keylogger + logi

**Posty:** 704 · przez **darktraveler** 23 Lis 2007, 16:34

Siema
Mam zainstalowanego Kaspersky Internet Securuty 7.0.0.125 (wczoraj importowałem stare ustawienia sprzed formatu jakieś 3 tygodnie temu z wersji 6... i w 6 nie było tego hyba) podczas uruchamiania gry LineAge 2 (serwer www.dragon-network.net )wyskakuje komunikat o keyloggerze bloggerze jak dam zakończ to wyłącza gre. Mam jeszcze inne gry sieciowe zainstalowane ale gdy uruchamiam to nie ma zdanego komunikatu. A więc czy to tylko wybryk kaperskiego czy coś sie zalęgło w kompie.
Firewwal Kasperskiego wystarczy czy lepiej Kerio zainstalować ???

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:02, on 2007-11-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Portrait Displays\forteManager\DTHtml.exe C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Codebox\BitMeter\BitMeter2.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\VMware\VMware Server\vmware-authd.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\VMware\VMware Server\vmserverdWin32.exe D:\GRY\lineage 2c4\system2\L2.exe H:\Programy\Antywirusy\SKAMOWANIE LOGI ZABEZPIECZENI\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 89.149.200.219 l2authd.lineage2.com O1 - Hosts: 89.149.200.219 l2testauthd.lineage2.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"" ["Nero AG"] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "DAEMON Tools Pro Agent" = ""C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"" ["DT Soft Ltd."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"] "DT LGE" = "C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder" ["Portrait Displays, Inc"] "UpdReg" = "C:\WINDOWS\Updreg.exe" ["Creative Technology Ltd."] "CTStartup" = "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run" ["Creative Technology Ltd."] "Jet Detection" = "C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [empty string] "Ai Nap" = ""C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"" [null data] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"" [null data] "IMJPMIG8.1" = ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32" [MS] "MSPY2002" = "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC" [null data] "PHIME2002ASync" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC" [MS] "PHIME2002A" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName" [MS] "AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"" ["Kaspersky Lab"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{654D0431-C930-43C4-B8DA-9AA01BA5B486}" = "PDI GUI Engine COM Obj" -> {HKLM...CLSID} = "PDI GUI Engine COM Obj" \InProcServer32\(Default) = "C:\Program Files\Common Files\Portrait Displays\Shared\HtmlEngine.dll" ["Portrait Displays, Inc"] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" [empty string] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki dla ochrony WWW" -> {HKLM...CLSID} = "Statystyki dla ochrony WWW" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <<!>> "AppInit_DLLs" = "C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll" ["Kaspersky Lab"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Kobyłka\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Kobyłka" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Bitmeter2" -> shortcut to: "C:\Program Files\Codebox\BitMeter\BitMeter2.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki dla ochrony WWW" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Statystyki dla ochrony WWW" {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "res://ieframe.dll/tabswelcome.htm" [file not found] HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 19 domain names to IP addresses, 2 of the IP addresses are *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] Asset Management Daemon, Asset Management Daemon, "C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe" [null data] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Kaspersky Internet Security 7.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r" ["Kaspersky Lab"] Portrait Displays Display Tune Service, DTSRVC, "C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe" [null data] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] VMware Authorization Service, VMAuthdService, "C:\Program Files\VMware\VMware Server\vmware-authd.exe" ["VMware, Inc."] VMware DHCP Service, VMnetDHCP, "C:\WINDOWS\system32\vmnetdhcp.exe" ["VMware, Inc."] VMware NAT Service, VMware NAT Service, "C:\WINDOWS\system32\vmnat.exe" ["VMware, Inc."] VMware Registration Service, vmserverdWin32, "C:\Program Files\VMware\VMware Server\vmserverdWin32.exe" ["VMware, Inc."] VMware Virtual Mount Manager Extended, vmount2, ""C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe"" ["VMware, Inc."] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor S330\Driver = "CNMLM45.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2007-11-23 15:29:42) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 22 seconds. ---------- (total run time: 46 seconds)

Kod: Zaznacz wszystko

**Posty:** 237 · przez **Kuba1** 23 Lis 2007, 16:58

Logi ok.

Fałszywy alarm Kaspersky-ego. Dodaj do wyjątków ten plik.

Na wszelki wypadek dołącz log z ComboFix

**Posty:** 704 · przez **darktraveler** 23 Lis 2007, 17:10

Prosze.

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Kobyˆka" 2007-11-23 16:06:08.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1308 [GMT 1:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 ))))))))))))))))))))))))))))))) 2007-11-22 20:41 91,124 --a------ C:\WINDOWS\system32\prfc0415.dat 2007-11-22 20:41 505,492 --a------ C:\WINDOWS\system32\prfh0415.dat 2007-11-22 12:02 <DIR> d-------- C:\Program Files\FlashGet 2007-11-17 07:39 281,552 --------- C:\WINDOWS\system32\cfosspeed.dll 2007-11-16 08:13 <DIR> d-------- C:\Program Files\Vstplugins 2007-11-16 08:07 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2007-11-16 08:07 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2007-11-16 08:06 <DIR> d-------- C:\Program Files\Sony 2007-11-16 08:06 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2007-11-14 22:43 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2007-11-14 22:36 131,072 --a------ C:\Progr_.dll 2007-11-14 18:59 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-11-12 18:21 <DIR> d-------- C:\Program Files\Ventrilo 2007-11-11 19:28 <DIR> d-------- C:\Program Files\Sony Setup 2007-11-11 16:56 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-11 16:56 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-11 16:56 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-11-11 16:56 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-11-11 16:07 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-11-11 15:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-11 15:48 <DIR> d-------- C:\Program Files\MSBuild 2007-11-11 15:46 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-11-11 15:45 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2007-11-11 15:43 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2007-11-11 15:43 <DIR> d-------- C:\Program Files\Reference Assemblies 2007-11-11 15:42 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-11-09 20:12 333,600 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-09 20:12 13,828,896 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-09 16:43 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-11-09 16:43 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-11-06 19:15 <DIR> d-------- C:\Program Files\Bonjour 2007-11-06 19:05 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2007-11-03 13:52 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-11-03 13:52 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-10-30 21:53 <DIR> d-------- C:\Program Files\FileZilla 2007-10-30 21:38 9,600 -ra------ C:\WINDOWS\system32\drivers\vmnetadapter.sys 2007-10-30 21:38 5,120 -ra------ C:\WINDOWS\system32\vnetinst.dll 2007-10-30 21:38 364,631 --a------ C:\WINDOWS\system32\vnetlib.dll 2007-10-30 21:38 15,616 --a------ C:\WINDOWS\system32\drivers\vmnetuserif.sys 2007-10-30 21:38 135,168 --a------ C:\WINDOWS\system32\vmnat.exe 2007-10-30 21:38 106,496 --a------ C:\WINDOWS\system32\vmnetdhcp.exe 2007-10-30 21:38 10,240 -ra------ C:\WINDOWS\system32\drivers\vmnet.sys 2007-10-30 21:35 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-10-30 21:33 <DIR> d-------- C:\Virtual Machines 2007-10-30 21:33 <DIR> d-------- C:\Program Files\Common Files\VMware 2007-10-30 21:32 <DIR> d-------- C:\Program Files\VMware 2007-10-28 13:37 <DIR> d-------- C:\Program Files\Stardock 2007-10-28 08:43 <DIR> d-------- C:\Program Files\Pionek (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-11-23 14:36 37736 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-23 14:36 194720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-23 14:36 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Azureus 2007-11-22 20:41 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\SmartFTP 2007-11-22 15:08 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\teamspeak2 2007-11-22 09:31 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\VMware 2007-11-21 18:43 --------- d-------- C:\Program Files\FreshDevices 2007-11-20 19:47 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-11-20 12:39 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Bioshock 2007-11-18 23:57 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\gtk-2.0 2007-11-16 20:00 --------- d-------- C:\Program Files\DivX Pro 6.2.5 VFW 2007-11-16 08:15 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Sony 2007-11-14 22:46 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\DAEMON Tools Pro 2007-11-14 19:20 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-11-14 18:59 278984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-14 18:59 25416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-11-13 20:18 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\UseNeXT 2007-11-12 18:21 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-11 18:54 --------- dr-h----- C:\DOCUME~1\KOBYKA~1\DANEAP~1\SecuROM 2007-11-11 15:38 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Sony Setup 2007-11-09 20:11 --------- d-------- C:\Program Files\Kaspersky Lab 2007-11-09 20:10 78415 --a------ C:\WINDOWS\system32\drivers\klif.cab 2007-11-04 08:47 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Canon 2007-11-03 07:13 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Publish Providers 2007-11-02 12:57 --------- d-------- C:\Program Files\Azureus 2007-10-28 08:47 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Pionek 2007-10-20 06:52 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\FileZilla 2007-10-20 06:35 --------- d-------- C:\Program Files\FileZilla Client 2007-10-19 20:42 --------- d-------- C:\Program Files\Winamp 2007-10-19 19:54 --------- d-------- C:\Program Files\Lavasoft 2007-10-19 19:54 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Lavasoft 2007-10-19 18:33 --------- d-------- C:\Program Files\Cream Software 2007-10-19 18:33 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Cream Software 2007-10-17 10:16 --------- d-------- C:\Program Files\DivX 2007-10-16 17:17 --------- d-------- C:\Program Files\AGEIA Technologies 2007-10-11 08:32 --------- d-------- C:\Program Files\TGTSoft 2007-10-07 14:42 --------- d-------- C:\Program Files\AdRem 2007-10-07 12:34 --------- d-------- C:\Program Files\Microsoft.NET 2007-10-04 17:54 720896 --a------ C:\WINDOWS\iun6002.exe 2007-10-04 15:53 --------- d-------- C:\Program Files\AlienGUIse 2007-09-27 11:28 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Ahead 2007-09-27 11:14 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Real 2007-09-27 06:05 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\AdobeUM 2007-09-26 21:30 --------- d-------- C:\Program Files\Gadu-Gadu 2007-09-26 13:49 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Arcsoft 2007-09-25 16:15 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\InstallShield 2007-09-25 15:51 663040 --a------ C:\WINDOWS\is-90LF2.exe 2007-09-24 18:04 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Ventrilo 2007-09-24 11:49 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-09-24 11:49 --------- d-------- C:\DOCUME~1\KOBYKA~1\DANEAP~1\Media Player Classic 2007-09-16 17:45 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin 2007-09-16 17:45 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin 2007-09-13 10:36 155648 --a------ C:\WINDOWS\system32\libssl32.dll 2007-09-13 08:45 70944 --a------ C:\WINDOWS\system32\PhysXLoader.dll 2007-09-11 16:41 0 -rahs---- C:\MSDOS.SYS 2007-09-11 16:41 0 -rahs---- C:\IO.SYS 2006-06-23 23:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 10:38] "DT LGE"="C:\Program Files\Portrait Displays\forteManager\DTHtml.exe" [2007-06-12 11:32] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 00:00] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-09-15 02:10] "Jet Detection"="C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-10-04 00:00] "Ai Nap"="C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2007-04-09 13:49] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 18:14] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 15:25] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll R0 Pnp680r;Silicon Image SiI 0680 Medley Raid Controller;C:\WINDOWS\system32\DRIVERS\pnp680r.sys R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);C:\WINDOWS\system32\drivers\e10kx2k.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys R3 pdiddcci;DDC/CI monitor;C:\WINDOWS\system32\DRIVERS\pdiddcci.sys R3 PdiPorts;Portrait Displays low level device driver;C:\WINDOWS\system32\Drivers\PdiPorts.sys S3 FreshIO;FreshIO;\??\C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys S3 XDva020;XDva020;\??\C:\WINDOWS\system32\XDva020.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-23 16:08:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run??????????st????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????'?????wd??w????????\???\???????t??????w-??w\???\?????????`?L????C@?\???\??????s????\??????s\????'??A??s?'???C@?x???`|?w\?????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-11-23 16:08:31 --- E O F ---

[ Dodano: Dzisiaj o 16:45 ]
LoL właśnie wiedźmina zainstalowałem i to samo keyloger.

**Posty:** 18165 · przez **wojtas** 23 Lis 2007, 18:30

czysto

**Posty:** 704 · przez **darktraveler** 23 Lis 2007, 18:31

a wiec mogę spokojnie dać do wyjątków ?

**Posty:** 8694 · przez **Red** 23 Lis 2007, 19:52

D:\GRY\lineage 2c4\system2\L2.exe

Taką masz ścieżkę,ona jest ok

keylogger + logi

keylogger + logi

Kto jest na forum