Digital Protection entfernen


Was ist Digital Protection?
Digital Protection gehört zur selben Malware-Familie wie Your Protection. Digital Protection ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines trojanischen Pferdes in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Digital Protection) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Verbreitet wird Digital Protection nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).




Symptome von Digital Protection:

• ständige Fake Virenmeldungen von Digital Protection
• PC läuft langsamer als üblich
• Stoppt / Verhindert folgene Software:

• F-Secure
• NOD32
• Malwarebytes' Anti-Malware
• Norton Internet Security
• Avira AntiVir
• AVG8
• AntiVir
• Agnitum Outpost Security Suite
• avast!

DANGEROUS! ANTIVIRUS DETECTED SOME HARMFUL PROGRAMS ON YOUR PC! THEY MAY CORRUPT YOUR INFORMATION OR SEND IT TO HACKERS.

A security threat detected on your computer! This malicious program may steal your private data. Click on the message to ensure the protection of your computer.

Harmful viruses detected on your computer. This malicious software may harm your computer. Click on the message to ensure the protection of your computer.

A security threat detected on your computer. TrojanASPX.JS.Win32. It strongly recommended to remove this threat right now. Click on the message to remove it.

Unauthorized person tries to steal your passwords and private information. Click on the message to prevent identity theft.

System files of your computer are damaged. Please, restart your system ASAP.


Warning! Virus threat detected!
Virus activity detected!
Trojan-Clicker.Win32 adware has been detected. This adware module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click the button below to locate and remove this threat now.

Dateien von Digital Protection:

c:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Digital Protection.lnk
%UserProfile%\Desktop\Digital Protection Support.lnk
%UserProfile%\Desktop\Digital Protection.lnk
%UserProfile%\Start Menu\Programs\Digital Protection
%UserProfile%\Start Menu\Programs\Digital Protection\About.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Activate.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Buy.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Digital Protection Support.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Digital Protection.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Scan.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Settings.lnk
%UserProfile%\Start Menu\Programs\Digital Protection\Update.lnk
c:\Program Files\Digital Protection
c:\Program Files\Digital Protection\about.ico
c:\Program Files\Digital Protection\activate.ico
c:\Program Files\Digital Protection\buy.ico
c:\Program Files\Digital Protection\dig.db
c:\Program Files\Digital Protection\digext.dll
c:\Program Files\Digital Protection\dighook.dll
c:\Program Files\Digital Protection\digprot.exe
c:\Program Files\Digital Protection\help.ico
c:\Program Files\Digital Protection\scan.ico
c:\Program Files\Digital Protection\settings.ico
c:\Program Files\Digital Protection\splash.mp3
c:\Program Files\Digital Protection\Uninstall.exe
c:\Program Files\Digital Protection\update.ico
c:\Program Files\Digital Protection\virus.mp3
%Temp%\4otjesjty.mof
%Temp%\asd1.tmp
%Temp%\c865.tmp
%Temp%\davclnt.exe
%Temp%\dhdhtrdhdrtr5y
%Temp%\dig.dat
%Temp%\digr.dat
         

Registry-Einträge von Digital Protection:

HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKEY_LOCAL_MACHINE\SOFTWARE\Digital Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Digital Protection
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Digital Protection"
         

Digital Protection im HijackThis-Log:

O4 - HKCU\..\Run: [Digital Protection] "C:\Program Files\Digital Protection\digprot.exe" -noscan
         

Digital Protection entfernen

Abgesicherter Modus zur Bereinigung

• Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
• Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:
  
  

• Starte einen vollständigen Scan mit Malwarebytes Anti-Malware

Achtung: Diese Fake Software wird versuchen, den Einsatz von Malwarebytes zu verhindern. Benenne das Setup vor dem speichern in etwas anderes um (z.B. Herbert.exe).

Falls es vorher nicht funktioniert hat, sollte das Setup jetzt starten.

Wenn das Programm nach der Installation nicht starten sollte, dann benenne die "mbam.exe" in "herbert.exe" um und versuche es erneut.

Sollte MBAM trotzdem nicht starten: Malwarebytes Anti-Malware startet nicht

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 22

Memory Processes Infected:
C:\Users\{username}\AppData\Local\Temp\Digital Protection\digprot.exe (Malware.Packer.Gen) -> Unloaded process successfully.

Memory Modules Infected:
C:\Users\{username}\AppData\Local\Temp\Digital Protection\dighook.dll (Malware.Packer.Gen) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\digital protection (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\davclnt.exe (Rogue.DigitalProtection) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection (Rogue.DigitalProtection) -> Quarantined and deleted successfully.

Files Infected:
C:\Users\{username}\AppData\Local\Temp\Digital Protection\dighook.dll (Malware.Packer.Gen) -> Delete on reboot.
C:\Users\{username}\AppData\Local\Temp\Digital Protection\digprot.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\E4CF.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\asd58DB.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\dhdhtrdhdrtr5y (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\PRAGMAaa9.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\TMPE38E.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\Digital Protection\digext.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\Digital Protection\Uninstall.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\About.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Activate.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Buy.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Digital Protection Support.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Digital Protection.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Scan.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Settings.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digital Protection\Update.lnk (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Digital Protection.LNK (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\Desktop\Digital Protection.LNK (Rogue.DigitalProtection) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Local\Temp\davclnt.exe (Rogue.DigitalProtection) -> Delete on reboot.
C:\Users\{username}\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\ProgramData\fiosejgfse.dll (Rogue.Trace) -> Quarantined and deleted successfully.
         

Digital Protection immer noch nicht entfernt?

OTH - OTHelper - Kill All Processes


Mit aktualisiertem (!!) Malwarebytes Anti-Malware nach Ausführen von OTH nochmal QUICKSCAN ausführen.

Bitte alle temporären Dateien löschen und Speicherplatz freigeben.

Weitergehende Prüfung

Das System könnte noch nicht vollständig sauber sein.

Daher unbedingt ein Thema erstellen: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Nicht vergessen mit FRST-Logfiles wie in der Anleitung beschrieben.

Wie man Hilfe bekommt steht auch hier.