รวมไฟล์ Virus ตระกูล OnlineGame

สำหรับเจ้า virus ตระกูล OnlineGame มีออกมาอยู่เรื่อย แก้กันจนงงไปหมด ไม่รู้ตัวไหนเป็นตัวไหน
หลายท่านแก้แล้วทำไม่สำเร็จ เพราะบางที ชื่อไฟล์ตัวเดียวกันแต่ทำงานไม่เหมือนกัน
ตัวอย่างเช่น ไฟล์ olhrwef.exe หรือ nmdfgds0.dll แต่ Antivirus ตรวจจับได้หลายชื่อ
เช่น Win32/PSW.OnlineGame.NNU, Win32/Pacex.Gen เป็นต้น
ต้องเปรียบเทียบด้วยค่า MD5 หรือ SHA1
Download fix tool
http://hotzone-it.blogspot.com/2009/08/virus-remove-tool.html

รายชื่อพวก OnlineGame ที่ฝังอยู่ในระบบ
[%WINDOWS%]\karna.dat
[%SYSTEM%]\System.exe
[%WINDOWS%]\xccdf16_090131a.dll
[%WINDOWS%]\SYSTEM\xccef090131.exe
[%SYSTEM%]\inf\xccdfb16_090131.dll
[%SYSTEM%]\ckvo0.dll
[%SYSTEM%]\nmdfgds0.dll
[%SYSTEM%]\nmdfgds1.dll
[%SYSTEM%]\kav320.dll
[%SYSTEM%]\08223B03.dll
[%SYSTEM%]\ed78ab9.dll
[%SYSTEM%]\skcfujQ5EDN.dll
[%SYSTEM_DRIVE%]\xih9.cmd
[%SYSTEM_DRIVE%]\icxpa.cmd
[%SYSTEM%]\CDuAUVkGy9.dll
[%FONTS%]\uXUsF2RrQy.fon
[%FONTS%]\Qq3qg7RGSp9raxWW.Ttf
[%SYSTEM%]\uret463.exe
[%SYSTEM_DRIVE%]\pjwtv.cmd
[%SYSTEM%]\nmdfgds2.dll
[%SYSTEM%]\JBn2ypqY23vWX.dll
[%SYSTEM%]\dfc8ac3ed7da.dll
[%SYSTEM%]\9CA963CA.cfg
[%SYSTEM%]\e863f72a04b6.dll
[%FONTS%]\eCgMhGRkPUcdutd0.Ttf
[%SYSTEM%]\cRsAQd4hw.dll
[%WINDOWS%]\MKMKrnl.dll
[%WINDOWS%]\MPKrnl.dll
[%WINDOWS%]\MSVB50CHS.dll
[%SYSTEM%]\ndxq9awMc.dll
[%FONTS%]\fyrwJf5Qfhh.fon
[%SYSTEM_DRIVE%]\2nuk.com
[%SYSTEM%]\JPccCJnKygDdp3.dll
[%SYSTEM%]\kSVHjMeWr5ZZY47.dll
[%SYSTEM%]\Va7SpUWgCA5f.dll
[%FONTS%]\bzMtuqTck9.fon
[%FONTS%]\MqppW9KYn.fon
[%FONTS%]\VBw9ZHsJt3M8tVgF.fon
[%PROFILE_TEMP%]\olhrwef.exe
[%SYSTEM_DRIVE%]\3j2h0tf.bat
[%SYSTEM%]\kavo.exe
[%SYSTEM%]\kavo1.dll
[%SYSTEM_DRIVE%]\m0vnonh.bat
[%SYSTEM%]\gasretyw0.dll
[%SYSTEM_DRIVE%]\0bcobed.exe
[%SYSTEM_DRIVE%]\1ogf.exe
[%SYSTEM_DRIVE%]\ej10fkdo.bat
[%SYSTEM_DRIVE%]\vwewav8.com
[%SYSTEM%]\optyhww0.dll
[%SYSTEM%]\urretnd.exe
[%SYSTEM_DRIVE%]\dbrxubcw.com
[%SYSTEM_DRIVE%]\2fiy.bat
[%SYSTEM_DRIVE%]\a1agmur.cmd
[%SYSTEM_DRIVE%]\i6g6x.cmd
[%SYSTEM_DRIVE%]\uhoxajc.cmd
[%SYSTEM%]\mkfght0.dll
[%SYSTEM_DRIVE%]\opgde.exe
[%SYSTEM_DRIVE%]\cqxj.exe
[%SYSTEM%]\mkfght1.dll
[%SYSTEM_DRIVE%]\2fiji.com
[%SYSTEM%]\dncyool64.sys
[%SYSTEM_DRIVE%]\d1vmq.exe
[%SYSTEM%]\avpo.exe
[%SYSTEM_DRIVE%]\gi2ky.exe
[%SYSTEM_DRIVE%]\q9.cmd
[%SYSTEM_DRIVE%]\9dlvtiil.exe
[%SYSTEM_DRIVE%]\jj2.com
[%SYSTEM_DRIVE%]\8gig0ofk.com
[%SYSTEM_DRIVE%]\6phx.com
[%PROFILE_TEMP%]\1185859833mxx.dll
[%SYSTEM_DRIVE%]\ix8bmwx.bat
[%SYSTEM%]\kavo2.dll
[%PROFILE_TEMP%]\662048064355mxx.dll
[%SYSTEM%]\122B901E.dll
[%SYSTEM%]\xg4hAPNygs29.dll
[%SYSTEM%]\704C3595.dll
[%SYSTEM%]\76B9BA7A.dll
[%SYSTEM%]\A0C86020.dll
[%SYSTEM%]\dhDhwS7fFW.dll
[%SYSTEM%]\taNjsFa2tT2Dh.dll
[%FONTS%]\tY5UFS434YYd.fon
[%SYSTEM%]\E4814792.dll
[%FONTS%]\MbsV2QQJe.fon
[%SYSTEM%]\2EF0D734.dll
[%FONTS%]\vwuXtYbhj.fon
[%SYSTEM%]\qB5BKZy7vR5m.dll
[%SYSTEM%]\GU6f5sW42mdc.dll
[%SYSTEM%]\RhdwE8NYdbqQ.dll
[%SYSTEM%]\GsfMwDWD3.dll
[%FONTS%]\zAPWgSjGrSpdsE4.fon
[%FONTS%]\xbpCfXnG6wUVF.fon
[%FONTS%]\d1PmeEeTVx.fon
[%FONTS%]\wQ7KbaNZKMe5G4qZ.fon
[%SYSTEM_DRIVE%]\uvsqfgwd.cmd
[%SYSTEM%]\VnTU2WAqUcZA6.dll
[%FONTS%]\CESPVP8FQd.fon
[%SYSTEM_DRIVE%]\sys32krnl.exe
[%SYSTEM_DRIVE%]\syswin.exe
[%SYSTEM_DRIVE%]\b.com
[%SYSTEM%]\QsbvDcwq7umu.dll

------------------------------------------------------------------------------------------------

Registry ที่พวก OnlineGane ไปแก้ไข เพิ่มค่า ลบค่า ต่างๆ
HKEY_CLASSES_ROOT\AppID\{B5BB60EE-125B-40AB-AAA5-A4E194973C95}HKEY_CLASSES_ROOT\AppID\FirstBHO.DLLHKEY_CLASSES_ROOT\FirstBHO.HelloWorldBHOHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54ebd53a-9bc1-480b-966a-843a333ca162}HKEY_CLASSES_ROOT\CLSID\{54ebd53a-9bc1-480b-966a-843a333ca162}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{54ebd53a-9bc1-480b-966a-843a333ca162}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{af4da69b-e1d6-469a-855b-6445294857d4}HKEY_CLASSES_ROOT\CLSID\{af4da69b-e1d6-469a-855b-6445294857d4}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{af4da69b-e1d6-469a-855b-6445294857d4}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnsfHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zftpHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32HKEY_CLASSES_ROOT\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}HKEY_CLASSES_ROOT\CLSID\{F0930A2F-D971-4828-8209-B7DFD266ED44}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{489873ce-f3e1-44a3-8e89-04be26be4446}HKEY_CLASSES_ROOT\CLSID\{489873ce-f3e1-44a3-8e89-04be26be4446}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{489873ce-f3e1-44a3-8e89-04be26be4446}HKEY_CLASSES_ROOT\XY2.gzxy2atl.1HKEY_CLASSES_ROOT\XY2.gzxy2atlHKEY_CLASSES_ROOT\CQWZ.ASDCQWZ.1HKEY_CLASSES_ROOT\CQWZ.ASDCQWZHKEY_CLASSES_ROOT\JH.jhatl.1HKEY_CLASSES_ROOT\JH.jhatlHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7c8d1401-a58d-a81c-cd24-a5915c4517c7}HKEY_CLASSES_ROOT\CLSID\{7c8d1401-a58d-a81c-cd24-a5915c4517c7}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7c8d1401-a58d-a81c-cd24-a5915c4517c7}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37ac9076-c898-b098-d098-a18319080973}HKEY_CLASSES_ROOT\CLSID\{37ac9076-c898-b098-d098-a18319080973}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{37ac9076-c898-b098-d098-a18319080973}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8ad0f1b1-990d-4f52-a33d-2837e43cef58}HKEY_CLASSES_ROOT\CLSID\{8ad0f1b1-990d-4f52-a33d-2837e43cef58}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8ad0f1b1-990d-4f52-a33d-2837e43cef58}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TxplatformHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Txp_sysHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296ab8c6-fb22-4d17-8834-064e2ba0a6f0}HKEY_CLASSES_ROOT\CLSID\{296ab8c6-fb22-4d17-8834-064e2ba0a6f0}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{296ab8c6-fb22-4d17-8834-064e2ba0a6f0}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3d10ba6d-fd37-4cbc-a5e7-95cd4b043399}HKEY_CLASSES_ROOT\CLSID\{3d10ba6d-fd37-4cbc-a5e7-95cd4b043399}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d10ba6d-fd37-4cbc-a5e7-95cd4b043399}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dcf49866-8f81-4f5f-8193-7ec75a2ab321}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{dcf49866-8f81-4f5f-8193-7ec75a2ab321}HKEY_CLASSES_ROOT\CQSJ.gzcsatl.1HKEY_CLASSES_ROOT\CQSJ.gzcsatlHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50940f85-f015-14f1-a05f-f69858ac6d05}HKEY_CLASSES_ROOT\CLSID\{50940f85-f015-14f1-a05f-f69858ac6d05}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{50940f85-f015-14f1-a05f-f69858ac6d05}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35671234-7890-abcd-cdef-567801237653}HKEY_CLASSES_ROOT\CLSID\{35671234-7890-abcd-cdef-567801237653}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{35671234-7890-abcd-cdef-567801237653}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7319a1f1-9410-9654-3201-345ffa349137}HKEY_CLASSES_ROOT\CLSID\{7319a1f1-9410-9654-3201-345ffa349137}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7319a1f1-9410-9654-3201-345ffa349137}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55694105-5108-9405-3695-954187462155}HKEY_CLASSES_ROOT\CLSID\{55694105-5108-9405-3695-954187462155}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55694105-5108-9405-3695-954187462155}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25fd6584-698f-bcd2-602c-698745210352}HKEY_CLASSES_ROOT\CLSID\{25fd6584-698f-bcd2-602c-698745210352}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25fd6584-698f-bcd2-602c-698745210352}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b490415f-65f8-b5c5-d8ba-9405fb12054b}HKEY_CLASSES_ROOT\CLSID\{b490415f-65f8-b5c5-d8ba-9405fb12054b}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b490415f-65f8-b5c5-d8ba-9405fb12054b}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aa59145f-315d-bc23-ac1f-145df81a34aa}HKEY_CLASSES_ROOT\CLSID\{aa59145f-315d-bc23-ac1f-145df81a34aa}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{aa59145f-315d-bc23-ac1f-145df81a34aa}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80af1289-f140-a140-d012-c1458759fc08}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{80af1289-f140-a140-d012-c1458759fc08}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87fd640a-158f-48ac-fd14-1597f14a9778}HKEY_CLASSES_ROOT\CLSID\{87fd640a-158f-48ac-fd14-1597f14a9778}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87fd640a-158f-48ac-fd14-1597f14a9778}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5d098345-6785-1098-5413-678067ae03d5}HKEY_CLASSES_ROOT\CLSID\{5d098345-6785-1098-5413-678067ae03d5}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5d098345-6785-1098-5413-678067ae03d5}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20909876-4567-3908-4056-909834565102}HKEY_CLASSES_ROOT\CLSID\{20909876-4567-3908-4056-909834565102}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{20909876-4567-3908-4056-909834565102}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1a698452-c5d8-c584-c256-c264c987c5a1}HKEY_CLASSES_ROOT\CLSID\{1a698452-c5d8-c584-c256-c264c987c5a1}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a698452-c5d8-c584-c256-c264c987c5a1}HKEY_CLASSES_ROOT\CLSID\{80af1289-f140-a140-d012-c1458759fc08}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2626e66-d21b-e628-c1df-1daccfa36ed2}HKEY_CLASSES_ROOT\CLSID\{c2626e66-d21b-e628-c1df-1daccfa36ed2}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2626e66-d21b-e628-c1df-1daccfa36ed2}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83ba45af-faaa-cddd-beee-bcde1234ab38}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ba45af-faaa-cddd-beee-bcde1234ab38}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc8975eb-dd3e-406a-8df9-218848c3b594}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{bc8975eb-dd3e-406a-8df9-218848c3b594}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08cbfe20-8dc8-4195-b8e2-dd66f860469d}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{08cbfe20-8dc8-4195-b8e2-dd66f860469d}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54f6a1f0-18cd-4a8e-b08b-6a5203aade30}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{54f6a1f0-18cd-4a8e-b08b-6a5203aade30}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4372FE4D-E2C2-45FE-A893-E2B1691A7DD0}HKEY_CLASSES_ROOT\CLSID\{4372FE4D-E2C2-45FE-A893-E2B1691A7DD0}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4372fe4d-e2c2-45fe-a893-e2b1691a7dd0}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09eb15fa-17d8-4d60-8598-3f549a848df2}HKEY_CLASSES_ROOT\CLSID\{09eb15fa-17d8-4d60-8598-3f549a848df2}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{09eb15fa-17d8-4d60-8598-3f549a848df2}HKEY_CLASSES_ROOT\CLSID\{dcf49866-8f81-4f5f-8193-7ec75a2ab321}HKEY_CLASSES_ROOT\CLSID\{08cbfe20-8dc8-4195-b8e2-dd66f860469d}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a698452-c5d8-c584-c256-c264c987c5a2}

ที่มา : http://www.exterminate-it.com/malpedia/remove-onlinegames
ใครจะลอง Download โปรแกรมของเขา ไป Scan ดูก็ได้ครับ แต่ลบไม่ได้นะครับ ต้อง Register ถึงจะลบได้
โปรแกรมตรวจสอบได้หลายๆตัวทีเดียว