Cập nhật ngày 01/2/2010 2:23:00 PM

Loại: Adware

Phát tán: Trung bình

Hệ thống ảnh hưởng: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

II- Chi tiết kỹ thuật:
Khi lây nhiễm Adware tạo ra các file sau:

• %ProgramFiles%\Mozilla Firefox\extensions\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}\chrome\content\OFoxb.xul
• %ProgramFiles%\Mozilla Firefox\extensions\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}\chrome.manifest
• %ProgramFiles%\Mozilla Firefox\extensions\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}\components\IFoxB.xpt
• %ProgramFiles%\Mozilla Firefox\extensions\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}\components\OFoxB.dll
• %ProgramFiles%\Mozilla Firefox\extensions\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}\install.rdf
• %ProgramFiles%\Ofb1\Ofb1.dll
• %ProgramFiles%\Ofb1\sites.ini
• %ProgramFiles%\Ofb1\Uninstall.exe

III - Cách diệt:
Trước khi thao tác tắt chức năng System Restore (Windows Me/XP).

1. Vào Start > Run.
2. Gõ  regedit
3. Click OK.
4. Tìm và xóa các file sau trong Registry

• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E1500AC-87A5-416b-A211-82E848649DA9}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7467507-DD40-4123-BE49-7B7DF5DB80C6}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9504AE8F-1019-4258-A047-C04CCC5301E6}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C1BC108B-B3EF-4E18-8EE6-CF3C381E3783}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ofb1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ofb1.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E1500AC-87A5-416b-A211-82E848649DA9}
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3E1500AC-87A5-416B-A211-82E848649DA9}

5. Thoát khỏi registry