Pe Devirusare.com am mai vorbit acum ceva timp ce este un program rogue si cat de daunator este.
Ca sa explic in 2 cuvinte pentru cei ce nu au rabdare sa citeasca, un program rogue este un antivirus/antispyware fals.
Imprumuta interfata si functii asemanatoare cu produsele originale ca sa pacaleasca utilizatorul sa plateasca o licenta.
Softul este un malware, care se instaleaza pe PC de pe diferite pagini(are sute de mirrors – site-uri identice cu originalul, doar pe alte domenii) si incepe sa trimita mesaje conform carora computerul este infectat si trebuie cumparata “licenta” pentru curatarea acestuia.
Bun, dupa acest malware au aparut sute de programe asemanatoare, companiile antivirus/antispyware facand cu greu fata zecilor de versiuni pe zi.
Este si greu de adaugat o detectie generica(o singura definitie pentru o familie de malware de acelasi tip).
Americanii au botezat acest fenomen scareware.
In continuare o sa prezint 2 metode de indepartare a programului AntivirusBest din PC:
1. Metoda manuala:
Stergeti urmatoarele fisiere din PC:
c:\Documents and Settings\All Users\Application Data\AB
c:\Documents and Settings\All Users\Application Data\AB\ABEST.CAB
c:\Documents and Settings\All Users\Application Data\AB\abest.exe
c:\Documents and Settings\All Users\Application Data\AB\Installer.exe
c:\Documents and Settings\All Users\Application Data\AB\QWProtect.dll
c:\Documents and Settings\All Users\Application Data\AB\svchost.exe
c:\Documents and Settings\All Users\Desktop\AntivirusBEST.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\AntivirusBEST
c:\Documents and Settings\All Users\Start Menu\Programs\AntivirusBEST\AntivirusBEST.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\AntivirusBEST\Uninstall.lnk
Stergeti urmatoarele chei de registry:
HKEY_CURRENT_USER\Software\ABEST\ABEST
HKEY_CLASSES_ROOT\AppID\{296A8A7F-B5AC-4789-9B33-F32C2F9A6ABD}
HKEY_CLASSES_ROOT\AppID\QWProtect.DLL
HKEY_CLASSES_ROOT\CLSID\{44B2C9F5-608D-46de-82E1-26C5BCB85193}
HKEY_CLASSES_ROOT\Interface\{296A8A7F-B5AC-4789-9B33-F32C2F9A6ABD}
HKEY_CLASSES_ROOT\QWProtect.QWProtectBHO
HKEY_CLASSES_ROOT\QWProtect.QWProtectBHO.1
HKEY_CLASSES_ROOT\TypeLib\{684A7904-2593-4BBE-A90E-CDAF2AC606AE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44B2C9F5-608D-46de-82E1-26C5BCB85193}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “AntivirusBEST”
Bifati si apasati Fix checked in Hijackthis 2.0.2 pentru:
O1 – Hosts: 70.38.19.201 www.review.2009softwarereviews.com
O1 – Hosts: 70.38.19.201 review.2009softwarereviews.com
O1 – Hosts: 70.38.19.201 a1.review.zdnet.com
O1 – Hosts: 70.38.19.201 www.d1.reviews.cnet.com
O1 – Hosts: 70.38.19.201 www.reviews.toptenreviews.com
O1 – Hosts: 70.38.19.201 reviews.toptenreviews.com
O1 – Hosts: 70.38.19.201 www.reviews.download.com
O1 – Hosts: 70.38.19.201 reviews.download.com
O1 – Hosts: 70.38.19.201 www.reviews.pcadvisor.c.uk
O1 – Hosts: 70.38.19.201 reviews.pcadvisor.co.uk
O1 – Hosts: 70.38.19.201 www.reviews.pcmag.com
O1 – Hosts: 70.38.19.201 reviews.pcmag.com
O1 – Hosts: 70.38.19.201 www.reviews.pcpro.co.uk
O1 – Hosts: 70.38.19.201 reviews.pcpro.co.uk
O1 – Hosts: 70.38.19.201 www.reviews.reevoo.com
O1 – Hosts: 70.38.19.201 reviews.reevoo.com
O1 – Hosts: 70.38.19.201 www.reviews.riverstreams.co.uk
O1 – Hosts: 70.38.19.201 reviews.riverstreams.co.uk
O1 – Hosts: 70.38.19.201 www.reviews.techradar.com
O1 – Hosts: 70.38.19.201 reviews.techradar.com
O1 – Hosts: 70.38.19.201 d1.reviews.cnet.com
O2 – BHO: QWProtectBHO – {44B2C9F5-608D-46de-82E1-26C5BCB85193} – C:\Documents and Settings\All Users\Application Data\AB\QWProtect.dll
O4 – HKLM\..\Run: [AntivirusBEST] C:\Documents and Settings\All Users\Application Data\AB\Installer.exe
O4 – HKLM\..\Run: [AntivirusBEST] C:\Documents and Settings\All Users\Application Data\AB\abest.exe
Dupa cum vedeti, cheile si fisierele au nume random, uneori aceasta metoda este dificila.
2. Metoda automata:
Descarcati Malwarebytes’ Anti-Malware:
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
si salvati-l pe Desktop.
In unele cazuri, nu puteti accesa site-ul Malwarebytes pentru a descarca programul.
Folositi mirror-ul pus la dispozitie de Softpedia:
http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml
Redenumiti kit-ul in test.exe sau ceva.exe si instalati-l.
La sfarsitul instalarii asigurati-va ca ati bifat urmatoarele: Update Malwarebytes’ Anti-Malware si Launch Malwarebytes’ Anti-Malware. Apoi apasati Finish.
Daca nu se poate conecta la internet pentru a descarca cele mai noi definitii, faceti un update offline:
Malwarebytes’ Anti-Malware Update Offline
Dupa lansarea programului, selectati Perform full scan si apoi apasati pe Scan.
La terminarea scanarii apasati OK si apoi Show Results. Asigurati-va ca e totul bifat si apoi apasati Remove Selected.
Restart PC.
