I - Mô tả:
Khi chúng tấn công vào máy phát tán lây nhiễm các đuôi và có file như sau:

• %Windir%\WindowsUpdata1.jpg
• %System%\c_30218.nls
• %System%\cryptcom.dll
• %System%\wowsub.sys
• %Temp%\ReInstall.exe
• C:\DelInfo.bin

III - Cách diệt:
Trước khi thao tác tắt chức năng System Restore (Windows Me/XP).

1. Vào Start > Run.
2. Gõ regedit
3. Click OK.
4. Tìm và xóa các file trong Registry như sau:

• HKEY_USERS\.default\Software\Microsoft\Internet Connection Wizard\"ShellNext" = "http://tj.nba1001.net:7777/tj/mac.html"

      5. Phục hồi lại hệ thống Registry sau:

• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AppMgmt\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\BITS\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\FastUserSwitchingCompatibility\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\WmdmPmSN\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\xmlprov\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\EventSystem\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Ntmssvc\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\upnphost\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\SSDPSRV\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Netman\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Nla\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Tapisrv\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Browser\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Themes\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\CryptSvc\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\helpsvc\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\RemoteRegistry\"Start" = 3
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Schedule\"Start" = 3
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhudongfangyu.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qutmserv.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kswebshield.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krnl360svc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UfSeAgnt.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmProxy.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SfCtlCom.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpfSrv.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcods.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcagent.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McProxy.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McNASvc.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360speedld.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe\"Debugger" = "ntsd -d"
• HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SoftMgrSvc.exe\"Debugger" = "ntsd -d"

      6. Và Subkey sau:

• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\SafeBoot\

      7. Loại bỏ tất cả các tập tin nghuy hiểm trong thư mục Host

• Windows 95/98/Me:
  %Windir%
• Windows NT/2000/XP:
  %Windir%\System32\drivers\etc
• Sau đó nhấp đôi chuột vào thư mục host
• Edit thư mục này trong Notepad và xoa bỏ hết đường linki nghuy hiểm của nó
• Sau đó lưu lại, hoặc chép file host từ máy an toàn hơn và bỏ mục cụ

      7. Thoát khỏi registry