kill the hokage virus
One way is wrong in promoting tourism is to make the virus. This
is done by the virus Hokage Killer who use popular names like Bridge
Kahayan id Palangkaraya, Palma is very potential to trigger a war that
ultimately harm the virus Indonesian IT community, especially the IT
community Palangkaraya. It
is clear that the virus makers are young programmers are smart and
great curiosity, but has one big problem that is sorely lacking
maturity and does not care (not conscious) will result of his actions
create and spread the virus can cause harm to other computer users. Ambush ability of the virus can be said to be adequate, but the ability of English was still rich as the name implies, Ambush. If you want a challenge to the Hokage menyamaikan should:Hey, Hokage, This is my place, Want to Start a War?(Hey Hokage, this cave house, would dig up the battle ax?)But perhaps because of too much to learn coding so seldom learn English as well as:Hey, Hokage, Is this My places, Wanna start a war **(Hey Hokage, Is this my house? Want to dig a battle ax?)Hopefully ** shambles virus makers are not issued specific new variant fix grammar errors.For
those of you who frequent the Central Kalimantan, most likely out with
Kahayan Bridge, the bridge which divides Kahajan in Palangkaraya,
Central Kalimantan, Indonesia. This
bridge has a length of 640 meters and 9 meters wide, consists of 12
spans with a special 150-meter span on river cruise line. The
bridge was first built in 1995 and was completed in 2001, and
inaugurated by President Megawati Sukarnoputri on January 13, 2002. Palangkaraya Kahayan bridge connecting with the South Barito districts and counties through the North Barito. So what to do?Having
previously appeared VBWorm.NUJ virus
(http://vaksin.com/2007/1107/moontox-bro.htm), has recently been
discovered a virus modified VM Palangkaraya (possible) can be seen from
the script and the file parent to be in the stretcher by this virus.For
now there are three variants in which for each of these variants have
the same characteristics, the virus is more commonly known by the name
W32/Amburadul.For the first variant detected as W32/Agent.XQXM Norman (54 KB)For the second variant has a name as W32/Agent.ETOR (56 KB)For all three variants have the name as W32/Autorun.CQJ (52 KB)For the fourth variant has a name as W32/Autorun.CIA (51 KB) (see figure 1)
Broadly speaking this virus with most of the local virus spread. Creating
duplicate files, block some windows functions like Regedit / Msconfig /
Search / Folder Option or Task Manager even block particular local
antivirus security software such as PC MAV, junior and ANSAV. He
also will try to kill the virus Hokage/VBWorm.gen16 who both came from
Central Kalimantan Sampit precisely in the area, this can be seen from
an existing script, where the script is trying to block the master file
from virus Hokage / VBWorm. This Gen16.Here are some of the characteristics of the files that will be on stretcher by Ambush and its variants:
*
Icon: Image (JPG)
*
File size: Varies according to the variant (51 KB, 52 KB, 54 KB and 56 KB)
*
File Extension: EXE
*
File Type: Application (see figure 2)
At
the time the virus is active, it will create some master file below
which will run every time the computer is turned on (this file will
also be made in all media including Flash drives Disk)
*
C: \ Windows \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~
o
csrcc.exe
o
smss.exe
o
lsass.exe
o
services.exe
o
winlogon.exe
o
Paraysutki_VM_Community.sys
o
msvbvm60.dll
*
C: \ Autorun.inf
*
C:
\ My Photos xx-x-xxx.exe, where x indicates the date virus proficiency
level in the switch (for example: a picture of me-2008.exe 14-3)
*
C: \ Friendster Community.exe
*
C: \ J3MbataN K4HaYan.exe
*
C: \ MyImages.exe (hidden file)
*
C: \ PaLMa.exe
*
C: \ Images
o
Ce_Pen9God4.exe
o
J34ñNy_Mö3tZ_CuTE.exe
o
M0D3L_P4ray_ 2008.exe
o
Night MinGGuan.exe
o
NonKroNG DJem8ataN K4H4yan.exe
o
Ph0to Ber5ama.exe
o
Picnic dT4ngKilin9.exe
o
King Nge5ex.exe
o
Trend 9aya RAm8ut 2008.exe
*
C: \ Images \ _PAlbTN
o
(V.4.9) _D053n ^ 908L0K.exe
o
~ ~ G0YanG bed. Exe
o
GePaCar4an Neh!. Exe
o
I ... BGT!. Exe
o
To .. N90C0k.exe monitoring view
o
Ma5tURbas1 XL1M4xs.exe
o
PraPtih G4diEs PuJAAnku.exe
o
SmunZa.exe Bali Circuit
What do the Ambush and its variants?Auto start-VirusIn
order for this virus can be activated automatically every time the
computer is on, it will create some strings to the registry berkut:
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ PaRaY_VM
o
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ winlogon.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ ConfigVir
o
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ services.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ NviDiaGT
o
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ lsass.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ NarmonVirusAnti
o
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ smss.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ AVManager
o
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ csrss.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon
o
shell = Explorer.exe,
C: \ WINDOWS \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~ \ winlogon.exeFunction block Windows and security software (Antivirus)To
defend himself he will also conduct a block of some windows functions
such as Task Manager / Regedit / Msconfig / Folder Options / System
Restore or Search, and several other security software which enables to
shorten the life of the virus, with some strings in the registry makes
the following:
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ System
o
EnableLUA = 0
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows NT \ SystemRestore
o
DisableConfig
o
DisableSR
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ Installer
o
DisableMSI
o
LimitSystemRestoreCheckpointing
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msconfig.exe
o
Debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ rstrui.exe
o
Debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ wscript.exe
o
Debugger = crundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mmc.exe
o
Debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Setup.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Instal.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ install.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ procexp.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msiexec.exe
o
Debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ taskmgr.exe
o
Debuger = rundll32.exe
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System
o
DisableRegistryTools
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer
o
NoFind
*
HKEY_CLASSES_ROOT \ exefile
o
NeverShowExt
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ HideFileExt
o
UncheckedValue = 1
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ HideFileExt
o
DefaultValue = 1
*
o
CheckedValue = 0
*
o
DefaultValue = 0
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden
o
UncheckedValue = 0
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden
o
Type = checkbok
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
o
ShowSuperHidden = 0
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
o
SuperHidden = 0
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
o
HideFileExt = 1
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ wscript.exe
o
debugger = rundll32.ex
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ taskkill.exe
o
debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ cmd.exe
o
debugger = rundll32.exe
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ tasklist.exe
o
debugger = rundll32.exe
W32/Agent.EQXM
(and its variants) also will try to block some of the local antivirus
(including the likes amit-amit as the best antivirus in the world) as
PCMAV, junior or ANSAV to create a string in the registry the following:
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-CLN.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-RTP.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Ansav.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kspoold.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kspool.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ boot.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Ansavgd.exe
o
Debuger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ SMP.exe
o
debugger = cmd.exe / c del
To
block the function of Windows and antivirus software in addition to
making the above string in the registry, he will also use the taskkill
command.These applications will be turned off by Agent.EQXM (and variants):taskkill / f / im winamp.exetaskkill / f / im winampa.exetaskkill / f / im firefox.exetaskkill / f / im iexplorer.exetaskkill / f / im wmplayer.exetaskkill / f / im PCMAVtaskkill / f / im CLN.exetaskkill / f / im Ansav.exetaskkill / f / im ansavgd.exetaskkill / f / im explorer.exeEradicate mission HokageShambles
and its variants have a mission to eradicate family Hokage
(VBWorm.Gen16) to block the virus file that can not be executed. This is confirmed by changing the title on the application of Internet Explorer (see the picture below). To do this he will make some string in the registry the following:
*
HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main
o
Window Title = + + + + Hey, Hokage / baboon (Anbu * Team * Sampit), Is this My places, Wanna start a War + + + + (see figure 3)
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ HokageFile.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Rin.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Obito.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KakashiHatake.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ HOKAGE4.exe
o
Debugger = cmd.exe / c del
*
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ HOKAGE4.exe
o
Debugger = cmd.exe / c del
DDos web siteAgent.EQXM
will also try to perform DDos to the number of website addresses which
have been determined by doing a Ping request to the following website:
*
www.duniasex.com
*
www.data0.net
*
www.rasasayang.com.my
Hiding the image fileFiles
that become the target of this virus is an image file (JPG / BMP / PNG
/ TIFF / GIF), but it will only hide the image file in the Flash Disk. To trick the user it will create a duplicate file that has the same name as the file name of the hidden features:
*
Icon JPG
*
The size of the "random" (depending on the variant -> 51 KB / 52 KB / 54 KB / 56 KB)
*
Extension. Xx `. Exe, where xx indicates the extension of the original image file. For example if the original image file has a name data.bmp the virus will create a duplicate file with the name `data.bmp. Exe. (See figure 4)
*
File type "Application"
Every
time hide files, it simply "good heart" will register her logs in file
C: \ Windows \ Amburadul_List.txt, drawing attention to 5 below:
Spread through the Flash DiskTo
spread itself, it will use the media "Flash Disk" or "floppy" to create
multiple master files and multiple file support so that he can be
activated automatically each time the user access to the Flash Disk.
Here are some of the files to be created on the Flash Disk or diskette media:
*
C: \ Autorun.inf
*
C:
\ My Photos xx-x-xxx.exe, where x indicates the date virus proficiency
level in the switch (for example: a picture of me-2008.exe 14-3)
*
C: \ Friendster Community.exe
*
C: \ J3MbataN K4HaYan.exe
*
C: \ MyImages.exe (hidden)
*
C: \ PaLMa.exe
*
C: \ Images
o
Ce_Pen9God4.exe
o
J34ñNy_Mö3tZ_CuTE.exe
o
M0D3L_P4ray_ 2008.exe
o
Night MinGGuan.exe
o
NonKroNG DJem8ataN K4H4yan.exe
o
Ph0to Ber5ama.exe
o
Picnic dT4ngKilin9.exe
o
King Nge5ex.exe
o
Trend 9aya RAm8ut 2008.exe
*
C: \ Images \ _PAlbTN
o
(V.4.9) _D053n ^ 908L0K.exe
o
~ ~ G0YanG bed. Exe
o
GePaCar4an Neh!. Exe
o
I ... BGT!. Exe
o
To .. N90C0k.exe monitoring view
o
Ma5tURbas1 XL1M4xs.exe
o
PraPtih G4diEs PuJAAnku.exe
o
SmunZa.exe Bali Circuit
So
that the virus can be activated automatically each time the user access
or Flash Disk Drive it will use the Windows Autorun feature by creating
autorun.inf file in the root Flash Disk or Drive. This will run the Autorun file MyImage.exe file, where files will be hidden so as not to be easily removed by the user. (See figure 6)
How to Clean W32/Agent.EQXM (and variants)
A.
Disconnect the computer that will be cleared from the network
2.
Turn off the virus active in memory resident. To kill the process using tools "currprocess" (http://www.nirsoft.net/utils/cprocess.zip). Then turn off the virus that has a JPG with extension EXE icon. (See figure 7)
3.
Repair the registry has been changed by W32/Agent.EQXM (and variants). To expedite the repair process please copy the script below on the notepad and save it as repair.inf.
Execute the following ways:
*
Right click repair.inf
*
Click Install
[Version]Signature = "$ Chicago $"Provider = Vaksincom
[DefaultInstall]AddReg = UnhookRegKeyDelReg = del[UnhookRegKey]HKLM, Software \ CLASSES \ batfile \ shell \ open \ command,,, "" "% 1" "% *"HKLM, Software \ CLASSES \ comfile \ shell \ open \ command,,, "" "% 1" "% *"HKLM, Software \ CLASSES \ exefile \ shell \ open \ command,,, "" "% 1" "% *"HKLM, Software \ CLASSES \ piffile \ shell \ open \ command,,, "" "% 1" "% *"HKLM, Software \ CLASSES \ regfile \ shell \ open \ command,,, "regedit.exe"% 1 ""HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command,,, "" "% 1" "% *"HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"HKLM,
SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \
Folder \ HideFileExt, UncheckedValue, 0x00010001, 0HKLM,HKLM,HKLM,
SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \
Folder \ SuperHidden, UncheckedValue, 0x00010001, 1HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden, CheckedValue, 0x00010001, 0HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden, defaultValue, 0x00010001, 0HKCU, Software \ Microsoft \ Internet Explorer \ Main, Start Page, 0, "about: blank"HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ HideFileExt, type, 0, "checkbox"HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden, type, 0, "checkbox"HKCU, Control Panel \ International, s1159, 0, "AM"HKCU, Control Panel \ International, s2359, 0, "PM"HKLM, SYSTEM \ ControlSet001 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"HKLM, SYSTEM \ CurrentControlSet \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, ShowSuperHidden, 0x00010001, 1HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, SuperHidden, 0x00010001, 1HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, HideFileExt, 0x00010001, 0
[Del]HKCU, Software \ Microsoft \ Internet Explorer \ Main, Window TitleHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kspoold.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kspool.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msconfig.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ rstrui.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ wscript.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mmc.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ HokageFile.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Rin.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ cmd.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ SMP.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ taskkill.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ tasklist.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Obito.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KakashiHatake.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-CLN.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-RTP.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ boot.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ HOKAGE4.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAVHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAVHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Ansav.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Setup.exe, debuggerHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Instal.exe, debuggerHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ install.exe, debuggerHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ procexp.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msiexec.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ taskmgr.exeHKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Ansavgd.exeHKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegistryToolsHKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFindHKLM, SOFTWARE \ Policies \ Microsoft \ Windows \ Installer, DisableMSIHKLM, SOFTWARE \ Policies \ Microsoft \ Windows \ Installer, LimitSystemRestoreCheckpointingHKCR, exefile, NeverShowExtHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, PaRaY_VMHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, ConfigVirHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, NviDiaGTHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, NarmonVirusAntiHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, AVManagerHKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, EnableLUAHKLM, SOFTWARE \ Policies \ Microsoft \ Windows NT \ SystemRestore
4.
Disable "System Restore" during the cleanup process
5.
Delete files W32/Agent parent virus. EQXM (and variants). Before deleting file should show hidden files do:
A.
Open Windows Explorer
2.
Click the menu "Tools"
3.
Click "Folder Options"
4.
Click the View Tab
5.
In the "Advanced settings"
*
Select the option "Show hidden files and folders"
*
Unchek "Hide extensions for known file types"
*
Uncheck "Hide protected operating system files (Recommended) (see figure 8)
Then
delete the following files (in all, including Flash Disk Drive except
for the files in the directory C: \ Windows \ system32 \ ~ A ~ m ~ B ~
u ~ R ~ a ~ D ~ u ~ L ~)
*
C: \ Windows \ system32 \ ~ A ~ m ~ B ~ u ~ R ~ a ~ D ~ u ~ L ~
+
csrcc.exe
+
smss.exe
+
lsass.exe
+
services.exe
+
winlogon.exe
+
Paraysutki_VM_Community.sys
+
msvbvm60.dll
*
C: \ Autorun.inf
*
C:
\ My Photos xx-x-xxx.exe, where x indicates the date virus proficiency
level in the switch (for example: a picture of me-2008.exe 14-3)
*
C: \ Friendster Community.exe
*
C: \ J3MbataN K4HaYan.exe
*
C: \ MyImages.exe
*
C: \ PaLMa.exe
*
C: \ Images
6.
Show images that have been disembbunyikan file in Flash Disk in a way:
*
Click "Start" menu
*
Click "Run"
*
Type "CMD"
*
At the Dos Prompt, move the cursor to the location of the Flash Disk and then type the command attrib-s-h / s / d
7.
For optimal cleaning and prevent re-infection with a virus scan is up-to-date and was able to identify this virus as well.
script type="text/javascript">
-