Mam problem podejżewam na swoim kompi keyloggera


(system) #1

mam podejrzenie że mam keyloggera wgrane jak go wykryć ?usunąć ? prosze o pomoc


(greh) #2

Pokaż log z HijackThis. Instrukcja :arrow: viewtopic.php?f=16&t=36654

Pokaż log z Combofix. Instrukcja :arrow: viewtopic.php?f=16&t=36654

Logi dajesz na wklej.org lub wklej.eu a w poście Pokażesz tylko link.


(system) #3

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:49:37, on 2009-02-25

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Microsoft Firewall Client 2004\FwcAgent.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Windows\system32\Drivers\spoolsv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://companyweb

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O4 - HKLM..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM..\Run: [Hidder] C:\PROGRA~1\GDATAS~1\SEKRET~1\Hidder.exe /start

O4 - HKLM..\Run: [MSN] C:\Windows\system32\Drivers\spoolsv.exe

O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU..\Run: [12CFG914-K641-26SF-N32P] C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe

O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Microsoft Firewall Client Management.lnk = ?

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://companyweb

O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://sbs2005/tsweb/msrdp.cab

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

--

End of file - 3967 bytes

-- Dodane 25.02.2009 (Śr) 14:06 --

ComboFix 09-02-24.02 - Tajniak 2009-02-25 14:02:56.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.503.253 [GMT 1:00]

Uruchomiony z: c:\documents and settings\Tajniak\Pulpit\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe

c:\windows\system32\drivers\spoolsv.exe

.

((((((((((((((((((((((((( Pliki utworzone od 2009-01-25 do 2009-02-25 )))))))))))))))))))))))))))))))

.

2009-02-19 10:05 . 2009-02-19 10:05

2009-02-18 11:30 . 2009-02-18 12:15 8,552 --a------ c:\documents and settings\student\bv2.exe

2009-02-18 09:45 . 2009-02-18 12:30 8,552 --a------ c:\documents and settings\Tajniak\bv2.exe

2009-02-17 13:40 . 2009-02-17 13:40

2009-02-16 14:52 . 2004-08-03 23:07 59,264 --a------ c:\windows\system32\drivers\USBAUDIO.sys

2009-02-16 14:52 . 2004-08-03 23:07 59,264 --a--c--- c:\windows\system32\dllcache\usbaudio.sys

2009-02-16 10:00 . 2009-02-18 09:00 8,552 --a------ c:\documents and settings\Administrator.STACJA004\bv2.exe

2009-02-16 09:56 . 2009-02-16 09:56

2009-01-28 07:00 . 2009-01-28 07:00

2009-01-26 13:09 . 2009-01-26 13:09

2009-01-26 12:40 . 2009-01-26 12:40

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-22 12:03 --------- d-----w c:\program files\Microsoft Chat

2009-01-21 08:02 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\Tibia

2009-01-21 08:00 --------- d-----w c:\program files\Tibia

2009-01-16 09:10 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer

2009-01-16 09:10 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\Media Player Classic

2009-01-16 09:09 --------- d-----w c:\program files\K-Lite Codec Pack

2009-01-15 10:11 --------- d-----w c:\program files\HP

2009-01-15 08:06 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\Ahead

2009-01-14 11:51 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-14 11:51 --------- d-----w c:\program files\G DATA Software

2009-01-08 09:27 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrueCrypt

2009-01-08 09:21 --------- d-----w c:\program files\TrueCrypt

2009-01-08 09:21 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\TrueCrypt

2009-01-07 10:02 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\TrueCrypt

2009-01-07 10:01 215,872 ----a-w c:\windows\system32\drivers\truecrypt.sys

2009-01-07 09:33 253,116 ----a-w c:\windows\PDFCreator_Toolbar_Uninstaller_843.exe

2009-01-07 09:33 14,290 ----a-w c:\program files\settings.dat

2009-01-07 09:33 --------- d-----w c:\program files\PDFCreator Toolbar

2009-01-07 09:33 --------- d-----w c:\program files\PDFCreator

2009-01-07 09:15 --------- d-----w c:\documents and settings\student\Dane aplikacji\TrueCrypt

2009-01-07 09:14 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

2009-01-07 09:07 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\WoDBO

2009-01-05 13:14 --------- d-----w c:\documents and settings\student\Dane aplikacji\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"12CFG914-K641-26SF-N32P"="c:\recycler\S-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe" [2009-02-18 8552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-05-06 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-05-06 118784]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"Hidder"="c:\progra~1\GDATAS~1\SEKRET~1\Hidder.exe" [2002-06-03 565248]

"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Microsoft Firewall Client Management.lnk - c:\windows\Installer{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2005-12-13 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-1650\Scripts\Logon\0\0]

"Script"=printer.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-2150\Scripts\Logon\0\0]

"Script"=printer.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-2590\Scripts\Logon\0\0]

"Script"=printer.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2756001398-2085459168-2910692662-2150\Scripts\Logon\0\0]

"Script"=printer.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2756001398-2085459168-2910692662-3211\Scripts\Logon\0\0]

"Script"=printer.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe"=

"c:\Program Files\MSN Messenger\msnmsgr.exe"=

"c:\Program Files\Messenger\msmsgs.exe"=

"c:\Program Files\HP\cs\cs\hl.exe"=

"c:\Documents and Settings\Administrator.STACJA004\Pulpit\cs\cs\hl.exe"=

"c:\Documents and Settings\Administrator.STACJA004\Pulpit\cod na Zsp2-rogas\CoDMP.exe"=

"c:\Program Files\HP\cs\cs\hlds.exe"=

"\\MICHAL\QUAKE3\quake3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 AFPAnsi;G-DATA UkrywaczAnsi;c:\windows\system32\drivers\AFPAnsi.sys [2009-01-14 31776]

R2 FwcAgent;Firewall Client Agent;c:\program files\Microsoft Firewall Client 2004\FwcAgent.exe [2005-02-10 124176]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]

rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\CChat25.inf,PerUserAdd.NT

.

.

------- Skan uzupełniający -------

.

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride =

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}

LSP: c:\program files\Microsoft Firewall Client 2004\FwcWsp.dll

FF - ProfilePath - c:\documents and settings\Tajniak\Dane aplikacji\Mozilla\Firefox\Profiles\4aq59d8r.default\

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-25 14:04:08

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

c:\windows\hide.conf 44 bytes

skanowanie pomyślnie ukończone

ukryte pliki: 1

**************************************************************************

.

Czas ukończenia: 2009-02-25 14:05:03

ComboFix-quarantined-files.txt 2009-02-25 13:05:01

Przed: 29,729,538,048 bajtów wolnych

Po: 29,846,941,696 bajtów wolnych

129 --- E O F --- 2008-12-19 08:49:55


(huber2t) #4

fix w hijackthis

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

c:\documents and settings\student\bv2.exe

c:\documents and settings\Tajniak\bv2.exe

c:\documents and settings\Administrator.STACJA004\bv2.exe


Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"12CFG914-K641-26SF-N32P"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000000

"UpdatesDisableNotify"=dword:00000000

Plik -> zapisz jako -> CFScript.txt.

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

cfscript10uc2.gif

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na http://wklej.org a w poście dajesz tylko link