problem[keylogger]

**Posty:** 48 · przez **Gerwazy** 14 Paź 2007, 11:59

Witam...Nie wiem czy na komputerze mam keyloggera.Który może pobierać moje dane.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:52:11, on 2007-10-14 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-21-1220945662-1202660629-725345543-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User '?') O4 - HKUS\.DEFAULT\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'Default user') O4 - S-1-5-21-1220945662-1202660629-725345543-1003 Startup: dragdiag.lnk = C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe (User '?') O4 - Startup: dragdiag.lnk = C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{DC900A05-6067-4C2A-B0AB-76F0371FE647}: NameServer = 213.241.79.37 83.238.255.76 O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - Eset - C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- End of file - 3772 bytes

przez **jeff** 14 Paź 2007, 12:11

a czemu przypuszczasz że masz keylogera ? W logu widać tylko to na kasację

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

pogrubiony folder usuwasz recznie

odinstaluj Bearshare jak masz i skasuj też to

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/

**Posty:** 48 · przez **Gerwazy** 14 Paź 2007, 15:02

Bo brat coś sciagał i Nod wykrył wirusa.

przez **jeff** 14 Paź 2007, 15:07

Gerwazy napisał(a):Nod wykrył wirusa.

napisz lokalizacje wirusa i nazwe pliku

**Posty:** 237 · przez **Kuba1** 14 Paź 2007, 15:41

Dołącz log z ComboFix, oraz wykonaj to co napisał jeff

**Posty:** 48 · przez **Gerwazy** 14 Paź 2007, 19:25

C:\WINDOWS ALG

Nie system32 !! wiem ze tam jest...

Kod: Zaznacz wszystko: ComboFix 07-10-12.4 - Gerwazy 2007-10-14 19:21:04.1 - NTFSx86 Running from: C:\Documents and Settings\Gerwazy\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 ))))))))))))))))))))))))))))))) . 2007-10-14 19:20 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-13 15:23 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\DivX 2007-10-13 15:23 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\DivX 2007-10-13 15:21 <DIR> d-------- C:\Program Files\Google 2007-10-13 15:20 <DIR> d-------- C:\Program Files\DivX 2007-10-13 15:20 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-10-13 15:20 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-10-11 14:13 5,606 --a------ C:\WINDOWS\system32\stci.dll 2007-10-11 14:12 <DIR> d-------- C:\Program Files\Thomson 2007-10-11 07:17 540,672 --a------ C:\WINDOWS\system32\Gothic.exe 2007-10-10 21:42 390,144 -r-hs---- C:\WINDOWS\system\msnrav.exe 2007-10-10 16:21 796,672 --a------ C:\WINDOWS\GPInstall.exe 2007-10-10 16:14 <DIR> d-------- C:\WINDOWS\Sun 2007-10-10 16:13 <DIR> d-------- C:\Program Files\Java 2007-10-10 16:11 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-10 16:00 <DIR> d--h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Ustawienia lokalne 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Ulubione 2007-10-10 16:00 <DIR> d--h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Szablony 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Pulpit 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Moje dokumenty 2007-10-10 16:00 <DIR> dr------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Menu Start 2007-10-10 16:00 <DIR> dr-h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Dane aplikacji 2007-10-05 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\TibiaTestserver 2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\TibiaTestserver 2007-10-04 16:32 <DIR> d-------- C:\Program Files\TibiaTestserver 2007-10-03 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-02 18:17 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-10-02 18:13 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Teleca 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Teleca 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Documents 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2007-10-02 18:12 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-10-02 18:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2007-10-02 18:10 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-10-02 18:07 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-02 18:07 6,144 --a------ C:\WINDOWS\system32\drivers\k750cm.sys 2007-10-02 18:07 5,744 --a------ C:\WINDOWS\system32\drivers\k750wh.sys 2007-09-30 19:51 <DIR> d-------- C:\Program Files\Real 2007-09-30 19:51 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-09-30 19:45 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-09-30 19:45 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-09-30 19:45 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-09-30 19:45 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-09-30 19:45 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-09-30 19:45 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-09-30 19:36 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Szablony 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji 2007-09-30 16:57 313,344 --a------ C:\WINDOWS\system32\winhttp(2).dll 2007-09-30 16:56 <DIR> d-------- C:\Documents and Settings\Gerwazy\UserData 2007-09-30 16:55 <DIR> d-------- C:\WINDOWS\pss 2007-09-30 16:40 <DIR> d-------- C:\Program Files\Common Files\Real 2007-09-28 18:08 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 18:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 18:07 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-09-28 18:07 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-09-28 18:07 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-09-28 09:10 1,277 --a------ C:\WINDOWS\mozver.dat 2007-09-27 22:58 <DIR> d-------- C:\Program Files\Xvid 2007-09-27 22:58 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-09-27 22:58 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-09-27 22:49 <DIR> d-------- C:\Program Files\MarBit 2007-09-27 22:40 57,088 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-09-27 22:40 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-27 22:39 70,144 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-27 22:39 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys 2007-09-27 22:39 9,728 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2007-09-27 22:38 <DIR> dr------- C:\Program Files 2007-09-27 22:38 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-27 22:38 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-27 22:38 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-27 22:37 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-27 22:37 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji 2007-09-27 22:20 <DIR> d-------- C:\Program Files\Winamp 2007-09-27 22:16 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Tibia 2007-09-27 22:16 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Tibia 2007-09-27 22:13 <DIR> d-------- C:\Program Files\Trend Micro 2007-09-27 22:13 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-27 22:11 <DIR> d-------- C:\Program Files\ToniArts 2007-09-27 22:10 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Gadu-Gadu 2007-09-27 22:10 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Gadu-Gadu 2007-09-27 22:09 <DIR> d-------- C:\Program Files\Tibia 2007-09-27 22:09 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-09-27 22:09 <DIR> d-------- C:\Documents and Settings\Gerwazy\Gadu-Gadu 2007-09-27 22:07 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-09-27 22:07 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-09-27 22:07 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-09-27 22:07 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-09-27 22:05 <DIR> d-------- C:\Program Files\VIA . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-11 12:12 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-27 20:11 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-27 19:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Eset 2007-09-27 19:57 --------- d-----w C:\Program Files\ATI Technologies 2007-09-27 19:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-27 19:46 --------- d-----w C:\Program Files\Usługi online 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" [2007-09-21 09:16] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-09-13 18:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime "HOT FIX"=Gothic.exe C:\Documents and Settings\Gerwazy\Menu Start\Programy\Autostart\ dragdiag.lnk - C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [2007-10-11 14:12:59] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL *Newly Created Service* - CATCHME .

**Posty:** 18165 · przez **wojtas** 14 Paź 2007, 19:31

jeff napisał(a):napisz lokalizacje wirusa i nazwe pliku

a nie sama lokalizacje

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\Gothic.exe
C:\WINDOWS\system\msnrav.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 48 · przez **Gerwazy** 14 Paź 2007, 20:20

Napisałem alg=]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:18, on 2007-10-14 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\ftp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-21-1220945662-1202660629-725345543-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User '?') O4 - HKUS\.DEFAULT\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'Default user') O4 - S-1-5-21-1220945662-1202660629-725345543-1003 Startup: dragdiag.lnk = C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe (User '?') O4 - Startup: dragdiag.lnk = C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{DC900A05-6067-4C2A-B0AB-76F0371FE647}: NameServer = 213.241.79.37 83.238.255.76 O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - Eset - C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- End of file - 3469 bytes

Kod: Zaznacz wszystko: ComboFix 07-10-12.4 - Gerwazy 2007-10-14 20:12:12.2 - NTFSx86 Running from: C:\Documents and Settings\Gerwazy\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Gerwazy\Pulpit\CFScript.txt FILE:: C:\WINDOWS\system\msnrav.exe C:\WINDOWS\system32\Gothic.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system\msnrav.exe C:\WINDOWS\system32\Gothic.exe . ((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 ))))))))))))))))))))))))))))))) . 2007-10-14 19:20 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-13 15:23 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\DivX 2007-10-13 15:23 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\DivX 2007-10-13 15:21 <DIR> d-------- C:\Program Files\Google 2007-10-13 15:20 <DIR> d-------- C:\Program Files\DivX 2007-10-13 15:20 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-10-13 15:20 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-10-11 14:13 5,606 --a------ C:\WINDOWS\system32\stci.dll 2007-10-11 14:12 <DIR> d-------- C:\Program Files\Thomson 2007-10-10 16:21 796,672 --a------ C:\WINDOWS\GPInstall.exe 2007-10-10 16:14 <DIR> d-------- C:\WINDOWS\Sun 2007-10-10 16:13 <DIR> d-------- C:\Program Files\Java 2007-10-10 16:11 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-10 16:00 <DIR> d--h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Ustawienia lokalne 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Ulubione 2007-10-10 16:00 <DIR> d--h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Szablony 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Pulpit 2007-10-10 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Moje dokumenty 2007-10-10 16:00 <DIR> dr------- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Menu Start 2007-10-10 16:00 <DIR> dr-h----- C:\Documents and Settings\Administrator.GERWAZY-SL0A6Y4\Dane aplikacji 2007-10-05 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\TibiaTestserver 2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\TibiaTestserver 2007-10-04 16:32 <DIR> d-------- C:\Program Files\TibiaTestserver 2007-10-03 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-02 18:17 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-10-02 18:13 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Teleca 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Teleca 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Documents 2007-10-02 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2007-10-02 18:12 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-10-02 18:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2007-10-02 18:10 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-10-02 18:07 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-02 18:07 6,144 --a------ C:\WINDOWS\system32\drivers\k750cm.sys 2007-10-02 18:07 5,744 --a------ C:\WINDOWS\system32\drivers\k750wh.sys 2007-09-30 19:51 <DIR> d-------- C:\Program Files\Real 2007-09-30 19:51 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-09-30 19:45 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-09-30 19:45 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-09-30 19:45 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-09-30 19:45 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-09-30 19:45 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-09-30 19:45 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-09-30 19:36 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Szablony 2007-09-30 18:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji 2007-09-30 16:57 313,344 --a------ C:\WINDOWS\system32\winhttp(2).dll 2007-09-30 16:56 <DIR> d-------- C:\Documents and Settings\Gerwazy\UserData 2007-09-30 16:55 <DIR> d-------- C:\WINDOWS\pss 2007-09-30 16:40 <DIR> d-------- C:\Program Files\Common Files\Real 2007-09-28 18:08 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 18:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 18:07 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-09-28 18:07 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-09-28 18:07 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-09-28 09:10 1,277 --a------ C:\WINDOWS\mozver.dat 2007-09-27 22:58 <DIR> d-------- C:\Program Files\Xvid 2007-09-27 22:58 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-09-27 22:58 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-09-27 22:49 <DIR> d-------- C:\Program Files\MarBit 2007-09-27 22:40 57,088 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-09-27 22:40 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-27 22:39 70,144 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-27 22:39 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys 2007-09-27 22:39 9,728 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2007-09-27 22:38 <DIR> dr------- C:\Program Files 2007-09-27 22:38 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-27 22:38 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-27 22:38 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-27 22:38 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-27 22:37 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-27 22:37 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji 2007-09-27 22:20 <DIR> d-------- C:\Program Files\Winamp 2007-09-27 22:16 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Tibia 2007-09-27 22:16 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Tibia 2007-09-27 22:13 <DIR> d-------- C:\Program Files\Trend Micro 2007-09-27 22:13 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-27 22:11 <DIR> d-------- C:\Program Files\ToniArts 2007-09-27 22:10 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Gadu-Gadu 2007-09-27 22:10 <DIR> d-------- C:\Documents and Settings\Gerwazy\Dane aplikacji\Gadu-Gadu 2007-09-27 22:09 <DIR> d-------- C:\Program Files\Tibia 2007-09-27 22:09 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-09-27 22:09 <DIR> d-------- C:\Documents and Settings\Gerwazy\Gadu-Gadu 2007-09-27 22:07 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-09-27 22:07 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-09-27 22:07 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-09-27 22:07 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-09-27 22:05 <DIR> d-------- C:\Program Files\VIA 2007-09-27 22:05 <DIR> d-------- C:\Program Files\Gigabyte 2007-09-27 22:05 75,904 -ra------ C:\WINDOWS\system32\drivers\viasraid.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-11 12:12 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-27 20:11 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-27 19:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Eset 2007-09-27 19:57 --------- d-----w C:\Program Files\ATI Technologies 2007-09-27 19:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-27 19:46 --------- d-----w C:\Program Files\Usługi online 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" [2007-09-21 09:16] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-09-13 18:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime "HOT FIX"=Gothic.exe C:\Documents and Settings\Gerwazy\Menu Start\Programy\Autostart\ dragdiag.lnk - C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [2007-10-11 14:12:59] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL *Newly Created Service* - CATCHME .

**Posty:** 18165 · przez **wojtas** 14 Paź 2007, 20:36

nie widze tego pliku w logu ale daje usuwanie:

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\alg.exe

Driver::
Application Layer Gateway Services

Registry::
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"HOT FIX"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

problem[keylogger]

problem[keylogger]

Kto jest na forum