Riskware opdaget (windows server 2003)
HejJeg har en windows server 2003 der står og hoster nogen småting som SVN og et par hjemmesider (står i en serverpark). Et par gange jeg har logget på, har jeg fået en fejl om at BrutePMA.exe har lavet en fejl. Jeg har ikke kunnet finde noget om filen, og har heller ikke kunnet finde den på computeren.
Derfor skannede jeg den igennem med kaspersky online scanner. Den fandt:
C:\WINDOWS\$NtUninstallKB970483$\spuninst\b1\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
C:\WINDOWS\$NtUninstallKB970483$\spuninst\b2\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
C:\WINDOWS\$NtUninstallKB970483$\spuninst\b3\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
C:\WINDOWS\$NtUninstallKB970483$\spuninst\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
C:\WINDOWS\system32\Ldmgr.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.gen 1
C:\WINDOWS\SysWOW64\Ldmgr.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.gen 1
men da jeg hentede en trial af scanneren, fandt den ikke noget. Den online scanner finder dem hver gang.
Er der nogen der har nogen inputs omkring dem. Er det false-positives eller noget jeg skal være nervøs for og hvordan fjerner jeg dem hvis det er?
Jeg har haft kørt superantispyware og Malwarebytes anti-malware. Sidstnævnte fandt en:
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:59:21, on 05-08-2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers\avp.exe
C:\Program Files (x86)\Code Ocean\Ocean FTP Server\Ocean FTP Server.exe
C:\Program Files (x86)\Code Ocean\Ocean FTP Server\Ocean FTP Server.exe
C:\WINDOWS\SysWOW64\Ldmgr.exe
C:\Program Files (x86)\Java\jre6\bin\jqs.exe
C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe
C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe
C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
C:\WINDOWS\SysWOW64\ctfmon.exe
C:\Program Files (x86)\PRTG Network Monitor\PRTG System Tray Notifier.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers\avp.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardAdmin.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files (x86)\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: PRTG System Tray Notifier.lnk = C:\Program Files (x86)\PRTG Network Monitor\PRTG System Tray Notifier.exe
O14 - IERESET.INF: START_PAGE_URL=http://webtropia.com
O15 - ESC Trusted Zone: http://www.backup4all.com
O15 - ESC Trusted Zone: http://www.bing.com
O15 - ESC Trusted Zone: http://cnettv.cnet.com
O15 - ESC Trusted Zone: http://www.cnet.com
O15 - ESC Trusted Zone: http://www.codeocean.com
O15 - ESC Trusted Zone: http://mads.com.com
O15 - ESC Trusted Zone: http://drh.img.digitalriver.com
O15 - ESC Trusted Zone: http://ps.digitalriver.com
O15 - ESC Trusted Zone: http://simsub.digitalriver.com
O15 - ESC Trusted Zone: http://bwp.download.com
O15 - ESC Trusted Zone: http://software-files.download.com
O15 - ESC Trusted Zone: http://www.download.com
O15 - ESC Trusted Zone: http://mysql.easynet.be
O15 - ESC Trusted Zone: http://mirror.kr.freebsd.org
O15 - ESC Trusted Zone: http://www.google.dk
O15 - ESC Trusted Zone: http://ftp.heanet.ie
O15 - ESC Trusted Zone: http://mozilla.mirror.ihug.co.nz
O15 - ESC Trusted Zone: http://mozilla.isc.org
O15 - ESC Trusted Zone: http://www.java.com
O15 - ESC Trusted Zone: http://downloads.kaspersky-labs.com
O15 - ESC Trusted Zone: http://www.kaspersky.co.uk
O15 - ESC Trusted Zone: http://support.kaspersky.com
O15 - ESC Trusted Zone: http://www.kaspersky.com
O15 - ESC Trusted Zone: http://www.kaspersky.dk
O15 - ESC Trusted Zone: http://search.live.com
O15 - ESC Trusted Zone: http://mozilla.mirror.ac.za
O15 - ESC Trusted Zone: http://*.mozilla.org
O15 - ESC Trusted Zone: http://runonce.msn.com
O15 - ESC Trusted Zone: http://dev.mysql.com
O15 - ESC Trusted Zone: http://www.mysql.com
O15 - ESC Trusted Zone: http://mysql.navicat.com
O15 - ESC Trusted Zone: http://www.navicat.com
O15 - ESC Trusted Zone: http://download-cdn.paessler.com
O15 - ESC Trusted Zone: http://www.paessler.com
O15 - ESC Trusted Zone: http://mysql.skynet.be
O15 - ESC Trusted Zone: http://easynews.dl.sourceforge.net
O15 - ESC Trusted Zone: http://master.dl.sourceforge.net
O15 - ESC Trusted Zone: http://jdl.sun.com
O15 - ESC Trusted Zone: http://www-cdn.sun.com
O15 - ESC Trusted Zone: http://www.techspot.com
O15 - ESC Trusted Zone: http://www.threatexpert.com
O15 - ESC Trusted Zone: http://subversion.tigris.org
O15 - ESC Trusted Zone: http://cwt.trendmicro-europe.com
O15 - ESC Trusted Zone: http://store.trendmicro-europe.com
O15 - ESC Trusted Zone: http://emea.trendmicro.com
O15 - ESC Trusted Zone: http://housecall.trendmicro.com
O15 - ESC Trusted Zone: http://housecall65.trendmicro.com
O15 - ESC Trusted Zone: http://store.trendmicro.com
O15 - ESC Trusted Zone: http://us.trendmicro.com
O15 - ESC Trusted Zone: http://www.viruslist.com
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O15 - ESC Trusted IP range: http://[SERVER_IP_ADRESSE]
O15 - ESC Trusted IP range: http://127.0.0.1
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219690901015
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers\avp.exe
O23 - Service: Ocean FTP Server (CODE_OCEAN_OCEANFTPSERVER_SERVICE) - Code Ocean - C:\Program Files (x86)\Code Ocean\Ocean FTP Server\Ocean FTP Server.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: IIS Admin Service (IISADMIN) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files (x86)\Java\jre6\bin\jqs.exe
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: FTP Publishing Service (MSFtpsvc) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: PRTGHostService (PRTG7CoreService) - Paessler AG - C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe
O23 - Service: PRTGProbeService (PRTG7ProbeService) - Paessler AG - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Simple Mail Transfer Protocol (SMTP) (SMTPSVC) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)
--
End of file - 9805 bytes
