Misstänkta objekt

25 mars, 2010

Jag har nyligen bytt säkerhetsprogram till Comodo Internet Security och vid skanning av datorn fick jag virusmeddelande. Datorn har successivt blivit segare med bl a långa hämtningstider av webbsidor, men det trodde jag hade med brandväggen att göra.

Efter att ha kört programmet DDS vet jag inta vad jag ska tro, för då fick jag meddelande om en ny trojan (se bifogad Comodo-fil).

(Det gick varken att bifoga filer eller förhandsgranska utan att koppla bort brandväggen!)

DDS (Ver_09-12-01.01) - NTFSx86

Run by GEST at 16:50:33,75 on 2010-03-14

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.511.116 [GMT 1:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\System32\gearsec.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program\PC Tools Firewall Plus\FWService.exe

C:\Program\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\fxssvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program\PC Tools Firewall Plus\FirewallGUI.exe

C:\Program\Microsoft Security Essentials\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Documents and Settings\GEST\Mina dokument\Hämtade filer\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.se/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot~1\SDHelper.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program\google\googletoolbar3.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program\google\googletoolbarnotifier\3.1.807.1746\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program\google\googletoolbar3.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [00PCTFW] "c:\program\pc tools firewall plus\FirewallGUI.exe" -s

mRun: [MSSE] "c:\program\microsoft security essentials\msseces.exe" -hide -runkey

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\program\delade~1\micros~1\dw\dwtrig20.exe" -t

IE: E&xportera till Microsoft Excel - c:\program\micros~3\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - {1FBA04EE-3024-11D2-8F1F-0000F87ABD16} c:\program\irfanview\ebay\ebay.htm - c:\program\irfanview\ebay\ebay.htm\inprocserver32 does not exist!

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} - hxxp://www.symantec.com/techsupp/activedata/nprdtinf.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099413911640

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-150-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program\delade filer\microsoft shared\web folders\PKMCDO.DLL

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\gest\applic~1\mozilla\firefox\profiles\lnsqzpnm.default\

FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:sv-SE:official

FF - plugin: c:\program\mozilla firefox\plugins\npdjvu.dll

FF - plugin: c:\program\personal\bin\np_prsnl.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 149040]

R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010-3-13 233136]

R1 SASDIFSV;SASDIFSV;c:\program\superantispyware\sasdifsv.sys [2006-12-11 5632]

R1 SASKUTIL;SASKUTIL;c:\program\superantispyware\SASKUTIL.SYS [2006-12-11 30720]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010-3-13 88040]

R2 PCToolsFirewallPlus;PC Tools Firewall Plus;c:\program\pc tools firewall plus\FWService.exe [2010-3-13 818432]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-3-13 70664]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2010-3-13 58816]

R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2010-3-13 115216]

R3 SASENUM;SASENUM;c:\program\superantispyware\SASENUM.SYS [2006-12-11 4096]

S2 Automatisk LiveUpdate-schemaläggare;Automatisk LiveUpdate-schemaläggare;"c:\program\symantec\liveupdate\aluschedulersvc.exe" --> c:\program\symantec\liveupdate\ALUSchedulerSvc.exe [?]

S3 G3GRSC;G3G R Smart Card;c:\windows\system32\drivers\g3grsc.sys [2006-6-21 18688]

S3 G3GRUMDM;G3G R USB Modem;c:\windows\system32\drivers\g3grumdm.sys [2006-6-21 27648]

S3 G3GRUSER;G3G R USB Serial;c:\windows\system32\drivers\g3gruser.sys [2006-6-21 24064]

S3 Tdsshbecr;Handelsbanken card reader;c:\windows\system32\drivers\shbecr.sys [2009-10-25 42368]

S3 Usblink;Usblink Driver;c:\windows\system32\drivers\ulink.sys [2005-5-5 40060]

S3 VNic;ULan Network Driver Module;c:\windows\system32\drivers\vnic.sys --> c:\windows\system32\drivers\VNic.sys [?]

=============== Created Last 30 ================

2010-03-14 07:10:17 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-03-14 07:10:17 215920 ----a-w- c:\windows\system32\muweb.dll

2010-03-14 07:10:17 17248 ----a-w- c:\windows\system32\mucltui.dll.mui

2010-03-13 22:13:11 181632 ------w- c:\windows\system32\MpSigStub.exe

2010-03-13 21:53:03 0 d-----w- c:\program\Microsoft Security Essentials

2010-03-13 21:51:56 0 d-----w- C:\afb4c9a73ae625070adcd410d3c105ae

2010-03-13 21:34:10 0 d-----w- c:\docume~1\gest\applic~1\PCToolsFirewallPlus

2010-03-13 21:32:00 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-03-13 21:32:00 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2010-03-13 21:32:00 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2010-03-13 21:32:00 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-03-13 21:31:58 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2010-03-13 21:31:58 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-03-13 21:31:05 7435 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.cat

2010-03-13 21:31:05 7399 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.cat

2010-03-13 21:31:05 70664 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2010-03-13 21:31:05 58816 ----a-w- c:\windows\system32\drivers\pctNdis.sys

2010-03-13 21:31:05 32680 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys

2010-03-13 21:31:05 0 d-----w- c:\program\delade filer\PC Tools

2010-03-13 21:31:01 7383 ----a-w- c:\windows\system32\drivers\pctplfw.cat

2010-03-13 21:31:01 115216 ----a-w- c:\windows\system32\drivers\pctplfw.sys

2010-03-13 21:30:59 0 d-----w- c:\program\PC Tools Firewall Plus

2010-02-21 20:08:33 0 d-----w- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2004-12-19 18:35:23 1154253 ----a-w- c:\program\image001.jpg

2003-04-24 02:00:00 94816 --sh--w- c:\windows\twain.dll

2008-04-14 16:04:53 50688 --sh--w- c:\windows\twain_32.dll

2008-04-14 16:04:41 1028096 --sha-w- c:\windows\system32\mfc42.dll

2008-04-14 16:04:44 57344 --sha-w- c:\windows\system32\msvcirt.dll

2008-04-14 16:04:44 413696 --sha-w- c:\windows\system32\msvcp60.dll

2008-04-14 16:04:44 343040 --sha-w- c:\windows\system32\msvcrt.dll

2008-04-14 16:04:47 551936 --sha-w- c:\windows\system32\oleaut32.dll

2008-04-14 16:04:47 84992 --sha-w- c:\windows\system32\olepro32.dll

2008-04-14 16:05:17 11776 --sha-w- c:\windows\system32\regsvr32.exe

2008-11-23 21:20:46 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008112320081124\index.dat

============= FINISH: 16:51:46,34 ===============Attach.txt Comodo-log.htm

25 mars, 2010

Det verkar vara gott om falsklarm i Comodo-loggen, men filen evP.exe som hela tiden återuppstår kan mycket väl vara skadlig. Det är filer i Comodos karantän som borde återställas.

På sidan http://www.virustotal.com trycker du på Bläddra-knappen och klistrar in följande filnamn i rutan, tryck på Skicka Fil och vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in resultatet från de olika antivirusprogrammen (inte Övrig information) eller en länk till resultatet här.

C:\Documents and Settings\GEST\Lokala inställningar\Temp\62.tmp\evP.exe

DDS-loggen är från 14 mars så gör en ny.

25 mars, 2010

Ja,det blev fel DDS-fil. Här är en ny:

DDS (Ver_10-03-17.01) - NTFSx86

Run by GEST at 19:59:40,39 on 2010-03-25

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.511.204 [GMT 1:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}

FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\Program\COMODO\COMODO livePCsupport\CLPSLS.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\System32\gearsec.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\fxssvc.exe

C:\Program\COMODO\COMODO Internet Security\cfp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Documents and Settings\GEST\Mina dokument\Hämtade filer\dds(2).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.se/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program\google\googletoolbar3.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program\google\googletoolbarnotifier\3.1.807.1746\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program\google\googletoolbar3.dll

TB: HopSurf toolbar: {e9fab13d-4600-49e1-90d1-ee961c859d39} - c:\program\comodo\hopsurftoolbar\HopSurfToolbar_IE.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [COMODO Internet Security] "c:\program\comodo\comodo internet security\cfp.exe" -h

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\program\delade~1\micros~1\dw\dwtrig20.exe" -t

IE: E&xportera till Microsoft Excel - c:\program\micros~3\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - {6BBCFF8E-D837-4DA4-9141-1F645B34A179} - c:\program\comodo\hopsurftoolbar\HopSurfToolbar_IE.dll