berbew
2 отговора
0 прегледа
Re: berbew
Manual removal is as follows. Do not attempt this procedure if you are not comfortable editing your registry, as you can render your system unbootable if you make a mistake.
Search the registry for the key HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad and remove the entry:
"Web Event Logger" = "{79FB9088-19CE-715E-D900-216290C5B738}"
Also remove in HKCR\CLSID\{79FB9088-19CE-715E-D900-216290C5B738}\InProcServer32:
"(Default)" = "%sysdir%/xxxxxx32.dll"
"ThreadingModel" = "Apartment"
where xxxxxx is a random string of lowercase characters. Reboot the machine and remove the dll file from the system directory. The trojan exe file also has a random name, but can be spotted by looking for files with the same timestamp as the dll. Remove surf.dat from the system directory - this file contains captured logins and passwords.
Search the registry for the key HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad and remove the entry:
"Web Event Logger" = "{79FB9088-19CE-715E-D900-216290C5B738}"
Also remove in HKCR\CLSID\{79FB9088-19CE-715E-D900-216290C5B738}\InProcServer32:
"(Default)" = "%sysdir%/xxxxxx32.dll"
"ThreadingModel" = "Apartment"
where xxxxxx is a random string of lowercase characters. Reboot the machine and remove the dll file from the system directory. The trojan exe file also has a random name, but can be spotted by looking for files with the same timestamp as the dll. Remove surf.dat from the system directory - this file contains captured logins and passwords.