Dezinstaleaza Windows Enterprise Defender – Ghid pentru Devirusare Completa

Windows Enterprise Defender este ultimul anti-spyware de tip rogue din familia Virus Doctor. Odata instalat, va porni odata cu Windows-ul si va crea o serie de fisiere care nu sunt periculoase ce au denumirile urmatoare:

%UserProfile%\Recent\cb.sys
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\eb.sys
%UserProfile%\Recent\energy.exe
%UserProfile%\Recent\pal.sys
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\ppal.exe
%UserProfile%\Recent\tempdoc.tmp

Cand Windows Enterprise Defender va scana computerul va detecta acele fisiere ca fiind infectate si va solicita achizitionarea programului pentru indepartarea lor. Bineinteles ca este doar o tactica de marketing pentru a va fura banii, PC-ul nefiind afectat de acei pretinsi virusi.
De asemenea soft-ul afiseaza alerte conform carora calculatorul ar fi atacat de pe internet, cu acelasi scop cu al fisierelor de mai sus.

Programul va crea urmatoarele fisiere\foldere:

• c:\Documents and Settings\All Users\Application Data\c9ba
• c:\Documents and Settings\All Users\Application Data\c9ba\83.mof
• c:\Documents and Settings\All Users\Application Data\c9ba\mozcrt19.dll
• c:\Documents and Settings\All Users\Application Data\c9ba\sqlite3.dll
• c:\Documents and Settings\All Users\Application Data\c9ba\unins000.dat
• c:\Documents and Settings\All Users\Application Data\c9ba\WED.ico
• c:\Documents and Settings\All Users\Application Data\c9ba\WindowsEDefender.exe
• c:\Documents and Settings\All Users\Application Data\c9ba\WEDDSys
• c:\Documents and Settings\All Users\Application Data\c9ba\WEDDSys\vd952342.bd
• c:\Documents and Settings\All Users\Application Data\WEDDSys
• c:\Documents and Settings\All Users\Application Data\WEDDSys\wed.cfg
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Enterprise Defender.lnk
• %UserProfile%\Application Data\Windows Enterprise Defender
• %UserProfile%\Application Data\Windows Enterprise Defender\cookies.sqlite
• %UserProfile%\Desktop\Windows Enterprise Defender.lnk
• %UserProfile%\Recent\cb.sys
• %UserProfile%\Recent\ddv.dll
• %UserProfile%\Recent\eb.sys
• %UserProfile%\Recent\energy.exe
• %UserProfile%\Recent\pal.sys
• %UserProfile%\Recent\PE.drv
• %UserProfile%\Recent\ppal.exe
• %UserProfile%\Recent\tempdoc.tmp
• %UserProfile%\Start Menu\Windows Enterprise Defender.lnk
• %UserProfile%\Start Menu\Programs\Windows Enterprise Defender.lnk
• c:\Program Files\Mozilla Firefox\searchplugins\search.xml

De asemenea si urmatoarele intrari registry ii sunt asociate:

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WindowsEDefender.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” => “http://search-gala.com/?&uid=7&q={searchTerms}”
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes “URL”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “[xSP_2:61a6083b6194a2314e3dd54cf9615e36_7]”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “876902803″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Windows Enterprise Defender”

In log-ul HijackThis apar urmatoarea intrare:

O4 – HKLM\..\Run: [Windows Enterprise Defender] “C:\Documents and Settings\All Users\Application Data\c9ba\WindowsEDefender.exe” /s /d

DEVIRUSARE: Descarcati, instalati si scanati Pc-ul cu Malwarebytes Anti-Malware. Stergeti la final toate infectiile gasite, apasand “Remove selected”.

Daca ai reusit sa cureti aceasta infectie, iti recomand sa cumperi versiunea PRO a Malwarebytes Anti-Malware pentru a te proteja si pe viitor de astfel de amenintari, avand in vedere ca nu au fost detectate\eliminate de antivirusul tau actual.