怎样清除国外流氓软件AntiVirGear (清除指导)
from:bleepingcomputer.com
怎样清除国外流氓软件AntiVirGear (清除指导)
电脑侠客翻译http://hi.baidu.com/dnxk
流氓简历: （症状看图就行了，不翻译了）
AntiVirGear is a rogue anti-spyware program which is installed via Zlob Trojan infections. Zlob Trojans are malware which masquerade as video or audio codecs which state they are required to be installed if you want to watch a particular movie or listen to a particular audio file found on the Internet. In reality, these files will instead install the AntiVirGear program as well as other malware onto your computer. These installations are typically done behind the scenes without your permission or knowledge.
When the Zlob infection is first launched on your computer it will display fake security alerts and automatically download the AntiVirGear program. When AntiVirGear has finished installing, it will automatically launch and scan your computer for spyware. When it has finished it will display a list of exaggerated or fake results and require you to purchase the full software in order to remove them. These results, though, are fake and are being used as a method to scare you into purchasing the software. Regardless of what this program displays, you should not purchase AntiVirGear. A screenshot of AntiVirGear can be found below.
怎样清除国外流氓软件AntiVirGear (清除指导)
电脑侠客翻译http://hi.baidu.com/dnxk
流氓简历: （症状看图就行了，不翻译了）
AntiVirGear is a rogue anti-spyware program which is installed via Zlob Trojan infections. Zlob Trojans are malware which masquerade as video or audio codecs which state they are required to be installed if you want to watch a particular movie or listen to a particular audio file found on the Internet. In reality, these files will instead install the AntiVirGear program as well as other malware onto your computer. These installations are typically done behind the scenes without your permission or knowledge.
When the Zlob infection is first launched on your computer it will display fake security alerts and automatically download the AntiVirGear program. When AntiVirGear has finished installing, it will automatically launch and scan your computer for spyware. When it has finished it will display a list of exaggerated or fake results and require you to purchase the full software in order to remove them. These results, though, are fake and are being used as a method to scare you into purchasing the software. Regardless of what this program displays, you should not purchase AntiVirGear. A screenshot of AntiVirGear can be found below.
AntiVirGear Screenshot
As said previously when the Zlob infection is started it will display fake security alerts in your Windows taskbar. These alerts will say there is a problem with your computer or infected with malware. These alerts are all false and are just being used to scare you into purchasing the software. If you click on the alert, it will automatically launch AntiVirGear and do a scan. The current text of the fake security alert is:
System has detected a number of active spyware applications that may impact the performance of your computer. Click the icon to get rid of unwanted spyware by downloading an up-to-date anti-spyware solution.
An example of the fake alert is shown below:
AntiVirGear Fake Security alert
This guide will remove the Zlob Trojan which displays the fake security alerts, the AntiVirGear program, and other malware that are typically installed with these programs.
需要用到的修复工具:
- SmitFraudFix (自动修复)
- FixAVG.reg (仅手工修复时使用)
在HijackThis日志中可以看到以下项:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http ://ffinder.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http ://ffinder.com/
O2 - BHO: ieffse32.msdn_hlp - {C1C6426B-FB16-4123-ACBE-74D94FB0E663} - C:\WINDOWS\system32\ieffse32.dll
O4 - HKLM\..\Run: [AntiVirGear 3.7] "C:\Program Files\AntiVirGear 3.7\AntiVirGear 3.7.exe" /h
O4 - HKLM\..\Run: [AntiVirGear 3.8] "C:\Program Files\AntiVirGear 3.8\AntiVirGear 3.8.exe" /h
*O10 - Unknown file in Winsock LSP: c:\windows\system32\laf1.dll
**O22 - SharedTaskScheduler: haruspicy - {60dea04c-9817-4309-bfa2-f8a1766c3cd1} - C:\WINDOWS\system32\jrpkmgh.dll
*注意: 不要手工删除这个文件. 会有几个关联的类似文件 (例如 laf2.dll 或 laf3.dll)
**注意: 此项为随机文件名，经常变动。
控制面板中添加/删除程序里面可以看到:
AntiVirGear 3.7
AntiVirGear 3.8
指导更新记录:
09/14/07 - Initial guide creation.
09/25/07 - Updated guide to remove symptoms and LSP infection. LSP infections are a new attack vector for Zlob installed Rogues.
09/27/07 - Guide updated to include new LSP removal instructions.
09/28/07 - Removed LSP instructions as SmitFraudFix now removes them.
09/29/07 - Updated guide for the AntiVirGear 3.8 version.
选择你喜欢的清除方法:
- 自动清除Automated Removal (简单,需要连接Internet.)
- 手工清除Manual Removal (自动清除不行的话用这个吧)
利用工具自动清除AntiVirGear:
- 先将本指导打印出来，因为一会儿修复的时候会关闭窗口.
- 从以下地址下载SmitfraudFix.exe并保存在桌面上:
SmitFraudFix.exe
确认将 SmitfraudFix.exe 放在了桌面上，现在不要双击下面这个图标，待会会用到它。
- 接下来,重启计算机进入安全模式
- 进入安全模式并能看到桌面后，关闭所有打开的窗口。
- 现在双击桌面上的 SmitFraudfix 图标，图标如下图所示:
- 此时会出现版权说明文字，按任意键继续.
- 现在你可以看到一个菜单，如下图所示。 按键盘上的数字键 2 然后回车，选择 Clean (safe mode recommended) 选项.
- 程序将运行一系列清理进程清理计算机，完成后,程序会自动运行磁盘清理程序，如下图所示.
磁盘清理程序会清除所有临时文件、IE临时文件和其它可能会引起感染的文件. 这会花费一些时间，请耐心等待.完成后，程序将自动关闭并进入第11步. - 清理完成后， 会提示你： Do you want to clean the registry ? (y/n). 选择Y（按一下键盘上的字母Y键），并回车。
- 现在进入最后一步，你会看到提示： Computer will reboot now. Close all applications. 按下空格键，提示你倒计时15秒重启计算机，不要取消，让计算机重启
- 重启后，会打开一个文本文件，里面有清除记录。
如果还有问题，扫个hjt日志吧
手工清除 AntiVirGear:
这些步骤看起来很繁琐，但做起来相当简单.
- 先将本指导打印出来，因为一会儿修复的时候会关闭窗口.
- 下载 FixAVG.reg 并保存在桌面上。右键点击下面链接，选择目标另存为.
FixAVG.reg Download Link
确认fixAVG已经保存在桌面上了. - 从下面链接下载 SmitfraudFix.exe 并保存在桌面上:
SmitFraudFix.exe
确认 SmitfraudFix.exe 保存在桌面上了，现在不要双击下面图中这个图标:
- 回到桌面，双击 FixVPP.reg ，按yes，导入注册表.
- 点击开始菜单-运行.
- 在输入框中输入: c:\windows\system32 ，然后回车.
- 如果提示你 These files are hidden,请点击Show the contents of this folder 选项.（就是显示隐藏文件啦）
- 显示隐藏文件。。（这个你应该知道吧？）
- 找到 wqzdtjg.dll 重命名为 wqzdtjg.dll.bad.
找到 ddllup.dll 重命名为ddllup.dll.bad
找到vmlwp.dll 重命名为vmlwp.dll.bad
找到 lgaac.dll 重命名为lgaac.dll.bad
找到 iheuv.dll 重命名为iheuv.dll.bad
找到 pluwue.dll 重命名为 pluwue.dll.bad
找到 zdhgsp.dll 重命名为 zdhgsp.dll.bad
找到 jrpkmgh.dll 重命名为 jrpkmgh.dll.bad
找到 swqzdtj.dll 重命名为 swqzdtj.dll.bad
找到 vusxqm.dll 重命名为 vusxqm.dll.bad
找到 rnxwph.dll 重命名为 rnxwph.dll.bad
找到 vzfhprk.dll 重命名为 vzfhprk.dll.bad
找到 hymww.dll 重命名为 hymww.dll.bad
找到 mvwqn.dll 重命名为 mvwqn.dll.bad
找到 veptlh.dll 重命名为 veptlh.dll.bad
找到 rmtdvc.dll 重命名为 rmtdvc.dll.bad
找到 hteogat.dll 重命名为 hteogat.dll.bad
找到 txxkb.dll 重命名为 txxkb.dll.bad
找到 fifzqip.dll 重命名为 fifzqip.dll.bad
找到 flirek.dll 重命名为 flirek.dll.bad
- 完成后，关闭 System32 文件夹窗口.
- 接下来, 重启计算机进入安全模式
- 进入安全模式并可以看到桌面后，点击开始菜单---控制面板，双击添加/删除程序
- 找到 AntiVirGear 3.7， AntiVirGear 3.8, 和 Online Video Add-on 项，双击卸载掉.按提示操作，如果提示你重启，先不要重启计算机
- 完成后，关闭添加/删除程序和控制面板窗口.
- 删除以下文件和文件夹 :
C:\Windows\System32\wqzdtjg.dll.bad
C:\Windows\System32\ddllup.dll.bad
C:\Windows\System32\vmlwp.dll.bad
C:\Windows\System32\lgaac.dll.bad
C:\Windows\System32\iheuv.dll.bad
C:\Windows\System32\pluwue.dll.bad
C:\Windows\System32\zdhgsp.dll.bad
C:\Windows\System32\jrpkmgh.dll.bad
C:\Windows\System32\swqzdtj.dll.bad
C:\Windows\System32\vusxqm.dll.bad
C:\Windows\System32\rnxwph.dll.bad
C:\Windows\System32\vzfhprk.dll.bad
C:\Windows\System32\hymww.dll.bad
C:\Windows\System32\mvwqn.dll.bad
C:\Windows\System32\veptlh.dll.bad
C:\Windows\System32\rmtdvc.dll.bad
C:\Windows\System32\hteogat.dll.bad
C:\Windows\System32\txxkb.dll.bad
C:\Windows\System32\fifzqip.dll.bad
C:\Windows\System32\flirek.dll.bad
C:\Windows\System32\cfg.dat
C:\Windows\System32\ieffse32.dll
C:\Windows\System32\lbf.tme
C:\Windows\System32\regmod.exe
C:\Program Files\AntiVirGear 3.7\
C:\Program Files\AntiVirGear 3.8\
- 关闭所有打开的窗口.
- 现在双击桌面上的 SmitFraudfix 图标:
- 按任意键继续，然后按键盘上的数字 2 ，并回车，执行选项 Clean (safe mode recommended).
- 程序将通过一系列进程清理计算机，完成后自动运行磁盘清理程序.
磁盘清理完成后，会启动关闭，然后进入第20步. - 清理完后提示你：Do you want to clean the registry ? (y/n). 选择Y并回车.
- 最后会提示你： Computer will reboot now. Close all applications. 然后倒计时15秒，让它重启计算机
- 重启后，会打开文本文件，上面有清除记录
- 接下来用熊猫在线扫描: Panda Online
- 点击 Scan your PC 按钮
- 会打开新窗口...点击 Check Now 按钮
- 输入你的国家Country
- 输入省State/Province
- 输入电邮e-mail address 点击send
- 选择Home User 或 Company
- 点击Scan Now 按钮
- 会提示你安装 ActiveX 插件
- 然后自动下载病毒库文件(会花费一些时间)
- 下载完后, 点击 Local Disks 开始扫描
- 在线扫描完成后，关闭IE.
现在 AntiVirGear 被清除了.
电脑侠客翻译http://hi.baidu.com/dnxk
注：最新版smifraudfix和中文操作说明请到电脑侠客E盘下载。
地址:http://ljs3509.ys168.com 专杀工具2目录中。文件名：SmitFraudFix清除国外流氓软件.rar
TAG:
评分(
