How to remove 9vlgaqms.cmd

How to remove 9vlgaqms.cmd (Win32/PSW.OnlineGame.NNU)
Detect by NOD32


9vlgaqms.cmd

CRC32: 9015B476
MD5: 0692B8168FC76CF9A8B26CBE1467338F
SHA-1: B149B7A22D4E39882B3E2818209D92BABACDDFBC
===================================================
Create file
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\olhrwef.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\nmdfgds0.dll (0-9)
X:\9vlgaqms.cmd
X:\autorun.inf

Delete file
C:\WINDOWS\system32\drivers\cdaudio.sys

Download file
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\am1.rar
Extract file
C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\am1.exe

Keys added
HKLM\SOFTWARE\Classes\CLSID\MADOWN
HKLM\SYSTEM\ControlSet001\Services\AVPsys
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Security
HKLM\SYSTEM\ControlSet001Services\AVPsys\Enum
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Security
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Enum

Values added
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Enum\Count: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Enum\NextInstance: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Enum\INITSTARTFAILED: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Type: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\AVPsys\Start: 0x00000003
HKLM\SYSTEM\ControlSet001\Services\AVPsys\ErrorControl: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\AVPsys\ImagePath: "\??\C:\WINDOWS\system32\drivers\cdaudio.sys"
HKLM\SYSTEM\ControlSet001\Services\AVPsys\DisplayName: "AVPsys"
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Enum\Count: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Enum\NextInstance: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Enum\INITSTARTFAILED: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Start: 0x00000003
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\ImagePath: "\??\C:\WINDOWS\system32\drivers\cdaudio.sys"
HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\DisplayName: "AVPsys"
HKCU\ Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\olhrwef.exe"
Values modified
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKCU\ \Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Hidden: 0x00000002HKCU\ \Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
ShowSuperHidden: 0x00000000
------------------------------------------------------------------------
วิธีกำจัด virus : 9vlgaqms.cmd
------------------------------------------------------------------------
Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGame Version 2.0.3
สามารถตรวจสอบรายชื่อ virus ที่โปรแกรมสามารถ clean ได้ ใน VirusList.txt