-----------แปลไทยกันเอาเองเด้อ -*- --------------
Disk Knight: a new virus “protection” program
UPDATE:
After having several thousand people visit my blog, obviously because Disk Knight is pissing them off, I thought it might be nice to post some step-by-step instructions on how to rid yourself of this nuisance. Follow these instructions at your own risk.
These instructions courtesy Precise Security:
1. Temporarily Disable USB Drive to autorun (Windows XP):
a. Open Windows Explorer or press the Windows + “e” key.
b. Right-click the drive of the USB Drive. Then select Properties. Drive Properties will appear.
c. Select the AutoPlay tab.
d. Choose Select an Action to Perform
e. At the bottom of the selection, click Take no Action, then click Apply.
f. Click OK to exit Drive Properties.
2. Show Hidden Files
a. Open Windows Explorer
b. Go to Tools > Options
c. On View tab, mark Checked the “Show Hidden Files and Folders and “Hide Protected OPerating System Files” Unchecked.
3. Delete the files manually
a. Go the USB Drive and delete autorun.inf
b. Go to C: Drive and delete autorun.inf
c. Go to C:\Windows and delete Disk Knight.exe
4. Modify Windows Registry
a. Go to Start > Run then type regedit
b. On Registry Editor, go to Edit > Find and type “knight”
c. Delete all entries it found.
5. Connect to Internet and update your AntiVirus
6. Reboot your computer in SafeMode
a. During BootUp process Press F8 continuously until selection appears
b. Use Arrow Up+Down to select SafeMode on the selections menu.
c. Hit Enter to proceed.
7. Scan your computer with an updated AntiVirus and delete all infections it founds.
Note: You may enable autorun of the USB Drive by reversing the process in Step 1.
ข้อมูล
http://www.mikeyleung.ca/2007/08/07/disk-knight/http://www.bleepingcomputer.com/startups/Knight.exe-20407.htmlนี่คือ autorun.inf ของ malware ตัวนี้
[autorun]
open=Knight.exe open
icon=Knight.exe,0
shellexecute=Knight.exe open
shell=auto
action=Disk Knight(Protection Against Mobile Disk Viruses)
shell\auto=&Auto
shell\auto\command=Knight.exe open
shell\open=&Open
shell\open\command=Knight.exe open
shell\explore=E&xplore
shell\explore\command=Knight.exe open
shell\find=S&earch...
shell\find\command=Knight.exe open
shell\install=&Disk Knight
shell\install\command=Knight.exe open
จะเห็นได้ว่าสั่งอะไรมันก็โดน Scrip สั่งให้รัน Knight.exe
วิธีที่ปลอดภัยที่สุด
1. ปิด autorun (ย้ำกันหลายรอบแล้ว)
2. ให้พิมพ์ที่ address bar ด้านบนแทน โดยพิมพ์ [X]: ([X]=ไดร์ฟที่ต้องการเปิด)
รู้สึกว่า Mouse จะกลายเป็นแหล่งแพร่กระจายใหม่แล้วสินะ
