Antivirus Studio 2010 entfernen


Was ist Antivirus Studio 2010?
Antivirus Studio 2010 ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Antivirus Studio 2010) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Da solche Software wie Antivirus Studio 2010 sich gegen jede Entfernung wehren wird und Antivirus Studio 2010 oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Scareware wie Antivirus Studio 2010 nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!



Symptome von Antivirus Studio 2010:

• ständige Fake Virenmeldungen von Antivirus Studio 2010
• PC läuft seit Antivirus Studio 2010 langsamer als üblich

Fake-Meldungen von Antivirus Studio 2010:

Warning!
Your computer is being used as spamming machine. You can get sued for spam.
Your computer WILL BE DISCONNECTED FORM INTERNET BECAUSE SPAMMING OTHER PCs

Antivirus Studio Agent
The antivirus database has become outdated and should be updated now. Click on this message to receive the latest antivirus updates.

Program <insert filename here> is infected with virus Generic Dropper.js. Continue running this program may be dangerous to your computer and personal data. Running this program can lead to permanent data loss and program instability. Would you like to disinfect this program with antivirus?

Your computer might be at risk
Antivirus detects viruses, worms, and Trojan horses. They can (and do) destroy data, format your hard disk or can destroy the BIOS. By destroying the BIOS many times you end up buying a new motherboard or if the bios chip is removable then that chip would need replacing.

To help protect your computer, Security Center has blocked some features of this program.
Do you want to block this suspicious software?
Name: Screen.Grab.J.exe
Risk: High

Unauthorized remote connection!
Your system is making an unauthorized personal data transfer to remote computer!
Warning! Unauthorized personal data transfer Is detected! It may be your personal credit card details, logins and passwords, browsing habits or information about files you have downloaded.

Warning
Are you wish to keep this ILLEGAL FILE on your computer ? This can lead to private data steal such as passwords,
and credit cards by cyber criminals. Your facebook, paypal and ebay account can be used by the hackers!Are you still willing to keep this DANGEROUS FILE on your computer, or DISINFECT IT USING DESKTOP SECURITY.

Security Center
No firewall is turned on
Automatic Updates is turned off
Antivirus software might not be activated
Click this balloon to fix this problem.


Reported Insecure Browsing: Navigation Blocked
Insecure Internet Activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms, and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes. Also insecure Internet activity can result in revealing your personal information.

Dateien von Antivirus Studio 2010:

%Temp%\02c9c3c35bdx5.exe
%Temp%\17dkf.exe
%Temp%\1iowieoo.exe
%Temp%\2010yo.exe
%Temp%\472a10e2ebxd9.exe
%Temp%\56493.exe
%Temp%\8gmsed-bd.exe
%Temp%\a75wef8e0e7.exe
%Temp%\ae0965a7157cd.exe
%Temp%\al3erfa3.exe
%Temp%\aler3fa.exe
%Temp%\alerfa.exe
%Temp%\alerfa2.exe
%Temp%\alerfa322.exe
%Temp%\aqfitrlxi2.exe
%Temp%\backd-efq.exe
%Temp%\brdss.exe
%Temp%\bzqa43d.exe
%Temp%\cffd4.exe
%Temp%\cosock.exe
%Temp%\cowceb.exe
%Temp%\cunifuc.exe
%Temp%\dc_3.exe
%Temp%\dd10x10.exe
%Temp%\ddhelp.exe
%Temp%\ddoll3342.exe
%Temp%\destroyer.exe
%Temp%\dkfjd93.exe
%Temp%\ds7hw.exe
%Temp%\dwl_bqz.exe
%Temp%\eelnvd13.exe
%Temp%\eephilpe.exe
%Temp%\exppdf_w.exe
%Temp%\fadz43.exe
%Temp%\fe.exe
%Temp%\format.exe
%Temp%\g_dx234.exe
%Temp%\gedx_ae09.exe
%Temp%\gpdfsws_bbg.exe
%Temp%\gpupz2a.exe
%Temp%\hardwh.exe
%Temp%\hhbboll_2.exe
%Temp%\hiphop.exe
%Temp%\hjkgfddd.exe
%Temp%\hodeme.exe
%Temp%\htfad4.exe
%Temp%\hvipws9.exe
%Temp%\jdhellwo3.exe
%Temp%\jofcdks.exe
%Temp%\kgn.exe
%Temp%\kilslmd.exex
%Temp%\kjdh_gf_jjdhgd.exe
%Temp%\kjh102k3.exe
%Temp%\kn.a.exe
%Temp%\kock.exe
%Temp%\ljts-23.exe
%Temp%\lkhgg_ea.exe
%Temp%\lols.exe
%Temp%\lorsk.exe
%Temp%\ploper.exe
%Temp%\poertd.exe
%Temp%\ppddfcfux.exxe
%Temp%\pswwg3c.exe
%Temp%\puzpup.exe
%Temp%\qwedvor.exe
%Temp%\qwklrvjhqlkj.exe
%Temp%\r0life.exe
%Temp%\rator.exe
%Temp%\rsrtd12.exe
%Temp%\rtfme.exe
%Temp%\safe.exe
%Temp%\snowif.exe
%Temp%\sycre.exe
%Temp%\test.exe
%Temp%\timem.exe
%Temp%\w32-reno-c.exe
%Temp%\warsddd_w.exe
%Temp%\wefgetn_00.exe
%Temp%\wergfq.exe
%Temp%\wined.exe
%Temp%\winlogoff.exe
%Temp%\wqefqw7e.exe
%Temp%\wrcud12.exe
%Temp%\wrfwe_di.exe
%Temp%\wwautrsd.exe
%Temp%\wwwsssgen.exe
%UserProfile%\Application Data\AntiVirus Studio 2010\
%UserProfile%\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe
%UserProfile%\Application Data\AntiVirus Studio 2010\securitycenter.exe
%UserProfile%\Application Data\AntiVirus Studio 2010\securityhelper.exe
%UserProfile%\Application Data\AntiVirus Studio 2010\taskmgr.dll
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Studio 2010.lnk
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010.lnk
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\Activate AntiVirus Studio 2010.lnk
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\AntiVirus Studio 2010.lnk
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\Help AntiVirus Studio 2010.lnk
%UserProfile%\Start Menu\Programs\AntiVirus Studio 2010\How to Activate AntiVirus Studio 2010.lnk
         

Registry-Einträge von Antivirus Studio 2010:

HKEY_CURRENT_USER\Software\AntiVirus Studio 2010
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus Studio 2010
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "2kowmeuswvw3"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "AntiVirus Studio 2010"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SecurityCenter"
         

Antivirus Studio 2010 im HijackThis-Log:

O4 - HKCU\..\Run: [AntiVirus Studio 2010] "%UserProfile%\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe" /STARTUP
O4 - HKCU\..\Run: [SecurityCenter] %UserProfile%\Application Data\AntiVirus Studio 2010\securitycenter.exe
         

Antivirus Studio 2010 entfernen

• Tool: rkill.com Download Link (umbenannt: iExplore.exe) von Grinler herunterladen und mit doppelklick ausführen.
  
  Sollte rkill.com nicht starten, versuche es mit der umbenannten Version iExplore.exe
  
  
  
  
  
  Das Tool stoppt alle Prozesse von Antivirus Studio 2010.
  
  Bei Bedarf mehrmals ausführen, bis alle ungewünschten Prozesse beendet wurden.

• Starte einen vollständigen Scan mit Malwarebytes Anti-Malware

Achtung: Diese Fake Software wird versuchen, den Einsatz von Malwarebytes zu verhindern. Benenne das Setup vor dem speichern in etwas anderes um (z.B. Herbert.exe).

Falls es vorher nicht funktioniert hat, sollte das Setup jetzt starten.

Wenn das Programm nach der Installation nicht starten sollte, dann benenne die "mbam.exe" in "herbert.exe" um und versuche es erneut.

Sollte MBAM trotzdem nicht starten: Malwarebytes Anti-Malware startet nicht

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 3
Folders Infected: 2
Files Infected: 62

Memory Processes Infected:
C:\Documents and Settings\{username}\Desktop\load.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe (Rogue.AntivirusStudio) -> Unloaded process successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securitycenter.exe (Rogue.AntivirusStudio) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45cwseuwf8sk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\securitycenter (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010 (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\{username}\Desktop\load.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\AntiVirus Studio 2010.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securitycenter.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\securityhelper.exe (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Application Data\AntiVirus Studio 2010\taskmgr.dll (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\Activate AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\Help AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010\How to Activate AntiVirus Studio 2010.lnk (Rogue.AntivirusStudio) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Start Menu\Programs\AntiVirus Studio 2010.LNK (Rogue.AntivirusStudio2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Studio 2010.LNK (Rogue.AntivirusStudio2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\02c9c3c35bdx5.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\17dkf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\472a10e2ebxd9.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\56493.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\8gmsed-bd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\ae0965a7157cd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\al3erfa3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\alerfa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\backd-efq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\bzqa43d.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\cocksucker.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\cosock.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\cunifuc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\dc_3.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\dd10x10.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\ddhelp.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\ddoll3342.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\dkfjd93.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\ds7hw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\eelnvd13.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\eephilpe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\exppdf_w.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\fe.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\gedx_ae09.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\gpupz2a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\hardwh.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\hhbboll_2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\hiphop.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\hodeme.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\hvipws9.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\jdhellwo3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\jofcdks.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\kilslmd.exex (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\kjdh_gf_jjdhgd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\lols.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\lorsk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\ppddfcfux.exxe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\pswwg3c.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\qwedvor.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\qwklrvjhqlkj.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\r0life.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\rator.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\snowif.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\sycre.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\test.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\timem.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\wergfq.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\winlogoff.exe (Trojan.FakeSmoke) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\wqefqw7e.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\wrcud12.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\{username}\Local Settings\Temp\wrfwe_di.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
         

Antivirus Studio 2010 immer noch nicht entfernt?

OTH - OTHelper - Kill All Processes


Mit aktualisiertem (!!) Malwarebytes Anti-Malware nach Ausführen von OTH nochmal QUICKSCAN ausführen.

Bitte alle temporären Dateien löschen und Speicherplatz freigeben.

Weitergehende Prüfung

Das System könnte noch nicht vollständig sauber sein.

Daher unbedingt ein Thema erstellen: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Nicht vergessen mit FRST-Logfiles wie in der Anleitung beschrieben.

Wie man Hilfe bekommt steht auch hier.