Trojan horse, hjep!

tobler0ne · 9. august 2007

Ser ut som om det har kommet en trojaner her. Trenger litt hjelp til hva jeg kan gjøre. AVG oppdaget den, og jeg trykket på "Heal", det så ut som den ble fjernet, men jeg tror den havnet i "Virus Vault". Jeg tømte Virus Vault (dumt? ). AVG så at den befant seg i en .exe fil, så jeg slettet denne manuelt, men etter et scan har den dukket opp på nytt (D:\System Volume Information\_restore -og masse annet- ). Problemet er at jeg ikke finner denne mappen normalt, og ikke våger å fjerne filen den befinner seg i, da jeg er usikker på hva som kan skje.

Uansett, det ser ikke ut som om AVG greier å fjerne styggedommen, og jeg har ikke så veldig mye peiling på hva jeg bør gjøre. Lastet ned Ad-Aware og kjørte full scan, men den fant ikke mye trojanere...

Tar jeg ikke feil, tror jeg trojaneren er en slik: "Trojan hourse SHeur.ERD", det oppgir AVG den for ... tror jeg. Så hva bør jeg gjøre nå? Noen opplyninger jeg har glemt?

norbat · 9. august 2007

Å fjerne den fra Vault gjør at du fjerner den fra pc'n, så dette går greit.

'_restore', er en skjult mappe på pc'n som lagrer kopi av systemet ditt i tilfelle du trenger å gjenopprette systemet til en tidliger tilstand. Man kan tømme denne mappa slik at man ikke blir infisert ved en evt. systemgjenoppretting. Dette kan vi se på senere.

Gjør følgende:

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

tobler0ne · 9. august 2007

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:55:19, on 09.08.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin.exe

C:\WINDOWS\system32\windsp.exe

C:\Program Files\Opera\Opera.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Documents and Settings\Dag Tore\Desktop\sokker\syltetøy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.online.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera

O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P30 "EPSON Stylus Photo R200 Series" /O5 "LPT1:" /M "Stylus Photo R200"

O4 - HKLM\..\Run: [Microsoft Display Driver] windsp.exe

O4 - HKLM\..\RunServices: [Microsoft Display Driver] windsp.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: TrayMin.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161526195339

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161526179256

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--

End of file - 5436 bytes

Der har du loggen.

Edit: Denne PCen er så gammel så den brukes omtrendt bare av meg (som ikke har sett til å kjøpe konfimasjons-PC enda), så klokkeslettet i loggen ble jo feil fordi jeg ikke bryr meg om det ^^...

Endret 9. august 2007 av Tobye

backup · 9. august 2007

Du skulle vel ikke mene "Trojan horse SHeur". I så fall kan du ta en tur her:

http://forums.majorgeeks.com/showthread.php?t=131900

Det synes å være falsk alarm! Eventuelt oppdater avg og kjør på nytt for å se om avg fortsatt flagger "Trojan horse SHeur". Prøv andre av'er, fordi det ser ut til at bare avg flagger "Trojan horse SHeur".

norbat · 9. august 2007

Sørg for at du kan se skjulte filer og mapper (kontrollpanel->mappealt.->vis->"vis skjulte filer og mapper")

Gå til nettstedet: http://virusscan.jotti.org/

Øverst på siden kan du laste opp følgende fil for en virussjekk: C:\WINDOWS\system32\windsp.exe

Kopier resultatet her (merk teksten, høyreklikk og velg kopier, lim det inn i en ny svarpost)

tobler0ne · 9. august 2007

Jo. som jeg skrev i førstpost er det "SHeur". Googlet den selv (fant dog ingenting om .ERD som den jeg har ender på). Men jeg er litt skeptisk, da AVG oppdaterer seg omtrendt daglig, og fordi AVG kom opp med meldingen etter at jeg hadde downloadet et program (som jeg vet er trygt. Grunnen må være fordi jeg brukte, ehrm... "tnerrot" (skjønner?) for å lastet ned programmet). Har faktisk kjørt full systemscan tre ganger idag. Hver gang kommer det samme.

tobler0ne · 9. august 2007

Vet ikke helt hva jeg skulle kopiere, men tok med disse:

Scanner results:

Klikk for å se/fjerne innholdet nedenfor

Scanner results

Scan taken on 09 Aug 2007 19:41:24 (GMT)

A-Squared Found nothing

AntiVir Found HEUR/Crypted

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

CPsecure Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

F-Secure Anti-Virus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

Panda Antivirus Found nothing

Rising Antivirus Found nothing

Sophos Antivirus Found nothing

VirusBuster Found nothing

VBA32 Found nothing

Statistics:

Klikk for å se/fjerne innholdet nedenfor

Statistics

Last file scanned at least one scanner reported something about: server.exe (MD5: 23b7f8548a56812e768cc05ff488712b, size: 108076 bytes), detected by:

Scanner Malware name

A-Squared X

AntiVir TR/Swizzor.HF.32

ArcaVir Trojan.Psw.Prostor.J

Avast Win32:Prostor-L

AVG Antivirus BackDoor.Generic5.OQO

BitDefender Trojan.Muldrop.AKW

ClamAV X

CPsecure X

Dr.Web Trojan.MulDrop.2990

F-Prot Antivirus X

F-Secure Anti-Virus Trojan-Dropper.Win32.Agent.bno

Fortinet X

Kaspersky Anti-Virus Trojan-Dropper.Win32.Agent.bno

NOD32 X

Norman Virus Control W32/Smalldoor.ANCP

Panda Antivirus Bck/Bifrose.ATY

Rising Antivirus X

Sophos Antivirus X

VirusBuster X

VBA32 Trojan.MulDrop.2990

You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives

We are not affiliated with any third parties that conduct tests using this service.

norbat · 9. august 2007

Ok,

Last ned SDFix til skrivebordet.

Dobbeltklikk på SDFix.exe og det vil pakke seg ut til ei mappe i C:\SDFix

Restart pc'n i sikker modus (tapp F8 under oppstart, velg sikker modus)

Åpne SDFix-mappa og dobbeltklikk på 'RunThis.bat' for å starte programmet

Velg Y for å starte rensingen

Pc'n vil restarte, og SDFix vil fortsette.

Post loggen (vil ligge som Report.txt i SDFix-mappa) + ny HJT-logg.

tobler0ne · 9. august 2007

SDFix:

SDFix: Version 1.97

Run by Dag Tore on 09.08.2007 at 13:13

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix\SDFix

Safe Mode:

Checking Services:

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting...

Normal Mode:

Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\windsp.exe - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS

No streams found.

C:\WINDOWS\system32

No streams found.

C:\WINDOWS\system32\svchost.exe

No streams found.

C:\WINDOWS\system32\ntoskrnl.exe

No streams found.

Final Check:

Remaining Services:

------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser"

"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"

"D:\\Spill\\CE\\LOBBY.EXE"="D:\\Spill\\CE\\LOBBY.EXE:*:Enabled:LOBBY"

"D:\\Spill\\CE 2\\LOBBY.EXE"="D:\\Spill\\CE 2\\LOBBY.EXE:*:Enabled:LOBBY"

"D:\\Spill\\CE 2\\ce.exe"="D:\\Spill\\CE 2\\ce.exe:*:Enabled:ce"

"D:\\Spill\\Warcraft III\\Warcraft III.exe"="D:\\Spill\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"

"C:\\Documents and Settings\\Dag Tore\\Desktop\\utorrent.exe"="C:\\Documents and Settings\\Dag Tore\\Desktop\\utorrent.exe:*:Enabled:æTorrent"

"C:\\Program Files\\Reallusion\\CrazyTalk for Skype\\CT4Skype.exe"="C:\\Program Files\\Reallusion\\CrazyTalk for Skype\\CT4Skype.exe:*:Disabled:CrazyTalk Application"

"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

"C:\\WINDOWS\\system32\\avamgrd.exe"="C:\\WINDOWS\\system32\\avamgrd.exe:*:Disabled:avamgrd"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:

---------------

Backups Folder: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

C:\Documents and Settings\Dag Tore\Application Data\Microsoft\Word\~WRL0005.tmp

C:\Documents and Settings\Dag Tore\Application Data\Microsoft\Word\~WRL0412.tmp

C:\Documents and Settings\Dag Tore\Application Data\Microsoft\Word\~WRL1252.tmp

C:\Documents and Settings\Dag Tore\Application Data\Microsoft\Word\~WRL1270.tmp

Finished

----

HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:38:52, on 09.08.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE