Trojaner med mer etter OS-nedlasting

[Peppep]

Etter å ha vært virusfri i åresvis, greide jeg muligens å få noe grums med da jeg skulle oppdatere Windows 7. Lastet ned en ISO som jeg var sikker på var ekte, men Avira er visst ikke enig.

 

Virus or unwanted program 'TR/Crypt.ZPACK.Gen [trojan]'

detected in file 'Z:\Users\BHS\AppData\Local\Temp\codeclc.exe.

Action performed: Deny access

 

 

MBAM fant ingenting, og Combofix vil ikke kjøre på Windows 7. Legger derfor ved logger fra MBAM og HJT i stedet.

 

MBAM:

Klikk for å se/fjerne innholdet nedenfor

Malwarebytes' Anti-Malware 1.36

Database version: 1954

Windows 6.1.7022

 

09.04.2009 06:33:47

mbam-log-2009-04-09 (06-33-47).txt

 

Scan type: Quick Scan

Objects scanned: 60710

Time elapsed: 4 minute(s), 37 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

(No malicious items detected)

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

(No malicious items detected)

 

HJT:

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 06:38:08, on 09.04.2009

Platform: Unknown Windows (WinNT 6.01.2926)

MSIE: Internet Explorer v8.00 (8.00.7022.0000)

Boot mode: Normal

 

Running processes:

Z:\Windows\system32\taskhost.exe

Z:\Windows\system32\Dwm.exe

Z:\Windows\OEM04Mon.exe

Z:\Program Files\Synaptics\SynTP\SynTPEnh.exe

Z:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe

Z:\Windows\WindowsMobile\wmdc.exe

Z:\Windows\System32\rundll32.exe

Z:\Windows\System32\rundll32.exe

Z:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

Z:\Program Files\Java\jre6\bin\jusched.exe

Z:\Program Files\Avira\AntiVir Desktop\avgnt.exe

Z:\Program Files\Windows Live\Messenger\msnmsgr.exe

Z:\Program Files\Windows Sidebar\sidebar.exe

Z:\Program Files\Dell\QuickSet\quickset.exe

Z:\Program Files\Synaptics\SynTP\SynTPHelper.exe

Z:\Program Files\Windows Live\Contacts\wlcomm.exe

Z:\Windows\system32\taskhost.exe

Z:\Program Files\uTorrent\uTorrent.exe

Z:\Program Files\PowerISO\PWRISOVM.EXE

Z:\Windows\Explorer.EXE

Z:\Program Files\Opera 10 Preview\opera.exe

Z:\Windows\system32\NOTEPAD.EXE

Z:\Windows\system32\SearchFilterHost.exe

Z:\Users\BHS\Desktop\H--J--T.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - Z:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - Z:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - Z:\Program Files\Google\Google Gears\Internet Explorer.5.4.2\gears.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O4 - HKLM\..\Run: [OEM04Mon.exe] Z:\Windows\OEM04Mon.exe

O4 - HKLM\..\Run: [synTPEnh] Z:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "Z:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE Z:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE Z:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe Z:\Windows\system32\nvHotkey.dll,Start

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "Z:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "Z:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "Z:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "Z:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [msnmsgr] "Z:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [sidebar] Z:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] Z:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] Z:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: QuickSet.lnk = Z:\Program Files\Dell\QuickSet\quickset.exe

O8 - Extra context menu item: Append Link Target to Existing PDF - res://Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://Z:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://Z:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - Z:\Program Files\Google\Google Gears\Internet Explorer.5.4.2\gears.dll

O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - Z:\Program Files\Google\Google Gears\Internet Explorer.5.4.2\gears.dll

O9 - Extra button: @Z:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - Z:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - Z:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @Z:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - Z:\Windows\WindowsMobile\INetRepl.dll

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Z:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - Z:\Windows\system32\aestsrv.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - Z:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - Z:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - Z:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate1c9b2048b7ee79a) (gupdate1c9b2048b7ee79a) - Google Inc. - Z:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - Z:\Windows\system32\nvvsvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - Z:\Windows\system32\STacSV.exe

 

--

End of file - 7511 bytes

 

Er avira overivrig (alle innstillinger er på default), eller er det noe reelt?

 

Takk for hjelpen.

Endret 9. april 2009 av Peppep

[Svenni212000]

Kan vell kort si at jeg da har en dårlig og en god nyhet.

Den dårlige nyheten er at trojaneren er ekte og er satt til ekstrem høy sikkerhetsrisiko.

Selveste trojaneren ligger antaglivis i en activation patch eller lignende.

Den gode nyheten er at det ikke er tegn til infeksjoner på din PC. Ser ut til at Avira har effektivt satt en stopper for trojaneren. Jeg ville dog kjørt CCleaner med sikker filsletting for å bli kvitt temp og andre skrotfiler, samt å kjøre en skann gjennom systemet med Avira. Dette bare for å kontrollere at alt er OK.

[Peppep]

Det er det jeg ikke skjønner, for man trenger ikke activation patch til Windows 7, MS har gitt ut lovlige nøkler. Men jeg tror deg selvfølgelig, skal kjøre gjennom full scan med CCleaner og Avira. Tusen takk.

Endret 9. april 2009 av Peppep

[Bytex]

Ingen anelse, jeg trengte ingen activation patch når jeg la inn windows 7. Det aktiverte seg selv når jeg gikk online fordi jeg brukte en gyldig beta-key.

[PerB]

Etter å ha vært virusfri i åresvis, greide jeg muligens å få noe grums med da jeg skulle oppdatere Windows 7. Lastet ned en ISO som jeg var sikker på var ekte, men Avira er visst ikke enig.

Jeg leser dette til at du ikke har lastet ned fra Microsoft. Lastet ned fra usikre kilder øker sjangsen på at nedlastingen inneholder trojanere.

[Peppep]

Selvfølgelig. Jeg laster ned minst mulig, og når jeg først laster ned, så unngår jeg typiske usikre warezsider. Den metoden har som nevnt fungert i åresvis.

 

CCleaner og Avira er for øvrig begge ferdig, ingen treff, og maskinen kjører normalt.

[PerB]

Men fortsatt ikke lastet ned fra den eneste sikre siden (dvs Microsoft). Alle andre steder er per definisjon usikre og nedlastinger kan inneholde trojanere.