yfmqo.cmd , j3ewro.exe
Files size 113,120 bytes
MD5: 50BA96569FFE859BFF780E1FB9305148
SHA-1: C2DA0D0AB9899AFDA8DBD71AC92A71E99961A359
================================================
Files Created
%System%\j3ewro.exe
%System%\jwedsfdo0.dll (0-9)
X:\yfmqo.cmd
X:\autorun.inf
%System% =C:\Windows\system32\
X:\ = C:\ - Z:\
Registry Modifications
Key Added
HKLM\SOFTWARE\Classes\CLSID\MADOWN
Values Added
HKLM\SOFTWARE\Classes\CLSID\MADOWN\urlinfo = "eftsdr.h"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
jvsoft = "%System%\j3ewro.exe"
Values modified
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\ Folder\Hidden\SHOWALL\CheckedValue = "0"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\Hidden = "2"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\ShowSuperHidden = "0"
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
NoDriveTypeAutoRun = "91"
Remote Host
221.1.222.109 port 80
URLs to be download/data identified
http://csj0o.com/xjj/cc1.rar
http://iytgfvcxs.com/xjj/cc.rar
=======================================================
วิธีกำจัด/แก้ virus : yfmqo.cmd , j3ewro.exe
=======================================================
Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGame 2.0.5
ไม่มีความคิดเห็น:
แสดงความคิดเห็น