

How to start Windows in Safe Mode

Link1 or Link 2 or Link3

Wednesday

How to remove a2xa.exe

a2xa.exe , cyban.exe

File size: 171520 bytes

MD5 : 3b114efff7e74aa04b42efae4a240bb8

SHA1 : 38390554ecb42a78de90d0e91f28934e19e92f5a

=======================================================

Antivirus	Version	Last Update	Result
a-squared	4.5.0.50	2010.04.13	Worm.Win32.Taterf!IK
AhnLab-V3	5.0.0.2	2010.04.12	Win-Trojan/Onlinegamehack.171520.B
AntiVir	7.10.6.65	2010.04.13	TR/PSW.Magania.dblc
Antiy-AVL	2.0.3.7	2010.04.13	Trojan/Win32.Magania.gen
Authentium	5.2.0.5	2010.04.12	W32/Taterf.B!Generic
Avast	4.8.1351.0	2010.04.12	Win32:Rootkit-gen
Avast5	5.0.332.0	2010.04.12	Win32:Rootkit-gen
AVG	9.0.0.787	2010.04.12	Win32/NSAnti.J
BitDefender	7.2	2010.04.13	Trojan.Generic.3599512
CAT-QuickHeal	10.00	2010.04.13	Worm.AutoRun.bfne
ClamAV	0.96.0.3-git	2010.04.13	PUA.Packed.ASPack
Comodo	4585	2010.04.13	TrojWare.Win32.Trojan.Agent.Gen
DrWeb	5.0.2.03300	2010.04.13	Trojan.PWS.Wsgame.13163
eSafe	7.0.17.0	2010.04.12	Win32.HEURCrypted
eTrust-Vet	35.2.7421	2010.04.12	-
F-Prot	4.5.1.85	2010.04.12	W32/Taterf.B!Generic
F-Secure	9.0.15370.0	2010.04.13	Trojan.Generic.3599512
Fortinet	4.0.14.0	2010.04.12	PossibleThreat
GData	19	2010.04.13	Trojan.Generic.3599512
Ikarus	T3.1.1.80.0	2010.04.13	Worm.Win32.Taterf
Jiangmin	13.0.900	2010.04.13	Trojan/PSW.Magania.ajkc
Kaspersky	7.0.0.125	2010.04.13	Trojan-GameThief.Win32.Magania.dblc
McAfee	5.400.0.1158	2010.04.13	Artemis!3B114EFFF7E7
McAfee-GW-Edition	6.8.5	2010.04.13	Heuristic.LooksLike.Win32.Trojan.C
Microsoft	1.5605	2010.04.13	Worm:Win32/Taterf.B
NOD32	5024	2010.04.13	Win32/PSW.OnLineGames.OUM
Norman	6.04.11	2010.04.12	Malware.MBON
nProtect	2009.1.8.0	2010.04.06	-
Panda	10.0.2.2	2010.04.12	-
PCTools	7.0.3.5	2010.04.13	-
Prevx	3.0	2010.04.13	Medium Risk Malware
Rising	22.43.01.01	2010.04.13	Trojan.Win32.Generic.51FDE5EA
Sophos	4.52.0	2010.04.13	Mal/Generic-L
Sunbelt	6169	2010.04.13	BehavesLike.Win32.Malware (v)
Symantec	20091.2.0.41	2010.04.13	Trojan.Gen
TheHacker	6.5.2.0.259	2010.04.12	Trojan/Magania.dblc
TrendMicro	9.120.0.1004	2010.04.13	-
VBA32	3.12.12.4	2010.04.09	MalwareScope.Worm.Viking.2
ViRobot	2010.4.13.2273	2010.04.13	-
VirusBuster	5.0.27.0	2010.04.12	-

-------------------------------------------------------------------------------

Files Added

%System%\cyban.exe

%System%\ieban0.dll (0-9)

X:\a2xa.exe

X:\autorun.inf

%System% =C:\Windows\system32\

X:\ = C:\ - Z:\

Registry Modifications

Key Added

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\Programmable

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Browser Helper Objects\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

Values Added

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID\

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32\

(Default) = "%System%\ieban0.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib\

(Default) = "{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}]

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32\

(Default) = "%System%\ieban0.dll"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR\

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS\

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\

(Default) = "IEHelper 1.0 Type Library"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID]

(Default) = "{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\

cybansos = "%System%\cyban.exe"

Values modified

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ Folder\Hidden\SHOWALL\CheckedValue: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\Hidden: 0x00000002

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ShowSuperHidden: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDriveTypeAutoRun: 0x00000091

Remote Host

202.111.175.157 port 80

URLs to be download/data identified

http://www.googlew65.com/1hg/ah1.rar

=======================================================

วิธีกำจัด/แก้ virus : a2xa.exe , cyban.exe

=======================================================

Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGames

------------------------------------------------------------------------------

หลังจากกำจัด virus ได้แล้ว แนะนำให้ติดตั้งโปรแกรมเพิ่มเติม เพื่อป้องกันการเรียกใช้ autorun

เช่น

Program Advice (Stop AutoRun)

NoAutoRun (.REG)

http://www.mediafire.com/?ammmxwhqmnm

Panda USB Vaccine

http://www.mediafire.com/download.php?qig0nmnm4ld

KB971029, KB967715

http://hotzone-it.blogspot.com/2009/08/kb971029-fix-autorun-microsoft.html

CPE17 AutoRun Killer

http://www.mediafire.com/download.php?hxoyjj0hyfh

Malware Fighting

Menu

Information

Wednesday

How to remove a2xa.exe

No comments:

Post a Comment

Exploit-DB updates

Exploits Database by Offensive Security

Metasploit

Metasploit Framework: Activity

iDefense Labs Software Releases

Popular Posts

Online Scan

Multi AV Scan malware