Virus Scanner found the
Exploit-MIME.gen.c (Malicious Mobile Code) virus
Virus Scanner found the
W32/Netsky.p@MM virus
in the attached file: message.scr
This procedure terminates the running malware process from memory. You will need the name(s) of the file(s) detected earlier.
Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file or files detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing during startup.
Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries:
Norton Antivirus AV = "%Windows%\FVProtect.exe"
Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WINNT.
ผมไปดูใน McAfee เกี่ยวกับเจ้าตัวนี้ มันบอกตามข้อความข้างล่างนี้ ตรงข้อความ
Delete the "ICQ Net" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
All Users :
Use specified engine and DAT files (or later) for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file WINLOGON.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
NOTE: Do not delete the file WINLOGON.EXE from the WINDOWS SYSTEM directory as that is a valid Windows system file.
Edit the registry
Delete the "ICQ Net" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
HKEY_CURRENT_USERS\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode
Sniffer Technologies
Sniffer Filters have been developed to filter DNS traffic sent by Netsky.d. Sniffer Filters are available for Sniffer Distributed 4.1/4.2/4.3, Sniffer Portable 4.7/4.7.5, and Netasyst network analyzer. The filters for Netsky.c apply for Netsky.d as well.
W32_Netsky.c@mm Sniffer Filters.zip
McAfee Threatscan
ThreatScan signatures that can detect the W32/Netsky.d@MM virus are available from:
Threatscan 2.5 - ftp.nai.com/pub/security/tsc25/updates/winnt
Threatscan 2.0/2.1 - ftp.nai.com/pub/security/tsc20/updates/winnt
ThreatScan Signature version: 2004-03-01
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
Run the "ThreatScan Template Report"
Look for module number #4066
คิดว่าคุณเจ๋งคงจะลงทะเบียนด้วย ถ้าต้องการรู้ว่า Mcfee up to date หรือไม่ก็ให้คลิกที่ตัว M สีแดง แล้วก็เข้าที่ security center ->virus scan -> up to date, เอ!ทาง Mcfee ส่ง Mail ให้เราทราบทุกครั้งไม่ใช่หรือครับว่ามี ไวรัสตัวใหม่เข้ามา แล้วเขาก็จะบอกให้เรา up date ด้วยครับ
บันทึกไม่สำเร็จ