Keylogger

elite007 · 19 Czerwiec 2012 18:37

Logi z otl:

extras.txt http://wklej.org/id/776242/

otl.txt http://wklej.org/id/776244/

Atis · 19 Czerwiec 2012 19:21

W panelu sterowania odinstaluj:

20Dollars2Surf

freemakeTB Toolbar

McAfee Security Scan Plus

Softonic toolbar on IE and Chrome

Winamp Toolbar

XfireXO Toolbar

Webroot Toolbar Updater

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | Auto | Stopped] – E:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys – (vstor2-ws60) DRV - File not found [Kernel | On_Demand | Stopped] – E:\Documents and Settings\Sebs\Pulpit\xqz ring0 by dedi\injectDLL.sys – (injectDLL) DRV - File not found [Kernel | On_Demand | Stopped] – E:\DOCUME~1\Sebs\USTAWI~1\Temp\cpuz134\cpuz134_x32.sys – (cpuz134) IE - HKLM…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/sli … 685&query={searchTerms}&invocationType=tb50winampie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={A83CA0D7-AAB1-46A5-80CC-19805D2E6260}&mid=498eb74ebb9147d0bd0e99127f775dfc-44ef882848c48fc36c4a40ce8312c2cb2777bf1d〈=pl&ds=st011&pr=sa&d=2012-05-29 11:46:12&v=11.1.0.7&sap=hp IE - HKCU…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - E:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKCU…\URLSearchHook: {adca5064-9e30-43fe-9856-58b07a3149fe} - E:\Program Files\freemakeTB\prxtbfree.dll (Conduit Ltd.) IE - HKCU…\SearchScopes${searchCLSID}: “URL” = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU…\SearchScopes{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=&apn_ptnrs=W6&apn_dtid=YYYYYYYYPL&apn_uid=fde9da32-238c-4ace-8bd6-a97c9c091548&apn_sauid=460475C0-4C97-4544-AF25-234ECE8168B5 IE - HKCU…\SearchScopes{6BBCAE15-5EC5-40B1-B1C7-6EEE1FB54C7F}: “URL” = http://search.softonic.com/MON00084/tb_v1?q={searchTerms}&SearchSource=4&cc= IE - HKCU…\SearchScopes{918987CA-0327-4E6E-80DC-B1C40119FFCF}: “URL” = http://search.phpnuke.org/?lang=en&q={searchTerms} IE - HKCU…\SearchScopes{92026D2D-FAE2-4428-A7BB-D62ED38EE11C}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=3538E3E4-7456-4E25-8F1B-756DB963BE09&apn_sauid=D3E3E064-CBB7-4585-81DB-0D31C55D01DC IE - HKCU…\SearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233}: “URL” = http://isearch.avg.com/search?cid={A83CA0D7-AAB1-46A5-80CC-19805D2E6260}&mid=498eb74ebb9147d0bd0e99127f775dfc-44ef882848c48fc36c4a40ce8312c2cb2777bf1d〈=pl&ds=st011&pr=sa&d=2012-05-29 11:46:12&v=11.1.0.7&sap=dsp&q={searchTerms} IE - HKCU…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3214568 IE - HKCU…\SearchScopes{DCDBBF03-BC10-457D-911F-EFB0321D22BE}: “URL” = ${SRCH_SCP_URL} IE - HKCU…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/sli … 685&query={searchTerms}&invocationType=tb50winampie7 IE - HKCU…\SearchScopes{F6364F62-6E2B-46f4-A9A4-70390062D5B9}: “URL” = http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.search.defaultthis.engineName: “freemakeTB Customized Web Search” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…keyword.URL: “http://websearch.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13997&locale=en_US&apn_uid=fde9da32-238c-4ace-8bd6-a97c9c091548&apn_ptnrs=W6&apn_sauid=460475C0-4C97-4544-AF25-234ECE8168B5&apn_dtid=YYYYYYYYPL&&q=” FF - prefs.js…network.proxy.http: “64.191.102.135” FF - prefs.js…network.proxy.http_port: 80 [2012-05-30 17:45:40 | 000,000,000 | —D | M] (ToggleEN Community Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions{038cb5c7-48ea-4af9-94e0-a1646542e62b} [2010-09-15 17:10:46 | 000,000,000 | —D | M] (Winamp Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2012-05-30 17:45:41 | 000,000,000 | —D | M] (freemakeTB Community Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions{adca5064-9e30-43fe-9856-58b07a3149fe} [2012-05-30 17:45:43 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [2012-05-22 08:55:45 | 000,000,000 | —D | M] (ST-Polska Community Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} [2012-02-25 13:04:43 | 000,000,000 | —D | M] (Softonic Toolbar) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions\ffxtlbra@softonic.com [2011-02-07 11:15:13 | 000,000,000 | —D | M] (“AutocompletePro - Your handy search suggestions tool”) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions\support@predictad.com [2012-05-25 08:15:14 | 000,000,000 | —D | M] (“Webroot Toolbar”) – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\extensions\toolbar@ask.com [2012-06-19 10:31:02 | 000,002,572 | ---- | M] () – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\searchplugins\askcom.xml [2012-05-22 11:08:14 | 000,000,923 | ---- | M] () – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\searchplugins\conduit.xml [2010-09-15 17:12:13 | 000,001,244 | ---- | M] () – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\searchplugins\winamp-search.xml [2012-05-19 11:58:01 | 000,002,060 | ---- | M] () – E:\Documents and Settings\Sebs\Dane aplikacji\Mozilla\Firefox\Profiles\p1t3rx27.default\searchplugins\softonic.xml O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [ApnUpdater] E:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM…\Run: [bpk] E:\Program Files\BPK\bpk.exe () O20 - Winlogon\Notify\LogonInit: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found O30 - LSA: Authentication Packages - (ows\s) - File not found O30 - LSA: Security Packages - (Lsa) - File not found O30 - LSA: Security Packages - (ity Packages settings…) - File not found O30 - LSA: Security Packages - (or) - File not found [2012-06-19 20:33:01 | 000,000,232 | ---- | M] () – E:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job :Files E:\Program Files\BPK :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

elite007 · 19 Czerwiec 2012 19:48

Usuwanie http://wklej.org/id/776287/

otl http://wklej.org/id/776290/

extras brak ?

Atis · 19 Czerwiec 2012 20:03

Extras automatycznie tworzony jest tylko podczasz pierwszego skanowania.

Odinstaluj 20Dollars2Surf i McAfee Security Scan Plus

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKCU…\SearchScopes{C1B09C66-4BC4-4D3C-A696-809AE7AFDDB3}: “URL” = http://search.phpnuke.org/?lang=en&q={searchTerms} FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3214568&SearchSource=3&q={searchTerms}” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3214568&SearchSource=2&q=” O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4 - HKCU…\Run: [{57A8E436-5E89-5E50-4EA7-95B8A86DFBE3}] E:\Documents and Settings\Sebs\Dane aplikacji\Exb\akopek.exe (Paragon Software Group) O30 - LSA: Authentication Packages - (ows\s) - File not found [2011-03-17 18:58:44 | 000,040,960 | ---- | C] () – E:\WINDOWS\System32\svchostwb.dll [2011-03-17 18:58:44 | 000,024,576 | ---- | C] () – E:\WINDOWS\System32\svchosthk.dll [2011-03-17 18:58:44 | 000,007,680 | ---- | C] () – E:\WINDOWS\System32\rinst.exe [2011-03-17 18:58:44 | 000,004,208 | ---- | C] () – E:\WINDOWS\System32\pk.bin [2011-03-17 18:58:44 | 000,000,996 | ---- | C] () – E:\WINDOWS\System32\inst.dat :Files E:\Documents and Settings\Sebs\Dane aplikacji\Exb E:\Documents and Settings\Sebs\Ustawienia lokalne\Dane aplikacji*.exe E:\Documents and Settings\All Users\Dane aplikacji\svcdotnet.cfg :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.