Trojaner-Board - Home Safety Essentials entfernen

Home Safety Essentials entfernen

Was ist Home Safety Essentials?
Home Safety Essentials ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Home Safety Essentials) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Da solche Software wie Home Safety Essentials sich gegen jede Entfernung wehren wird und Home Safety Essentials oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Scareware wie Home Safety Essentials nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!

http://www.trojaner-board.de/attachm...1&d=1316258762 http://www.trojaner-board.de/attachm...1&d=1316258762

Symptome von Home Safety Essentials:

ständige Fake Virenmeldungen von Home Safety Essentials
PC läuft seit Home Safety Essentials langsamer als üblich

Fake-Meldungen von Home Safety Essentials:

%AppData%\Microsoft\Windows\Recent\CLSV.tmp
%AppData%\Microsoft\Windows\Recent\DBOLE.dll
%AppData%\Microsoft\Windows\Recent\PE.sys
%AppData%\Microsoft\Windows\Recent\SICKBOY.drv
%AppData%\Microsoft\Windows\Recent\SICKBOY.sys
%AppData%\Microsoft\Windows\Recent\delfile.dll
%AppData%\Microsoft\Windows\Recent\eb.dll
%AppData%\Microsoft\Windows\Recent\eb.sys
%AppData%\Microsoft\Windows\Recent\energy.dll
%AppData%\Microsoft\Windows\Recent\gid.tmp
%AppData%\Microsoft\Windows\Recent\pal.sys
%AppData%\Microsoft\Windows\Recent\ppal.drv
%AppData%\Microsoft\Windows\Recent\runddlkey.exe
%AppData%\Microsoft\Windows\Recent\snl2w.drv

Dateien von Home Safety Essentials:

Code:

%AllUsersProfile%\<random characters>\

%AllUsersProfile%\<random characters>\14.mof

%AllUsersProfile%\<random characters>\3178.mof

%AllUsersProfile%\<random characters>\46.mof

%AllUsersProfile%\<random characters>\6113.mof

%AllUsersProfile%\<random characters>\HS2d7_231.exe

%AllUsersProfile%\<random characters>\HSE.ico

%AllUsersProfile%\<random characters>\HSESys

%AllUsersProfile%\<random characters>\Quarantine Items

%AllUsersProfile%\HSYITSQGE

%AllUsersProfile%\HSYITSQGE\HSLGILTOGE.cfg

%AppData%\Home Safety Essentials\

%AppData%\Home Safety Essentials\Instructions.ini

%AppData%\Home Safety Essentials\ScanDisk_.exe

%AppData%\Microsoft\Internet Explorer\Quick Launch\Home Safety Essentials.lnk

%AppData%\Microsoft\Windows\Recent\CLSV.tmp

%AppData%\Microsoft\Windows\Recent\DBOLE.dll

%AppData%\Microsoft\Windows\Recent\PE.sys

%AppData%\Microsoft\Windows\Recent\SICKBOY.drv

%AppData%\Microsoft\Windows\Recent\SICKBOY.sys

%AppData%\Microsoft\Windows\Recent\delfile.dll

%AppData%\Microsoft\Windows\Recent\eb.dll

%AppData%\Microsoft\Windows\Recent\eb.sys

%AppData%\Microsoft\Windows\Recent\energy.dll

%AppData%\Microsoft\Windows\Recent\gid.tmp

%AppData%\Microsoft\Windows\Recent\pal.sys

%AppData%\Microsoft\Windows\Recent\ppal.drv

%AppData%\Microsoft\Windows\Recent\runddlkey.exe

%AppData%\Microsoft\Windows\Recent\snl2w.drv

%AppData%\Microsoft\Windows\Start Menu\Programs\Home Safety Essentials.lnk

%AppData%\Microsoft\Windows\Start Menu\Home Safety Essentials.lnk

%UserProfile%\Desktop\Home Safety Essentials.lnk

Registry-Einträge von Home Safety Essentials:

Code:

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\91\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid    {137E7700-3573-11CF-AE69-08002B2E1262}

HKCU\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL    http://findgala.com/?&uid=231&q={searchTerms}

HKCU\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures    1

HKCU\Software\Microsoft\Internet Explorer\PRS    http://127.0.0.1:27777/?inj=%ORIGINAL%

HKCU\Software\Microsoft\Internet Explorer\SearchScopes\URL    http://findgala.com/?&uid=231&q={searchTerms}

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\89770803    

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\lib/5.00231    

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UID    231

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0    msseces.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1    MSASCui.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10    avgscanx.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11    avgcfgex.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12    avgemc.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13    avgchsvx.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14    avgcmgr.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15    avgwdsvc.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2    ekrn.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3    egui.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4    avgnt.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5    avcenter.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6    avscan.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7    avgfrw.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8    avgui.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9    avgtray.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun    1

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Home Safety Essentials    

HKLM\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}

HKLM\SOFTWARE\Classes\HS2d7_231.DocHostUIHandler

HKCU\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures    "no"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin    "2"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser    "2"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA    "1"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe

... <Many more Image File Execution Options entries>

Home Safety Essentials im HijackThis-Log:

Code:

O4 – HKCU\..\Run: [Home Safety Essentials] “%AllUsersProfile%\<random characters>\<random characters>_<random numbers>.exe” /s /d