Sysinternals Antivirus entfernen

**AdminBot** · 03.06.2010, 12:17

Sysinternals Antivirus entfernen

Was ist Sysinternals Antivirus?
Sysinternals Antivirus gehört zur selben Malware-Famile wie Your PC Protector. Sysinternals Antivirus ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Sysinternals Antivirus) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.
Da solche Software wie Sysinternals Antivirus sich gegen jede Entfernung wehren wird und Sysinternals Antivirus oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Sysinternals Antivirus nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Symptome von Sysinternals Antivirus:

ständige Fake Virenmeldungen von Sysinternals Antivirus
PC läuft seit Sysinternals Antivirus langsamer als üblich

Fake-Meldungen von Sysinternals Antivirus:

Warning!
Running of application is impossible.<Application Name> is infected.

Security Alert
Infiltration Alert
Your computer is being attacked by an Internet Virus. It could be a password-stealing attack, a trojan-dropped or similar.

Warning: Infection is Detected
Windows has found spyware infection on your computer! Click here to update your WIndows antivirus software...

svchost.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
If you were in the middle of something, the information you were working on might be lost.
Please tell Microsoft about this problem.
We have created an error report that you can send to us. We will treat this report as confidential and anonymous.

Dateien von Sysinternals Antivirus:

Code:

ATTFilter

c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\lleod150
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmharun.log
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk

Registry-Einträge von Sysinternals Antivirus:

Code:

ATTFilter

HKEY_CURRENT_USER\Software\Sysinternals Antivirus
HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavapp"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavappr"

Sysinternals Antivirus im HijackThis-Log:

Code:

ATTFilter

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: ADC PlugIn - {149256D5-E103-4523-BB43-2CFB066839D6} - C:\Program Files\adc_w32.dll
O4 - HKCU\..\Run: [novavapp] %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe
O4 - HKCU\..\Run: [novavappr] %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F902301-D005-499E-8448-F9E2EC98B9A7}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{9239B395-78B0-4938-AC0D-692A7A7C682C}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{D3D77D58-5997-458E-A70C-892555CEEC52}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F902301-D005-499E-8448-F9E2EC98B9A7}: NameServer = 8.8.8.8
O23 - Service: Adobe Update Service (AdbUpd) - Unknown owner - C:\Program Files\svchost.exe

Sysinternals Antivirus entfernen

Anleitungen, FAQs & Links: Sysinternals Antivirus entfernen

Sysinternals Antivirus entfernen

Ähnliche Themen: Sysinternals Antivirus entfernen