معرفی بدافزارها با نام جعلی نرم افزارهای امنیتی و کاربردی

[Borna66]

در این تاپیک قصد دارم تا Malware ها یا بدافزارهایی را که وارد سیستم شما بصورت خواسته با ناخواسته می شوند
را معرفی کنم تا بتوانید این نرم افزارهای جعلی را شناسایی کنید که تعداد آنها روز به روز در حال افزایش است.
متاسفانه اینگونه بدافزارها در سیستم های کاربران ایرانی رواج زیادی پیدا کرده و از روی ناآشنایی آنها را وارد سیستم های خود
می کنند.
روش حذف و پاکسازی سیستم از اینگونه بد آفزارها با نرم افزارهای امنیتی قدرمتند و Anti-Mlaware ها به راحتی امکان
پذیر است.
در این تاپیک فقط اینگونه نرم افزارها + مسیرهایی از هارددیسک و رجیستری ویندوز
که خود را قرار داده اند

[Borna66]

MS Antispyware 2009



کد:

c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20081214155256795.log
c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED
%UserProfile%\Start Menu\Programs\MS AntiSpyware 2009
%UserProfile%\Start Menu\Programs\MS AntiSpyware 2009\MS AntiSpyware 2009.lnk
HKEY_CURRENT_USER\Software\CrucialSoft Ltd
HKEY_CURRENT_USER\Software\CrucialSoft Ltd\MS AntiSpyware 2009
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\uninstall\MS AntiSpyware 2009 5.7
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "MS AntiSpyware 2009"

[Borna66]

Antivirus 360



ن

قل قول:
c:\Program Files\A360
c:\Program Files\A360\av360.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk
%UserProfile%\Desktop\Antivirus 360.lnk
%UserProfile%\Start Menu\Antivirus 360
%UserProfile%\Start Menu\Antivirus 360\Antivirus 360.lnk
%UserProfile%\Start Menu\Antivirus 360\Help.lnk
%UserProfile%\Start Menu\Antivirus 360\Registration.lnk
نقل قول:
HKEY_CURRENT_USER\Software\13376694984709702142491 016734454
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ Run "13376694984709702142491016734454

[Borna66]

SystemBooster2009



کد:
c:\My Downloads
c:\Program Files\SystemBooster2009 (Free Edition)
c:\Program Files\SystemBooster2009 (Free Edition)\install_stat2.tmp
c:\Program Files\SystemBooster2009 (Free Edition)\License Aggr.rtf
c:\Program Files\SystemBooster2009 (Free Edition)\Read Me.rtf
c:\Program Files\SystemBooster2009 (Free Edition)\sbr_cfg.ini
c:\Program Files\SystemBooster2009 (Free Edition)\sbr_inst.imd
c:\Program Files\SystemBooster2009 (Free Edition)\sbr_pcid.exe
c:\Program Files\SystemBooster2009 (Free Edition)\sbr_updater.exe
c:\Program Files\SystemBooster2009 (Free Edition)\sbrckrdr.exe
c:\Program Files\SystemBooster2009 (Free Edition)\startup_db.db
c:\Program Files\SystemBooster2009 (Free Edition)\SystemBooster2009 Home Page.url
c:\Program Files\SystemBooster2009 (Free Edition)\SystemBooster2009.chm
c:\Program Files\SystemBooster2009 (Free Edition)\SystemBooster2009.config
c:\Program Files\SystemBooster2009 (Free Edition)\SystemBooster2009.exe
c:\Program Files\SystemBooster2009 (Free Edition)\SystemBooster2009_Chk.exe
c:\Program Files\SystemBooster2009 (Free Edition)\Uninstall SystemBooster2009.exe
c:\Program Files\SystemBooster2009 (Free Edition)\comstart
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\001_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\003_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\006_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\007_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\009_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\011_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\013_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\016_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\017_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\020_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\023_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\027_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\030_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\031_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\033_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\040_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\EdTweaks\042_eddat.reg
c:\Program Files\SystemBooster2009 (Free Edition)\genstart
c:\Program Files\SystemBooster2009 (Free Edition)\Undo_Data
%UserProfile%\Desktop\QuickInstallPack.lnk
%UserProfile%\Local Settings\Application Data\qip
%UserProfile%\Local Settings\Application Data\qip\data.ini
%UserProfile%\Local Settings\Application Data\qip\iercpt.dll
%UserProfile%\Local Settings\Application Data\qip\QuickInstallPack.exe
%UserProfile%\Local Settings\Application Data\qip\systembooster2009_Setup_free_en.exe.ini
%UserProfile%\Local Settings\Application Data\USBR_QIP
%UserProfile%\Local Settings\Application Data\USBR_QIP\data.ini
%UserProfile%\Start Menu\Programs\QuickInstallPack
%UserProfile%\Start Menu\Programs\QuickInstallPack\QuickInstallPack on the Web.url
%UserProfile%\Start Menu\Programs\QuickInstallPack\QuickInstallPack.ln k
%UserProfile%\Start Menu\Programs\QuickInstallPack\Uninstall QuickInstallPack.lnk
c:\Documents and Settings\All Users\Desktop\SystemBooster2009 (Free Edition).lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\SystemBooster2009 Home Page.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\SystemBooster2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\Uninstall SystemBooster2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\Documentation
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\Documentation\Documentation.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\Documentation\License Aggr.rtf.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemBooster2009 (Free Edition)\Documentation\Read Me.rtf.lnk
کد:
HKEY_CURRENT_USER\Software\SystemBooster2009
HKEY_LOCAL_MACHINE\SOFTWARE\SystemBooster2009
HKEY_LOCAL_MACHINE\SOFTWARE\SystemBooster2009 (Free Edition)
HKEY_CLASSES_ROOT\AppID\{3A9377A6-BE7F-485D-908C-D44114691389}
HKEY_CLASSES_ROOT\AppID\iercpt.DLL
HKEY_CLASSES_ROOT\CLSID\{D4CDC21D-43BE-4101-A1EF-E379F134771E}
HKEY_CLASSES_ROOT\iercpt.iercptbho
HKEY_CLASSES_ROOT\iercpt.iercptbho.1
HKEY_CLASSES_ROOT\Interface\{59C345BA-3D5E-44E3-9D10-D3848AF15D73}
HKEY_CLASSES_ROOT\TypeLib\{A6FBD2E4-1C7E-4EAB-80DD-01DE2645566A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{D4CDC21D-43BE-4101-A1EF-E379F134771E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\QuickInstallPack
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SystemBooster2009 (Free Edition)
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "QuickInstallPack"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "SBR2009F"
HKEY_LOCAL

[Borna66]

Privacy Commander

کد:
c:\Documents and Settings\Bleeping\Desktop\Privacy Commander.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\Privacy Commander
c:\Documents and Settings\Bleeping\Start Menu\Programs\Privacy Commander\Privacy Commander.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\Privacy Commander\Uninstall.lnk
c:\Program Files\Privacy Commander
c:\Program Files\Privacy Commander\settings.ini
c:\Program Files\Privacy Commander\sysguard.exe
c:\Program Files\Privacy Commander\tipguard.exe
c:\Program Files\Privacy Commander\uninstall.exe
c:\Program Files\Privacy Commander\img
c:\Program Files\Privacy Commander\img\bg_fixed_de.jpg
c:\Program Files\Privacy Commander\img\bg_fixed_en.jpg
c:\Program Files\Privacy Commander\img\bg_fixed_es.jpg
c:\Program Files\Privacy Commander\img\bg_fixed_it.jpg
c:\Program Files\Privacy Commander\img\bg_licence_de.jpg
c:\Program Files\Privacy Commander\img\bg_licence_en.jpg
c:\Program Files\Privacy Commander\img\bg_licence_es.jpg
c:\Program Files\Privacy Commander\img\bg_licence_it.jpg
c:\Program Files\Privacy Commander\img\bg_main_de.jpg
c:\Program Files\Privacy Commander\img\bg_main_en.jpg
c:\Program Files\Privacy Commander\img\bg_main_es.jpg
c:\Program Files\Privacy Commander\img\bg_main_it.jpg
c:\Program Files\Privacy Commander\img\bg_warning_de.jpg
c:\Program Files\Privacy Commander\img\bg_warning_en.jpg
c:\Program Files\Privacy Commander\img\bg_warning_es.jpg
c:\Program Files\Privacy Commander\img\bg_warning_it.jpg
c:\Program Files\Privacy Commander\img\bt_activate_de.jpg
c:\Program Files\Privacy Commander\img\bt_activate_en.jpg
c:\Program Files\Privacy Commander\img\bt_activate_es.jpg
c:\Program Files\Privacy Commander\img\bt_activate_it.jpg
c:\Program Files\Privacy Commander\img\bt_cancel_de.jpg
c:\Program Files\Privacy Commander\img\bt_cancel_en.jpg
c:\Program Files\Privacy Commander\img\bt_cancel_es.jpg
c:\Program Files\Privacy Commander\img\bt_cancel_it.jpg
c:\Program Files\Privacy Commander\img\bt_fix_de.jpg
c:\Program Files\Privacy Commander\img\bt_fix_en.jpg
c:\Program Files\Privacy Commander\img\bt_fix_es.jpg
c:\Program Files\Privacy Commander\img\bt_fix_it.jpg
c:\Program Files\Privacy Commander\img\bt_ok_de.jpg
c:\Program Files\Privacy Commander\img\bt_ok_en.jpg
c:\Program Files\Privacy Commander\img\bt_ok_es.jpg
c:\Program Files\Privacy Commander\img\bt_ok_it.jpg
c:\Program Files\Privacy Commander\img\bt_silent_de.jpg
c:\Program Files\Privacy Commander\img\bt_silent_en.jpg
c:\Program Files\Privacy Commander\img\bt_silent_es.jpg
c:\Program Files\Privacy Commander\img\bt_silent_it.jpg
c:\Program Files\Privacy Commander\img\bt_upd_de.jpg
c:\Program Files\Privacy Commander\img\bt_upd_en.jpg
c:\Program Files\Privacy Commander\img\bt_upd_es.jpg
c:\Program Files\Privacy Commander\img\bt_upd_it.jpg
c:\Program Files\Privacy Commander\img\bt_update_de.jpg
c:\Program Files\Privacy Commander\img\bt_update_en.jpg
c:\Program Files\Privacy Commander\img\bt_update_es.jpg
c:\Program Files\Privacy Commander\img\bt_update_it.jpg
c:\Program Files\Privacy Commander\lang
c:\Program Files\Privacy Commander\lang\de.lng
c:\Program Files\Privacy Commander\lang\en.lng
c:\Program Files\Privacy Commander\lang\es.lng
c:\Program Files\Privacy Commander\lang\it.lng
c:\Program Files\Privacy Commander\sounds
c:\Program Files\Privacy Commander\sounds\1.mp3
c:\Program Files\Privacy Commander\sounds\2.mp3
c:\Program Files\Privacy Commander\sounds\3.mp3
کد:
HKEY_CURRENT_USER\Software\sysguard
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\sysguard
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "tipguard.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"=>

[Borna66]

Perfect Defender 2009

کد:
c:\Program Files\Perfect Defender 2009
c:\Program Files\Perfect Defender 2009\dbbase.div
c:\Program Files\Perfect Defender 2009\pd.dll
c:\Program Files\Perfect Defender 2009\pdfndr.exe
c:\Program Files\Perfect Defender 2009\pdmonitor.exe
c:\Program Files\Perfect Defender 2009\UnInstall.exe
c:\Documents and Settings\All Users\Start Menu\Perfect Defender 2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009\Perfect Defender 2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009\Uninstall Perfect Defender 2009.lnk
کد:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "Perfect Defender 2009"

[Borna66]

Nano Antivirus

کد:
c:\uninstallinfo.txt
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\nanoav.exe
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\BASE
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\DELETED
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\LOG
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\LOG\20081202135125769.log
c:\Documents and Settings\All Users\Application Data\Surround Software Solutions\Nano Antivirus\SAVED
کد:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\uninstall\Nano Antivirus 3.8
HKEY_CURRENT_USER\Software\Surround Software Solutions\Installer
HKEY_CURRENT_USER\Software\Surround Software Solutions\Nano Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "Nano Antivirus"

[Borna66]

Secure Expert Cleaner

کد:
c:\uninstallinfo.txt
c:\My Downloads
c:\Program Files\SecureExpertCleaner
c:\Program Files\SecureExpertCleaner\mfc80.dll
c:\Program Files\SecureExpertCleaner\Microsoft.VC80.MFC.manif est
c:\Program Files\SecureExpertCleaner\Reminder.exe
c:\Program Files\SecureExpertCleaner\SEC.exe
c:\Program Files\SecureExpertCleaner\SEC.ico
c:\Program Files\SecureExpertCleaner\SEC.xml
c:\Program Files\SecureExpertCleaner\unins.ico
c:\Program Files\SecureExpertCleaner\unins000.dat
c:\Program Files\SecureExpertCleaner\unins000.exe
c:\Program Files\SecureExpertCleaner\Microsoft.VC80.CRT
c:\Program Files\SecureExpertCleaner\Microsoft.VC80.CRT\Micro soft.VC80.CRT.manifest
c:\Program Files\SecureExpertCleaner\Microsoft.VC80.CRT\msvcp 80.dll
c:\Program Files\SecureExpertCleaner\Microsoft.VC80.CRT\msvcr 80.dll
c:\Documents and Settings\All Users\Application Data\SEC
c:\Documents and Settings\All Users\Application Data\SEC\base.dat
c:\Documents and Settings\All Users\Desktop\Secure ExpertCleaner.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SecureExpertCleaner
c:\Documents and Settings\All Users\Start Menu\Programs\SecureExpertCleaner\Launch SecureExpertCleaner.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SecureExpertCleaner\Uninstall SecureExpertCleaner.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SecureExpertCleaner.lnk
%UserProfile%\Application Data\SecureExpertCleaner
%UserProfile%\Application Data\SecureExpertCleaner\Logs
%UserProfile%\Application Data\SecureExpertCleaner\Logs\scns.log
%UserProfile%\Desktop\QuickInstallPack.lnk
%UserProfile%\Local Settings\Application Data\qip
%UserProfile%\Local Settings\Application Data\qip\data.ini
%UserProfile%\Local Settings\Application Data\qip\iercpt.dll
%UserProfile%\Local Settings\Application Data\qip\QuickInstallPack.exe
%UserProfile%\Local Settings\Application Data\qip\SecureExpertCleaner_Pandora_Dual_En.exe.i ni
%UserProfile%\Start Menu\Programs\QuickInstallPack
%UserProfile%\Start Menu\Programs\QuickInstallPack\QuickInstallPack on the Web.url
%UserProfile%\Start Menu\Programs\QuickInstallPack\QuickInstallPack.ln k
%UserProfile%\Start Menu\Programs\QuickInstallPack\Uninstall QuickInstallPack.lnk
کد:
HKEY_CURRENT_USER\Software\SEC
HKEY_LOCAL_MACHINE\SOFTWARE\SEC
HKEY_CURRENT_USER\Software\SecureExpertCleaner
HKEY_CLASSES_ROOT\AppID\{3A9377A6-BE7F-485D-908C-D44114691389}
HKEY_CLASSES_ROOT\AppID\iercpt.DLL
HKEY_CLASSES_ROOT\CLSID\{D4CDC21D-43BE-4101-A1EF-E379F134771E}
HKEY_CLASSES_ROOT\iercpt.iercptbho
HKEY_CLASSES_ROOT\iercpt.iercptbho.1
HKEY_CLASSES_ROOT\Interface\{59C345BA-3D5E-44E3-9D10-D3848AF15D73}
HKEY_CLASSES_ROOT\TypeLib\{A6FBD2E4-1C7E-4EAB-80DD-01DE2645566A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{D4CDC21D-43BE-4101-A1EF-E379F134771E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\3P_USEC_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\QuickInstallPack
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "QuickInstallPack"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent\Post Platform "3P_USEC 1.0.10.8"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "Reminder"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "SecureExpertCleaner"

[Borna66]

Winweb Security

کد:
c:\Documents and Settings\All Users\Application Data\WinwebSecurity
c:\Documents and Settings\All Users\Application Data\WinwebSecurity\Languages
c:\Documents and Settings\All Users\Application Data\WinwebSecurity\config.udb
c:\Documents and Settings\All Users\Application Data\WinwebSecurity\init.udb
c:\Documents and Settings\All Users\Application Data\WinwebSecurity\WinwebSecurity.exe
c:\Documents and Settings\All Users\Application Data\WinwebSecurity\Languages\English.lng
کد:
HKEY_CLASSES_ROOT\CLSID\{D5DF7C9D-6069-4552-8B0C-D02A912FC889}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{D5DF7C9D-6069-4552-8B0C-D02A912FC889}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "WinwebSecurity"

[Borna66]

Extra Antivir

کد:
%UserProfile%\Application Data\Extra Antivir
%UserProfile%\Application Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_
%UserProfile%\Application Data\Extra Antivir\Extra Antivir.ini
%UserProfile%\Application Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\ base.dat
%UserProfile%\Application Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\ base2.dat
%UserProfile%\Application Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\ Desc.dat
%UserProfile%\Application Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\ spline.dat
کد:
HKEY_CURRENT_USER\Software\Extra Antivir