Hej, hjälp sökes! Avast Anti-Virus 4.8 Professional upptäckte ett virus, men jag har nyss formaterat om datorn. Kan ju omöjligt redan fått ett virus, eller?
Description:
Sign of "Win32:Trojan-gen" has been found in "CProgram Files (x86)\Common Files\alg.exe" file.
Körde HijackThis:
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 19:41:49, on 2009-11-18Platform: Unknown Windows (WinNT 6.01.3504)MSIE: Internet Explorer v8.00 (8.00.7600.16385)Boot mode: NormalRunning processes:CProgram Files (x86)\Analog Devices\SoundMAX\SoundMAX.exeCWindows\SysWOW64
undll32.exeCWindows\SysWOW64\HsMgr.exeCWindows\Sy
sWOW64
unonce.exeCProgram Files\Alwil Software\Avast4\ashDisp.exeCProgram Files (x86)\Analog Devices\Core\smax4pnp.exeCProgram Files (x86)\Personal\bin\Personal.exeCProgram Files (x86)\Java\jre6\bin\jusched.exeCProgram Files (x86)\iTunes\iTunesHelper.exeCProgram Files (x86)\Virtual CD v10\System\VC10Play.exeCProgram Files (x86)\Virtual CD v10\System\VC10Tray.exeCProgram Files (x86)\Mozilla Firefox\firefox.exeCProgram Files (x86)\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = CWindows\SysWOW64\blank.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exeO2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - CProgram Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - CProgram Files (x86)\Java\jre6\bin\jp2ssv.dllO4 - HKLM\..\Run: [avast!] "CProgram Files\Alwil Software\Avast4\ashDisp.exe"O4 - HKLM\..\Run: [SoundMAXPnP] CProgram Files (x86)\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] "CProgram Files (x86)\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "CProgram Files (x86)\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "CProgram Files (x86)\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [VC10Player] CProgram Files (x86)\Virtual CD v10\System\VC10Play.exeO4 - HKLM\..\Run: [Application Layer Gateway] CProgram Files (x86)\Common Files\alg.exeO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE&#39O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] CWindows\System32\mctadmin.exe (User 'LOCAL SERVICE&#39O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE&#39O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] CWindows\System32\mctadmin.exe (User 'NETWORK SERVICE&#39O4 - Global Startup: BankID Security Application.lnk = CProgram Files (x86)\Personal\bin\Personal.exeO13 - Gopher Prefix: O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Unknown owner - CWindows\system32\AEADISRV.EXE (file missing)O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - CWindows\System32\alg.exe (file missing)O23 - Service: Apple Mobile Device - Apple Inc. - CProgram Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - CProgram Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - ALWIL Software - CProgram Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - CProgram Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - CProgram Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - CProgram Files (x86)\Bonjour\mDNSResponder.exeO23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - CProgram Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exeO23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - CWindows\System32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - CWindows\system32\fxssvc.exe (file missing)O23 - Service: iPod Service - Apple Inc. - CProgram Files\iPod\bin\iPodService.exeO23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - CWindows\system32\lsass.exe (file missing)O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - CWindows\System32\msdtc.exe (file missing)O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - CWindows\system32\lsass.exe (file missing)O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - CWindows\system32
vvsvc.exe (file missing)O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - CWindows\system32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - CWindows\system32\locator.exe (file missing)O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - CWindows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - CWindows\System32\snmptrap.exe (file missing)O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - CWindows\System32\spoolsv.exe (file missing)O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - CWindows\system32\sppsvc.exe (file missing)O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - CProgram Files (x86)\NVIDIA Corporation\3D Vision
vSCPAPISvr.exeO23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - CWindows\system32\UI0Detect.exe (file missing)O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - CWindows\system32\lsass.exe (file missing)O23 - Service: Virtual CD v10 Management Service (VC10SecS) - H+H Software GmbH - CProgram Files (x86)\Virtual CD v10\System\VC10SecS.exeO23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - CWindows\System32\vds.exe (file missing)O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - CWindows\system32\vssvc.exe (file missing)O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - CWindows\system32\wbengine.exe (file missing)O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - CWindows\system32\wbem\WmiApSrv.exe (file missing)O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - CProgram Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)--End of file - 7364 bytes
Körde sen Malwarebytes:

Malwarebytes' Anti-Malware 1.41Database version: 3194Windows 6.1.76002009-11-18 20:01:55mbam-log-2009-11-18 (20-01-52).txtScan type: Quick ScanObjects scanned: 84569Time elapsed: 2 minute(s), 2 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 1Folders Infected: 0Files Infected: 2Memory Processes InfectedNo malicious items detected)Memory Modules InfectedNo malicious items detected)Registry Keys InfectedNo malicious items detected)Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Run\application layer gateway (Trojan.Agent) -> No action taken.Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Policies\Explorer\NoActiveDe
sktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.Folders InfectedNo malicious items detected)Files Infected:CProgram Files (x86)\Common Files\alg.exe (Trojan.Agent) -> No action taken.CUsers\enbom\AppData\Local\Temp\_ir_sf_temp
_0\irsetup.exe (Trojan.Agent) -> No action taken.

Där är resultatet från virustotal:
https://www.virustotal.com/sv/analisis/490160bbb3
506ea261b571491971d
6fd13cef3159625ef0eb2b9875cc5a55883-1257982052
Hela länken fick inte plats, så jag fick ta ett radbyte.
Ska jag vara helt ärlig så har jag ingen aning om vad "CUsers\enbom\AppData\Local\Temp\_ir_sf_temp_0" är för någonting. Hmm... Ska testa skanna igen!
Skannade igen, då kommer det inte upp någonting om "_ir_sf_temp_0".
Den där filen alg.exe körs i processer när man kollar i Windows Task Manager. Filen har destription: "CPAX20". Vad det nu kan betyda?

Resultatet i en .txt-fil:
http://data.fuskbugg.se/skalman01/VirusTotal_Resu
ltat.txt
Jag körde nyss en till scan med Malwarebytes och åtgärdade allt den hade att säga. Filen alg.exe är nu deleted, men jag tror att den kommer att komma tillbaka. Jag deletade filen med Avast men den kom tillbaka efter någon timme.

Nope, jag har då inte något av de programmen som finns på länken. Nej, det är inte processen "CWindows\System32\alg.exe", det har jag kollat. För den är avstängd enligt när man kollar på Task Managern.
När jag igår tog bort de problem som Malwarebytes visade, så har det inte kommit tillbaka något eller några nya. Problemet verkar vara löst. Finns ingen alg.exe i Common Files heller.
Malwarebytes' Anti-Malware 1.41Database version: 3194Windows 6.1.76002009-11-19 11:57:20mbam-log-2009-11-19 (11-57-20).txtScan type: Quick ScanObjects scanned: 84293Time elapsed: 2 minute(s), 29 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes InfectedNo malicious items detected)Memory Modules InfectedNo malicious items detected)Registry Keys InfectedNo malicious items detected)Registry Values InfectedNo malicious items detected)Registry Data Items InfectedNo malicious items detected)Folders InfectedNo malicious items detected)Files InfectedNo malicious items detected)

Jag får väl återkomma om det kommer tillbaka. Men än så länge verkar det vara bra.