How to remove V3zxc.exe

V3zxc.exe

MD5 : 8eb711f737925d6072140a8e89f96bb0

SHA1 : cc921af2d1d819cd0086d15569807264fde029f5

...

Antivirus	Version	Last Update	Result
AhnLab-V3	2010.11.18.01	2010.11.18	-
AntiVir	7.10.14.36	2010.11.18	TR/Crypt.ASPM.Gen2
Antiy-AVL	2.0.3.7	2010.11.18	-
Avast	4.8.1351.0	2010.11.18	-
Avast5	5.0.594.0	2010.11.18	-
AVG	9.0.0.851	2010.11.18	Win32/NSAnti.J
BitDefender	7.2	2010.11.18	-
CAT-QuickHeal	11.00	2010.11.09	-
ClamAV	0.96.4.0	2010.11.18	PUA.Packed.ASPack
Command	5.2.11.5	2010.11.18	-
Comodo	6759	2010.11.18	-
DrWeb	5.0.2.03300	2010.11.18	-
Emsisoft	5.0.0.50	2010.11.18	Trojan-PWS.OnlineGames3!IK
eSafe	7.0.17.0	2010.11.16	-
eTrust-Vet	36.1.7984	2010.11.18	-
F-Prot	4.6.2.117	2010.11.18	-
F-Secure	9.0.16160.0	2010.11.18	-
Fortinet	4.2.254.0	2010.11.18	-
GData	21	2010.11.18	-
Ikarus	T3.1.1.90.0	2010.11.18	Trojan-PWS.OnlineGames3
Jiangmin	13.0.900	2010.11.18	-
K7AntiVirus	9.68.3011	2010.11.17	-
Kaspersky	7.0.0.125	2010.11.18	-
McAfee	5.400.0.1158	2010.11.18	-
McAfee-GW-Edition	2010.1C	2010.11.18	-
Microsoft	1.6402	2010.11.18	Worm:Win32/Taterf.B
NOD32	5629	2010.11.18	a variant of Win32/Kryptik.IAQ
Norman	6.06.10	2010.11.18	W32/Taterf.AD
nProtect	2010-11-18.02	2010.11.18	-
Panda	10.0.2.7	2010.11.17	Suspicious file
PeeTechFix	2.o.7.132	2010.11.18	Win32.PSW.OnlineGames.zxc
Prevx	3.0	2010.11.18	-
Rising	22.74.03.05	2010.11.18	-
Sophos	4.59.0	2010.11.18	-
SUPERAntiSpyware	4.40.0.1006	2010.11.18	-
Symantec	20101.2.0.161	2010.11.18	-
TheHacker	6.7.0.1.086	2010.11.18	-
TrendMicro	9.120.0.1004	2010.11.18	Cryp_OLGM-41
TrendMicro-HouseCall	9.120.0.1004	2010.11.18	Cryp_OLGM-41
VBA32	3.12.14.2	2010.11.18	BScope.Trojan-Dropper.Inject
VIPRE	7341	2010.11.18	BehavesLike.Win32.Malware.bse (vs)
ViRobot	2010.11.18.4155	2010.11.18	-
VirusBuster	13.6.47.1	2010.11.18	-

...

Files Added

%System%\V3szxc10.dll

%System%\V3szxc11.dll

%System%\V3szxc20.dll

%System%\V3zxc.exe

%System%= C:\Windows\System32 , C:\Winnt\System32\

Registry Modifications

Keys added

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID

HKLMSOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

Values Added

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32

(Default) = "%System%\V3szxc20.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib

(Default) = "{94AC7948-7BE1-4FB9-A7CA-67CD88362758}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32

(Default) = "%System%\V3szxc20.dll"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0

(Default) = "IEHelper 1.0 Type Library"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

(Default) = "{94AC7942-7BE1-4FB9-A7CA-67CD88362758}"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1]

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft

Update = "sky17.in"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

V3sos = "%System%\V3zxc.exe"

Effect : MSN /Windows live messenger error and disconnect

http://hotzone-it.blogspot.com/2010/06/msn-disconect.html

AppName: wlcomm.exe ModName: v3szxc10.dll

=======================================================

วิธีกำจัด/แก้ virus : V3zxc.exe

=======================================================

Download Fix Tool :

PeeTechFix-Win32.PSW.OnlineGames

--------------------------------------------------------------------------------------------------

หลังจากกำจัด virus ได้แล้ว แนะนำให้ติดตั้งโปรแกรมเพิ่มเติม เพื่อป้องกันการเรียกใช้ autorun

เช่น

Program Advice (Stop AutoRun function/autorun.inf)

Microsoft path : Fix autorun function

http://support.microsoft.com/kb/967715

or

Panda USB Vaccine

http://www.pandasecurity.com/homeusers/downloads/usbvaccine/

or

NoAutoRun (.REG)

http://www.mediafire.com/?ammmxwhqmnm