Trojaner-Board - Antivirus Studio 2010 entfernen

Antivirus Studio 2010 entfernen

Was ist Antivirus Studio 2010?
Antivirus Studio 2010 ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Antivirus Studio 2010) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Da solche Software wie Antivirus Studio 2010 sich gegen jede Entfernung wehren wird und Antivirus Studio 2010 oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Scareware wie Antivirus Studio 2010 nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!

http://www.trojaner-board.de/attachm...1&d=1286237122 http://www.trojaner-board.de/attachm...1&d=1286237122

Symptome von Antivirus Studio 2010:

ständige Fake Virenmeldungen von Antivirus Studio 2010
PC läuft seit Antivirus Studio 2010 langsamer als üblich

Fake-Meldungen von Antivirus Studio 2010:

http://www.trojaner-board.de/attachm...1&d=1286237122 http://www.trojaner-board.de/attachm...1&d=1286237122
http://www.trojaner-board.de/attachm...1&d=1286237122 http://www.trojaner-board.de/attachm...1&d=1286237122

Warning!
Your computer is being used as spamming machine. You can get sued for spam.
Your computer WILL BE DISCONNECTED FORM INTERNET BECAUSE SPAMMING OTHER PCs

Antivirus Studio Agent
The antivirus database has become outdated and should be updated now. Click on this message to receive the latest antivirus updates.

Program <insert filename here> is infected with virus Generic Dropper.js. Continue running this program may be dangerous to your computer and personal data. Running this program can lead to permanent data loss and program instability. Would you like to disinfect this program with antivirus?

Your computer might be at risk
Antivirus detects viruses, worms, and Trojan horses. They can (and do) destroy data, format your hard disk or can destroy the BIOS. By destroying the BIOS many times you end up buying a new motherboard or if the bios chip is removable then that chip would need replacing.

To help protect your computer, Security Center has blocked some features of this program.
Do you want to block this suspicious software?
Name: Screen.Grab.J.exe
Risk: High

Unauthorized remote connection!
Your system is making an unauthorized personal data transfer to remote computer!
Warning! Unauthorized personal data transfer Is detected! It may be your personal credit card details, logins and passwords, browsing habits or information about files you have downloaded.

Warning
Are you wish to keep this ILLEGAL FILE on your computer ? This can lead to private data steal such as passwords,
and credit cards by cyber criminals. Your facebook, paypal and ebay account can be used by the hackers!Are you still willing to keep this DANGEROUS FILE on your computer, or DISINFECT IT USING DESKTOP SECURITY.

Security Center
No firewall is turned on
Automatic Updates is turned off
Antivirus software might not be activated
Click this balloon to fix this problem.

Reported Insecure Browsing: Navigation Blocked
Insecure Internet Activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms, and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes. Also insecure Internet activity can result in revealing your personal information.

http://www.trojaner-board.de/attachm...1&d=1286237122 http://www.trojaner-board.de/attachm...1&d=1286237122
http://www.trojaner-board.de/attachm...1&d=1286237122

Dateien von Antivirus Studio 2010:

Code:

%Temp%\02c9c3c35bdx5.exe

%Temp%\17dkf.exe

%Temp%\1iowieoo.exe

%Temp%\2010yo.exe

%Temp%\472a10e2ebxd9.exe

%Temp%\56493.exe

%Temp%\8gmsed-bd.exe

%Temp%\a75wef8e0e7.exe

%Temp%\ae0965a7157cd.exe

%Temp%\al3erfa3.exe

%Temp%\aler3fa.exe

%Temp%\alerfa.exe

%Temp%\alerfa2.exe

%Temp%\alerfa322.exe

%Temp%\aqfitrlxi2.exe

%Temp%\backd-efq.exe

%Temp%\brdss.exe

%Temp%\bzqa43d.exe

%Temp%\cffd4.exe

%Temp%\cosock.exe

%Temp%\cowceb.exe

%Temp%\cunifuc.exe

%Temp%\dc_3.exe

%Temp%\dd10x10.exe

%Temp%\ddhelp.exe

%Temp%\ddoll3342.exe

%Temp%\destroyer.exe

%Temp%\dkfjd93.exe

%Temp%\ds7hw.exe

%Temp%\dwl_bqz.exe

%Temp%\eelnvd13.exe

%Temp%\eephilpe.exe

%Temp%\exppdf_w.exe

%Temp%\fadz43.exe

%Temp%\fe.exe

%Temp%\format.exe

%Temp%\g_dx234.exe

%Temp%\gedx_ae09.exe

%Temp%\gpdfsws_bbg.exe

%Temp%\gpupz2a.exe

%Temp%\hardwh.exe

%Temp%\hhbboll_2.exe

%Temp%\hiphop.exe

%Temp%\hjkgfddd.exe

%Temp%\hodeme.exe

%Temp%\htfad4.exe

%Temp%\hvipws9.exe

%Temp%\jdhellwo3.exe

%Temp%\jofcdks.exe

%Temp%\kgn.exe

%Temp%\kilslmd.exex

%Temp%\kjdh_gf_jjdhgd.exe

%Temp%\kjh102k3.exe

%Temp%\kn.a.exe

%Temp%\kock.exe

%Temp%\ljts-23.exe

%Temp%\lkhgg_ea.exe

%Temp%\lols.exe

%Temp%\lorsk.exe

%Temp%\ploper.exe

%Temp%\poertd.exe

%Temp%\ppddfcfux.exxe

%Temp%\pswwg3c.exe

%Temp%\puzpup.exe

%Temp%\qwedvor.exe

%Temp%\qwklrvjhqlkj.exe

%Temp%\r0life.exe

%Temp%\rator.exe

%Temp%\rsrtd12.exe

%Temp%\rtfme.exe

%Temp%\safe.exe

%Temp%\snowif.exe

%Temp%\sycre.exe

%Temp%\test.exe

%Temp%\timem.exe

%Temp%\w32-reno-c.exe

%Temp%\warsddd_w.exe

%Temp%\wefgetn_00.exe

%Temp%\wergfq.exe

%Temp%\wined.exe

%Temp%\winlogoff.exe

%Temp%\wqefqw7e.exe

%Temp%\wrcud12.exe

%Temp%\wrfwe_di.exe

%Temp%\wwautrsd.exe

%Temp%\wwwsssgen.exe

%UserProfile%\Application Data\AntiVirus Studio 2010\

%UserProfile%\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe

%UserProfile%\Application Data\AntiVirus Studio 2010\securitycenter.exe

%UserProfile%\Application Data\AntiVirus Studio 2010\securityhelper.exe

%UserProfile%\Application Data\AntiVirus Studio 2010\taskmgr.dll

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Studio 2010.lnk

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010.lnk

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\Activate AntiVirus Studio 2010.lnk

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\AntiVirus Studio 2010.lnk

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\Help AntiVirus Studio 2010.lnk

%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\How to Activate AntiVirus Studio 2010.lnk

Registry-Einträge von Antivirus Studio 2010:

Code:

HKEY_CURRENT_USER\Software\AntiVirus Studio 2010

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus Studio 2010

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "2kowmeuswvw3"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "AntiVirus Studio 2010"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SecurityCenter"

Antivirus Studio 2010 im HijackThis-Log:

Code:

O4 - HKCU\..\Run: [AntiVirus Studio 2010] "%UserProfile%\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe" /STARTUP

O4 - HKCU\..\Run: [SecurityCenter] %UserProfile%\Application Data\AntiVirus Studio 2010\securitycenter.exe

Antivirus Studio 2010 entfernen

Tool: rkill.com Download Link (umbenannt: iExplore.exe) von Grinler herunterladen und mit doppelklick ausführen.

Sollte rkill.com nicht starten, versuche es mit der umbenannten Version iExplore.exe

http://www.trojaner-board.de/attachm...aning-tool.png

Das Tool stoppt alle Prozesse von Antivirus Studio 2010.

Bei Bedarf mehrmals ausführen, bis alle ungewünschten Prozesse beendet wurden.

Starte einen vollständigen Scan mit Malwarebytes Anti-Malware

Achtung: Diese Fake Software wird versuchen, den Einsatz von Malwarebytes zu verhindern. Benenne das Setup vor dem speichern in etwas anderes um (z.B. Herbert.exe).

Falls es vorher nicht funktioniert hat, sollte das Setup jetzt starten.

Wenn das Programm nach der Installation nicht starten sollte, dann benenne die "mbam.exe" in "herbert.exe" um und versuche es erneut.

Sollte MBAM trotzdem nicht starten: Malwarebytes Anti-Malware startet nicht

http://www.trojaner-board.de/attachm...ntfernen-2.png

http://www.trojaner-board.de/attachm...1&d=1286237408

Code:

Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 3 Folders Infected: 2 Files Infected: 62 Memory Processes Infected: C:\Documents and Settings\{username}\Desktop\load.exe (Trojan.Agent) -> Unloaded process successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe (Rogue.AntivirusStudio) -> Unloaded process successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securitycenter.exe (Rogue.AntivirusStudio) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45cwseuwf8sk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\securitycenter (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\{username}\Desktop\load.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securitycenter.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securityhelper.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\taskmgr.dll (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\Activate AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\Help AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\How to Activate AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010.LNK (Rogue.AntivirusStudio2010) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Studio 2010.LNK (Rogue.AntivirusStudio2010) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\02c9c3c35bdx5.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\17dkf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\472a10e2ebxd9.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\56493.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\8gmsed-bd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\ae0965a7157cd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\al3erfa3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\alerfa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\backd-efq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\bzqa43d.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\cocksucker.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\cosock.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\cunifuc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\dc_3.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\dd10x10.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\ddhelp.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\ddoll3342.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\dkfjd93.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\ds7hw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\eelnvd13.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\eephilpe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\exppdf_w.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\fe.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\gedx_ae09.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\gpupz2a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\hardwh.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\hhbboll_2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\hiphop.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\hodeme.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\hvipws9.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\jdhellwo3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\jofcdks.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\kilslmd.exex (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\kjdh_gf_jjdhgd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\lols.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\lorsk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\ppddfcfux.exxe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\pswwg3c.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\qwedvor.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\qwklrvjhqlkj.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\r0life.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\rator.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\snowif.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\sycre.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\test.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\timem.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\wergfq.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\winlogoff.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\wqefqw7e.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\wrcud12.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\{username}\Local Settings\Temp\wrfwe_di.exe (Trojan.Downloader) -> Quarantined and deleted successfully.