удалите в mbam
- Запустите MBAM
- выберите Perform Full Scan (Провести полную проверку)
- нажмите Scan (Проверить)
- после сканирования выберите Ок и далее Show Results (Показать результаты)
- нажмите Remove Selected (удалить выделенные, внимание - проверьте то, что удаляете).
Код:
Заражённые ключи в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.
Заражённые папки:
c:\program files\funwebproducts (Adware.MyWebSearch) -> No action taken.
c:\program files\funwebproducts\Installr (Adware.MyWebSearch) -> No action taken.
c:\program files\funwebproducts\Installr\1.bin (Adware.MyWebSearch) -> No action taken.
c:\documents and settings\user\application data\winxrar (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar (Trojan.Agent) -> No action taken.
Заражённые файлы:
c:\WINDOWS\reconstruction.exe (Trojan.Spambot) -> No action taken.
c:\documents and settings\user\application data\winxrar\after.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\aview (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\dir.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\key (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\logo.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\logo2.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\myriadwebpro-condensed.ttf (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-h-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-h-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-scroll-back.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-scroll-base.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-scroll-slider.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-v-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\sb-v-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\user\application data\winxrar\scroll.css (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\after.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\aview (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\dir.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\key (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\logo.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\logo2.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\myriadwebpro-condensed.ttf (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-h-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-h-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-scroll-back.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-scroll-base.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-scroll-slider.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-v-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\sb-v-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\WAMPIR\application data\winxrar\scroll.css (Trojan.Agent) -> No action taken.
кейгены на ваше усмотрение, могут содержать трояны
vercontrol.exe - этот файл тоже проверить заново
и повторить лог MBAM
