podejrzenie o keylogger

**Posty:** 130 · przez **Cell** 06 Mar 2008, 17:48

Proszę o sprawdzenie tego loga. Podejrzewam kayloggera. Kiedyś zakoszono mi konto w Metinie a dzisaj e-mail. Codziwnnie robiłem sprawdzenie loga na http://hijackthis.de/ i tylko za 1. razem wykryło, ununęłem i już nic nie wykrywał.

Logfile of HijackThis v1.99.1
Scan saved at 16:45:23, on 2008-03-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
H:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Common Files\LightScribe\LSSrvc.exe
H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Panda Software\Panda Antivirus 2007\apvxdwin.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\VDOTool\TBPanel.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
h:\program files\panda software\panda antivirus 2007\WebProxy.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Documents and Settings\aaaa\Pulpit\Nowy folder (2)\Anti-keylogger.exe
H:\WINDOWS\system32\osk.exe
H:\WINDOWS\system32\MSSWCHX.EXE
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe
H:\Documents and Settings\aaaa\Pulpit\AKG\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Gainward] H:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [APVXDWIN] "H:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Anti-keylogger] H:\Documents and Settings\aaaa\Pulpit\Nowy folder (2)\Anti-keylogger.exe /autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Gadu-Gadu] "H:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: avldr - H:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - H:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - H:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - H:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe

[/url]

**Posty:** 18165 · przez **wojtas** 06 Mar 2008, 20:37

Cell napisał(a):Codziwnnie robiłem sprawdzenie loga na http://hijackthis.de/ i tylko za 1. razem wykryło, ununęłem i już nic nie wykrywał.

prosze z tej strony nie korzystac czasami kaze usuwac dobre wpisy

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 130 · przez **Cell** 06 Mar 2008, 21:22

Combofix

Kod: Zaznacz wszystko: ComboFix 08-03-05.3 - aaaa 2008-03-06 20:15:18.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.543 [GMT 1:00] Running from: H:\Documents and Settings\aaaa\Pulpit\Nowy folder (3)\combofix\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 ))))))))))))))))))))))))))))))) . 2008-03-06 20:02 . 2008-03-06 20:02 <DIR> d-------- H:\WINDOWS\ERUNT 2008-03-06 19:57 . 2008-03-06 20:09 <DIR> d-------- H:\SDFix 2008-03-06 16:35 . 2006-11-24 12:19 374,272 --a------ H:\WINDOWS\system32\drivers\krnl_akl.sys 2008-03-02 18:01 . 2008-03-02 18:01 1,210 --a------ H:\WINDOWS\mozver.dat 2008-03-02 14:41 . 2008-03-02 14:41 <DIR> d-------- H:\Documents and Settings\aaaa\Dane aplikacji\Talkback 2008-03-02 14:41 . 2008-03-02 14:41 0 --a------ H:\WINDOWS\nsreg.dat 2008-03-01 18:19 . 2008-03-01 18:19 <DIR> d-------- H:\DMC3 2008-03-01 09:45 . 2008-03-01 09:45 <DIR> d-------- H:\Program Files\Atari 2008-02-29 19:40 . 2008-02-29 19:40 <DIR> d-------- H:\Documents and Settings\aaaa\Dane aplikacji\Bioshock 2008-02-29 19:39 . 2008-02-29 19:39 107,888 --a------ H:\WINDOWS\system32\CmdLineExt.dll 2008-02-29 19:36 . 2008-02-29 19:36 <DIR> d-------- H:\Program Files\2K Games 2008-02-23 12:42 . 2008-02-23 12:43 <DIR> d-------- H:\PES 2008-02-22 19:54 . 2008-02-22 19:54 <DIR> d-------- H:\Program Files\KONAMI 2008-02-15 21:21 . 2008-02-15 21:35 <DIR> d-------- H:\Documents and Settings\aaaa\Dane aplikacji\U3 2008-02-09 19:24 . 2008-03-06 19:08 <DIR> d-------- H:\Metin 2008-02-09 19:19 . 2008-02-24 15:03 <DIR> d-------- H:\Flash get 2008-02-09 17:09 . 2008-02-09 17:09 <DIR> d-------- H:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2008-02-09 08:25 . 2008-03-06 17:11 <DIR> d-------- H:\WinRAR 2008-02-08 09:55 . 2004-08-03 23:01 25,856 --a------ H:\WINDOWS\system32\drivers\usbprint.sys 2008-02-08 09:55 . 2004-08-03 23:01 25,856 --a--c--- H:\WINDOWS\system32\dllcache\usbprint.sys 2008-02-07 21:58 . 2008-02-13 05:33 <DIR> d--h----- H:\WINDOWS\$hf_mig$ 2008-02-07 19:43 . 2008-02-09 11:09 <DIR> d-------- H:\Within Temptation 2008-02-07 18:58 . 2008-02-22 21:12 <DIR> d-------- H:\Documents and Settings\aaaa\Gadu-Gadu 2008-02-07 18:58 . 2008-02-07 18:58 <DIR> d-------- H:\Documents and Settings\aaaa\Dane aplikacji\Gadu-Gadu 2008-02-07 18:57 . 2008-03-06 16:18 <DIR> d-------- H:\Program Files\Gadu-Gadu 2008-02-07 18:54 . 2008-02-07 18:54 37 --a------ H:\WINDOWS\r007 2008-02-07 16:23 . 2008-02-07 16:23 <DIR> d-------- H:\Program Files\Audacity 2008-02-06 20:35 . 2008-02-08 19:44 <DIR> d-------- H:\Program Files\City Interactive . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-06 16:06 --------- d-----w H:\Program Files\VDOTool 2008-03-06 15:57 --------- d-----w H:\Program Files\DAEMON Tools 2008-03-06 15:56 --------- d-----w H:\Program Files\Common Files\LightScribe 2008-03-01 08:45 --------- d--h--w H:\Program Files\InstallShield Installation Information 2008-02-11 14:12 --------- d-----w H:\Documents and Settings\aaaa\Dane aplikacji\Ahead 2008-02-03 17:28 --------- d-----w H:\Documents and Settings\aaaa\Dane aplikacji\AdobeUM 2008-02-03 17:03 --------- d-----w H:\Program Files\Microsoft.NET 2008-02-03 17:03 --------- d-----w H:\Program Files\Microsoft Works 2008-02-02 16:00 --------- d-----w H:\Program Files\Common Files\Adobe 2008-02-01 18:17 --------- d-----w H:\Program Files\GameSpy 2008-02-01 18:11 22,328 ----a-w H:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-01 18:11 22,328 ----a-w H:\Documents and Settings\aaaa\Dane aplikacji\PnkBstrK.sys 2008-02-01 18:02 --------- d-----w H:\Program Files\Electronic Arts 2008-02-01 17:25 106,496 ----a-w H:\WINDOWS\DIIUnin.exe 2008-02-01 17:16 223,128 ----a-w H:\WINDOWS\system32\drivers\dtscsi.sys 2008-02-01 17:14 96,256 ----a-w H:\WINDOWS\system32\drivers\sptd1565.sys 2008-02-01 17:14 664,064 ----a-w H:\WINDOWS\system32\drivers\sptd.sys 2008-02-01 15:39 --------- d-----w H:\Program Files\OpenAL 2008-02-01 15:37 --------- d-----w H:\Program Files\ND Games 2008-02-01 14:37 --------- d-----w H:\Program Files\Common Files\InstallShield 2008-01-31 10:54 --------- d-----w H:\Program Files\Realtek 2008-01-31 10:53 15,600 ----a-w H:\WINDOWS\gdrv.sys 2008-01-31 10:53 --------- d-----w H:\Documents and Settings\aaaa\Dane aplikacji\InstallShield 2008-01-30 15:05 --------- d-----w H:\Program Files\Panda Software 2008-01-30 13:56 --------- d-----w H:\Program Files\Common Files\Ahead 2008-01-30 13:53 --------- d-----w H:\Program Files\Nero 2008-01-30 13:53 --------- d-----w H:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-01-30 11:41 315,392 ----a-w H:\WINDOWS\HideWin.exe 2008-01-30 11:38 --------- d-----w H:\Program Files\Yahoo! 2008-01-30 11:30 --------- d-----w H:\Program Files\microsoft frontpage 2008-01-30 11:28 --------- d-----w H:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-04 10:39 149040] "LightScribe Control Panel"="H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 13:26 484904] "Gadu-Gadu"="H:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 08:52 16841216 H:\WINDOWS\RTHDCPL.exe] "Gainward"="H:\Program Files\VDOTool\TBPanel.exe" [2007-10-02 12:19 2165272] "NvCplDaemon"="H:\WINDOWS\system32\NvCpl.dll" [2007-10-05 06:37 8491008] "nwiz"="nwiz.exe" [2007-10-05 06:37 1626112 H:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="H:\WINDOWS\system32\NvMcTray.dll" [2007-10-05 06:37 81920] "NeroFilterCheck"="H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 10:59 161328] "APVXDWIN"="H:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2006-09-13 07:59 311296] "DAEMON Tools"="H:\Program Files\DAEMON Tools\daemon.exe" [2005-11-08 23:00 128920] "Anti-keylogger"="H:\Documents and Settings\aaaa\Pulpit\Nowy folder (2)\Anti-keylogger.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="H:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll 2005-09-27 12:13 45056 H:\WINDOWS\system32\avldr.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "H:\\WINDOWS\\system32\\PnkBstrA.exe"= "H:\\WINDOWS\\system32\\PnkBstrB.exe"= "H:\\CS1.6 pod-Bot\\hl.exe"= "H:\\Program Files\\Gadu-Gadu\\gg.exe"= "H:\\Metin\\metin2.bin"= R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);H:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 krnl_akl;krnl_akl;H:\WINDOWS\system32\drivers\krnl_akl.sys [2006-11-24 12:19] S3 gdrv;gdrv;H:\WINDOWS\gdrv.sys [2008-01-31 11:53] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\AutoRunCD.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82e37a56-dc03-11dc-8dc3-001a4df8e9c5}] \Shell\AutoRun\command - J:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "H:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-06 20:18:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . H:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe H:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE H:\Program Files\Common Files\LightScribe\LSSrvc.exe H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE H:\WINDOWS\system32\nvsvc32.exe H:\WINDOWS\system32\PnkBstrA.exe H:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe H:\WINDOWS\system32\wdfmgr.exe h:\program files\panda software\panda antivirus 2007\WebProxy.exe H:\WINDOWS\system32\RUNDLL32.EXE H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Completion time: 2008-03-06 20:20:25 - machine was rebooted [aaaa] . 2008-02-13 08:37:41 --- E O F ---

Report

Kod: Zaznacz wszystko: [b]SDFix: Version 1.153 [/b] Run by aaaa on 2008-03-06 at 20:03 Microsoft Windows XP [Wersja 5.1.2600] Running From: H:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-06 20:07:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:6398ff22 "s1"=dword:3afbaac3 "s2"=dword:ea61d261 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="H:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:bf,a7,b2,bd,be,73,a7,63,81,3b,b3,dd,45,ac,1b,15,60,e8,9d,ed,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,72,60,4c,41,1b,3d,81,34,d6,45,ee,41,72,68,38,37,c4,.. "khjeh"=hex:b7,d7,75,78,23,92,3d,18,9c,c5,e3,83,0e,6d,1f,af,25,6a,f7,76,50,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:19,01,90,71,45,82,00,6f,91,70,b3,65,d8,a7,78,c5,bb,ac,2e,b8,50,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="H:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:bf,a7,b2,bd,be,73,a7,63,81,3b,b3,dd,45,ac,1b,15,60,e8,9d,ed,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,72,60,4c,41,1b,3d,81,34,d6,45,ee,41,72,68,38,37,c4,.. "khjeh"=hex:b7,d7,75,78,23,92,3d,18,9c,c5,e3,83,0e,6d,1f,af,25,6a,f7,76,50,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:19,01,90,71,45,82,00,6f,91,70,b3,65,d8,a7,78,c5,bb,ac,2e,b8,50,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000000 "TracesSuccessful"=dword:00000000 "LastTraceFailure"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "H:\\Program Files\\ND Games\\Instinct\\instinct.exe"="H:\\Program Files\\ND Games\\Instinct\\instinct.exe:*:Enabled:ds2main" "H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"="H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32" "H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="H:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "H:\\WINDOWS\\system32\\PnkBstrA.exe"="H:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "H:\\WINDOWS\\system32\\PnkBstrB.exe"="H:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "H:\\Program Files\\Sierra\\Empire Earth - Sztuka Podboju\\EE-AOC.exe"="H:\\Program Files\\Sierra\\Empire Earth - Sztuka Podboju\\EE-AOC.exe:*:Enabled:EE-AOC" "H:\\CS1.6 pod-Bot\\hl.exe"="H:\\CS1.6 pod-Bot\\hl.exe:*:Enabled:Half-Life Launcher" "H:\\Program Files\\Gadu-Gadu\\gg.exe"="H:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "H:\\Flash get\\flashget.exe"="H:\\Flash get\\flashget.exe:*:Enabled:Flashget" "H:\\Metin\\metin2.bin"="H:\\Metin\\metin2.bin:*:Enabled:metin2" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sat 6 Aug 2005 295,936 A..H. --- H:\DOCUME~1\AAAA\PULPIT\NOWYFO~1\NARUTO~2.EXE Thu 7 Dec 2006 3,096,576 A..H. --- H:\DOCUME~1\AAAA\DANEAP~1\U3\TEMP\LAUNCH~1.EXE [b]Finished![/b]

Hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:22:30, on 2008-03-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\svchost.exe H:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe H:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE H:\WINDOWS\System32\svchost.exe H:\WINDOWS\system32\spoolsv.exe H:\Program Files\Common Files\LightScribe\LSSrvc.exe H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE H:\WINDOWS\system32\nvsvc32.exe H:\WINDOWS\system32\PnkBstrA.exe H:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe H:\Program Files\Panda Software\Panda Antivirus 2007\apvxdwin.exe h:\program files\panda software\panda antivirus 2007\WebProxy.exe H:\WINDOWS\RTHDCPL.EXE H:\Program Files\VDOTool\TBPanel.exe H:\WINDOWS\system32\RUNDLL32.EXE H:\Program Files\DAEMON Tools\daemon.exe H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe H:\Program Files\Gadu-Gadu\gg.exe H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe H:\WINDOWS\explorer.exe H:\WINDOWS\system32\wuauclt.exe H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe H:\WINDOWS\system32\wuauclt.exe H:\Program Files\internet explorer\iexplore.exe H:\WINDOWS\system32\osk.exe H:\WINDOWS\system32\MSSWCHX.EXE H:\Program Files\internet explorer\iexplore.exe H:\Program Files\internet explorer\iexplore.exe H:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe H:\Program Files\internet explorer\iexplore.exe H:\Documents and Settings\aaaa\Pulpit\AKG\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Gainward] H:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [APVXDWIN] "H:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Anti-keylogger] H:\Documents and Settings\aaaa\Pulpit\Nowy folder (2)\Anti-keylogger.exe /autorun O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [LightScribe Control Panel] H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [Gadu-Gadu] "H:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = H:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: avldr - H:\WINDOWS\SYSTEM32\avldr.dll O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - H:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - H:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - H:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe

**Posty:** 18165 · przez **wojtas** 06 Mar 2008, 21:27

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

i bedzie czysto

podejrzenie o keylogger

Podejrzenie o keylogger

Kto jest na forum