Nel caso di infezione ecco quali sono i messaggi mostrati continuamente come popus :
- "Critical System Error",
- "Your computer is infected",
Guida alla rimozione di AntivirusTrigger.
(Sconsiglio vivamente questa strada agli inesperti , meglio l'installazione di un antispyware )
1) Fermare i processi (sulla barra di stato , tasto destro , Task manager ...) :
AvirTr.exe, browseu.exe, hpmom.exe, hpmon.exe, hpmun.exe, qttask.exe, qttaskm.exe, qttasku.exe
2) Disinstallare AntivirusTrigger :
Start > Impostazioni > Pannello di controllo > Aggiungi/rimuovi programmi :
Cerca e , nel caso , disinstalla AntivirusTrigger.
3) Cercare e rimuovere le chiavi di registro : (Start/esegui/regedit)
HKEY_CURRENT_USER\Software\AvirTrsoft
HKEY_CURRENT_USER\Software\AvirTrsoft\Update
HKEY_CLASSES_ROOT\AvirTrWarning.WarningBHO
HKEY_CLASSES_ROOT\AvirTrWarning.WarningBHO.1
HKEY_CLASSES_ROOT\CLSID\{22C447D3-73A8-E1C7-C391-21BE4338CEBC}
HKEY_CLASSES_ROOT\CLSID\{3A267370-076E-4af4-B986-77626B8E89DF}
HKEY_CLASSES_ROOT\Interface\{764BC8B4-1159-4736-8AF1-F124A7C8C3A8}
HKEY_CLASSES_ROOT\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}
HKEY_CLASSES_ROOT\TypeLib\{3ED86073-2FA7-4CF4-810B-28B030671678}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvirTrsoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A267370-076E-4af4-B986-77626B8E89DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AvirTrsoft
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AvirTr”
HKEY_CLASSES_ROOT\webmedia.chl
HKEY_CLASSES_ROOT\z444.z444mgr
HKEY_CLASSES_ROOT\z444.z444mgr.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer add-on
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “wblogon”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusTriggerBin “(Default)”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler “{e0feeb92-908e-46d2-8a66-88c5295f2629}”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run “QuickTime Task”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run “VMware hptray”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser “ITBar7Layout”
4) Cercare e rimuovere le directory ed i files :HKEY_CURRENT_USER\Software\AvirTrsoft\Update
HKEY_CLASSES_ROOT\AvirTrWarning.WarningBHO
HKEY_CLASSES_ROOT\AvirTrWarning.WarningBHO.1
HKEY_CLASSES_ROOT\CLSID\{22C447D3-73A8-E1C7-C391-21BE4338CEBC}
HKEY_CLASSES_ROOT\CLSID\{3A267370-076E-4af4-B986-77626B8E89DF}
HKEY_CLASSES_ROOT\Interface\{764BC8B4-1159-4736-8AF1-F124A7C8C3A8}
HKEY_CLASSES_ROOT\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}
HKEY_CLASSES_ROOT\TypeLib\{3ED86073-2FA7-4CF4-810B-28B030671678}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvirTrsoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A267370-076E-4af4-B986-77626B8E89DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AvirTrsoft
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AvirTr”
HKEY_CLASSES_ROOT\webmedia.chl
HKEY_CLASSES_ROOT\z444.z444mgr
HKEY_CLASSES_ROOT\z444.z444mgr.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer add-on
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “wblogon”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusTriggerBin “(Default)”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler “{e0feeb92-908e-46d2-8a66-88c5295f2629}”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run “QuickTime Task”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run “VMware hptray”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser “ITBar7Layout”
Impostare Strumenti/opzioni cartella/visualizzazione - Visualizza cartelle e file nascosti.
Ricordate che %UserProfile% sta per c:\Documents and Settings\nome utente ...
Controllare sia "Program Files" che "Programmi"
c:\Program Files\AvirTrsoftware (tutta la cartella)
c:\Program Files\WebMediaViewer (tutta la cartella)
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusTrigger 2.1.lnk
%UserProfile%\Desktop\AntivirusTrigger 2.1.lnk
%UserProfile%\Start Menu\AntivirusTrigger 2.1.lnk
%UserProfile%\Start Menu\Programs\AntivirusTrigger 2.1
%UserProfile%\Start Menu\Programs\AntivirusTrigger 2.1\AntivirusTrigger 2.1.lnk
c:\WINDOWS\system32\512686
c:\WINDOWS\system32\512686\512686.dll
c:\WINDOWS\system32\algg.exe
c:\WINDOWS\system32\tiltmeo.dll
c:\Documents and Settings\All Users\Desktop\Antivirus Scan.url
c:\Documents and Settings\All Users\Desktop\Online Antispyware Test.url
c:\Documents and Settings\All Users\Start Menu\Antivirus Scan.url
c:\Documents and Settings\All Users\Start Menu\Online Antispyware Test.url
%UserProfile%\Favorites\Antivirus Scan.url
%UserProfile%\My Documents\My Documents.url
%UserProfile%\My Documents\My Music\My Music.url
%UserProfile%\My Documents\My Pictures\My Pictures.url
%UserProfile%\My Documents\My Videos
%UserProfile%\My Documents\My Videos\My Video.url
Se leggete queste righe siete arrivate alla fine ed avete debellato il virus : complimenti!In alternativa , trattandosi di uno spyware , consiglio l'installazione di un antispyware free : http://www.superantispyware.com/ oppure Spybot Search and Destroy
E , per un pronto intervento risolutivo : Malwarebytes’ Anti-Malware
Nessun commento:
Posta un commento