Adware:Win32/FastSaveApp 清除
不慎中了Adware:Win32/FastSaveApp,IE浏览器被感染。
IE浏览器打开任意网站,MSE均报告风险,网上有很多处理方法(比如会安装浏览器扩展程序,但我的并没发现),但尝试过都无效,它会伪装成不同文件名,最终使用adwcleaner清理掉。
通过Log发现被感染的文件
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
***** [Files / Folders] *****
Folder Found : C:\ProgramData\BetterSoft
Folder Found : C:\ProgramData\InstallMate
***** [Registry] *****
Key Found : HKCU\Software\AppDataLow\SProtector
Key Found : HKCU\Software\TENCENT
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Found : HKLM\Software\SP Global
Key Found : HKLM\Software\SProtector
Key Found : HKLM\Software\TENCENT
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.onewebsearch.com?hp=CN-1000-01032013090145
-\\ Mozilla Firefox v16.0.1 (zh-CN)
File : C:\Users\localuser\AppData\Roaming\Mozilla\Firefox\Profiles\v8xs9g4j.default\prefs.js
Found : user_pref("aol_toolbar.default.homepage.check", false);
Found : user_pref("aol_toolbar.default.search.check", false);
Found : user_pref("browser.startup.homepage", "hxxp://www.onewebsearch.com?hp=CN-1000-01032013090145");
Found : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Found : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Found : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Found : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Found : user_pref("sweetim.toolbar.searchguard.enable", "");
-\\ Google Chrome v [Unable to get version]
File : C:\Users\localuser\AppData\Local\Google\Chrome\User Data\Default\Preferences