Devi rimuovere i seguenti file:
File relativi all’infezione:
codice:
zayz0qorhnhyGn.exe
yhyz0qorihyGn.exe
cDdouyYokr9NKbE.exe
%UserProfile%\Desktop\System Check.lnk
%Temp%\smtmp\4
%Temp%\smtmp\3
%Temp%\smtmp\2
%Temp%\smtmp\1
%Temp%\smtmp\
%StartMenu%\Programs\System Check\Uninstall System Check.lnk
%StartMenu%\Programs\System Check\System Check.lnk
%StartMenu%\Programs\System Check\
%LocalAppData%\[Random].exe
Eseguibili da eliminare:
codice:
zayz0qorhnhyGn.exe
yhyz0qorihyGn.exe
cDdouyYokr9NKbE.exe
%LocalAppData%\[Random].exe
Rimozione delle entrate del registro:
codice:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\R
Byez