How to remove koking.exe

Koking.exe

MD5: E611669B05EAAA676A8BBDDF8D16619C

SHA-1: 79E914B574D4172B8056A2DA4F11D998CC702E23

...

Files Added

%System%\hgking.exe

%System%\koking.exe

%System%\hgking0.dll (0-9)

%System%\koking0.dll (o-9)

%System%\koie0.dll

%System%\kingie0.dll

X:\khd.exe

X:\autorun.inf

%System%= C:\Windows\System32 , C:\Winnt\System32\

X:\ = C:\- Z:\

Registry Modifications

Keys Added

HKLM\SOFTWARE\Classes\CLSID\MNDOWN

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\ProgID

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\Programmable

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}

Values Added

HKLM\SOFTWARE\Classes\CLSID\MNDOWN

urlinfo = "chddet.w"

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\VersionIndependentProgID

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\ProgID

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}\InprocServer32

(Default) = "%System%\koie0.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\TypeLib

(Default) = "{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\ProxyStubClsid32

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}\ProxyStubClsid

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\{20FDDC65-28D4-4FC4-AC6B-6EBEB9417B64}]

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\0\win32

(Default) = "%System%\koie0.dll"

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\HELPDIR

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0\FLAGS

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\{20FDDC2B-28D4-4FC4-AC6B-6EBEB9417B64}\1.0

(Default) = "IEHelper 1.0 Type Library"

HKLM\SOFTWARE\Classes\TypeLib\{5DA7432B-6725-4ADE-BF17-C328743011FD}\1.0\0\win32]

(Default) = "%System%\kingie0.dll"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj]

(Default) = "IEHlprObj Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

(Default) = "{20FDDC64-28D4-4FC4-AC6B-6EBEB9417B64}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

King_ko = "%System%\koking.exe"

King_hg = "%System%\hgking.exe"

...

Effect : MSN /Windows live messenger error and disconnect

http://hotzone-it.blogspot.com/2010/06/msn-disconect.html

=======================================================

วิธีกำจัด/แก้ virus : Koking.exe

=======================================================

Download Fix Tool :

JupiterFix-Win32.PSW.OnlineGames

หมายเหตุ : ท่านใดที่ได้รับผลกระทบจากไวรัสตัวนี้ โืดย MSN จะ Error และ Disconnect

ก็ลองเอาไปแก้ดูนะครับ

------------------------------------------------------------------------------

หลังจากกำจัด virus ได้แล้ว แนะนำให้ติดตั้งโปรแกรมเพิ่มเติม เพื่อป้องกันการเรียกใช้ autorun

เช่น

Program Advice (Stop AutoRun function/autorun.inf)

Microsoft path : Fix autorun function

http://support.microsoft.com/kb/967715

or

Panda USB Vaccine

http://www.pandasecurity.com/homeusers/downloads/usbvaccine/

or

NoAutoRun (.REG)

http://www.mediafire.com/?ammmxwhqmnm