Trojaner-Board - Strong Malware Defender entfernen

Strong Malware Defender entfernen

Was ist Strong Malware Defender?
Strong Malware Defender ist Teil der Malware the Rogue.VirusDoctor. Strong Malware Defender ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Strong Malware Defender) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Da solche Software wie Strong Malware Defender sich gegen jede Entfernung wehren wird und Strong Malware Defender oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Scareware wie Strong Malware Defender nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!

http://www.trojaner-board.de/attachm...1&d=1330051051 http://www.trojaner-board.de/attachm...1&d=1330051051

http://www.trojaner-board.de/attachm...1&d=1330051051

Symptome von Strong Malware Defender:

ständige Fake Virenmeldungen von Strong Malware Defender
PC läuft seit Strong Malware Defender langsamer als üblich

http://www.trojaner-board.de/attachm...1&d=1330051051

Fake-Meldungen von Strong Malware Defender:

%UserProfile%\Recent\CLSV.sys
%UserProfile%\Recent\DBOLE.tmp
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\eb.drv
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\fix.sys
%UserProfile%\Recent\grid.sys
%UserProfile%\Recent\kernel32.tmp
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\ppal.sys
%UserProfile%\Recent\tjd.dll
System Alert
Potentially harmful programs have been detected in your system and need to be dealt with immediately. Click here to remove them using Strong Malware Defender.

Warning! Access conflict detected!
An unidentified program is trying to access system process address space.
Process Name: AllowedForm
Location: C:\Windows\...\taskmgr.exe

Warning! Identity theft attempt detected

Warning! Virus detected
Threat Detected: Trojan-PSW.VBS.Half
Description: This is a VBScript-virus. It steals user's passwords.

Dateien von Strong Malware Defender:

Code:

%AppData%\Strong Malware Defender\

%AppData%\Strong Malware Defender\cookies.sqlite

%AppData%\Strong Malware Defender\Instructions.ini

%AppData%\Strong Malware Defender\ScanDisk_.exe

%AppData%\Microsoft\Internet Explorer\Quick Launch\Strong Malware Defender.lnk

%CommonAppData%\79b35\

%CommonAppData%\79b35\SMa76.exe

%CommonAppData%\79b35\SMD.ico

%CommonAppData%\79b35\717.mof

%CommonAppData%\79b35\mozcrt19.dll

%CommonAppData%\79b35\sqlite3.dll

%CommonAppData%\79b35\BackUp\

%CommonAppData%\79b35\HMCSys\

%CommonAppData%\79b35\Quarantine Items\

%CommonAppData%\SMICFD\

%CommonAppData%\SMICFD\SMSIFRIED.cfg

%StartMenu%\Strong Malware Defender.lnk

%StartMenu%\Programs\Strong Malware Defender.lnk

%UserProfile%\Desktop\Strong Malware Defender.lnk

%UserProfile%\Recent\CLSV.sys

%UserProfile%\Recent\DBOLE.tmp

%UserProfile%\Recent\ddv.dll

%UserProfile%\Recent\eb.drv

%UserProfile%\Recent\energy.tmp

%UserProfile%\Recent\fix.sys

%UserProfile%\Recent\grid.sys

%UserProfile%\Recent\kernel32.tmp

%UserProfile%\Recent\PE.exe

%UserProfile%\Recent\PE.tmp

%UserProfile%\Recent\ppal.sys

%UserProfile%\Recent\tjd.dll

Registry-Einträge von Strong Malware Defender:

Code:

HKEY_CURRENT_USER\Software\3

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}

HKEY_CLASSES_ROOT\dumped_patched.DocHostUIHandler

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=7&q={searchTerms}"

HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=7&q={searchTerms}"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "IIL" = 0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "ltHI" = 0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "ltTST"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = 1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "UID" = 7

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "lib/7.00007"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "DisallowRun" = 1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "0" = "msseces.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "1" = "MSASCui.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "2" = "ekrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "3" = "egui.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "4" = "avgnt.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "5" = "avcenter.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "6" = "avscan.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "7" = "avgfrw.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "8" = "avgui.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "9" = "avgtray.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "10" = "avgscanx.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "11" = "avgcfgex.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "12" = "avgemc.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "13" = "avgchsvx.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "14" = "avgcmgr.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "15" = "avgwdsvc.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Strong Malware Defender"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgiproxy.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pgmonitr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\signcheck.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe

... and many more Image File Execution Options entries.

Strong Malware Defender im HijackThis-Log:

Code:

O4 - HKCU\..\Run: [Strong Malware Defender] "%CommonAppData%\79b35\SMa76.exe" /s /d