mam podejrzenie że mam keyloggera wgrane jak go wykryć ?usunąć ? prosze o pomoc
Pokaż log z HijackThis. Instrukcja 
viewtopic.php?f=16&t=36654
Pokaż log z Combofix. Instrukcja viewtopic.php?f=16&t=36654
Logi dajesz na wklej.org lub wklej.eu a w poście Pokażesz tylko link.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:49:37, on 2009-02-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Firewall Client 2004\FwcAgent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Windows\system32\Drivers\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://companyweb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE
O4 - HKLM…\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”
O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”
O4 - HKLM…\Run: [Hidder] C:\PROGRA~1\GDATAS~1\SEKRET~1\Hidder.exe /start
O4 - HKLM…\Run: [MSN] C:\Windows\system32\Drivers\spoolsv.exe
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [12CFG914-K641-26SF-N32P] C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe
O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)
O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O4 - Global Startup: Microsoft Firewall Client Management.lnk = ?
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://companyweb
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://sbs2005/tsweb/msrdp.cab
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
–
End of file - 3967 bytes
– Dodane 25.02.2009 (Śr) 14:06 –
ComboFix 09-02-24.02 - Tajniak 2009-02-25 14:02:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.503.253 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Tajniak\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe
c:\windows\system32\drivers\spoolsv.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2009-01-25 do 2009-02-25 )))))))))))))))))))))))))))))))
.
2009-02-19 10:05 . 2009-02-19 10:05
2009-02-18 11:30 . 2009-02-18 12:15 8,552 --a------ c:\documents and settings\student\bv2.exe
2009-02-18 09:45 . 2009-02-18 12:30 8,552 --a------ c:\documents and settings\Tajniak\bv2.exe
2009-02-17 13:40 . 2009-02-17 13:40
2009-02-16 14:52 . 2004-08-03 23:07 59,264 --a------ c:\windows\system32\drivers\USBAUDIO.sys
2009-02-16 14:52 . 2004-08-03 23:07 59,264 --a–c— c:\windows\system32\dllcache\usbaudio.sys
2009-02-16 10:00 . 2009-02-18 09:00 8,552 --a------ c:\documents and settings\Administrator.STACJA004\bv2.exe
2009-02-16 09:56 . 2009-02-16 09:56
2009-01-28 07:00 . 2009-01-28 07:00
2009-01-26 13:09 . 2009-01-26 13:09
2009-01-26 12:40 . 2009-01-26 12:40
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 12:03 --------- d-----w c:\program files\Microsoft Chat
2009-01-21 08:02 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\Tibia
2009-01-21 08:00 --------- d-----w c:\program files\Tibia
2009-01-16 09:10 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-01-16 09:10 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\Media Player Classic
2009-01-16 09:09 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-15 10:11 --------- d-----w c:\program files\HP
2009-01-15 08:06 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\Ahead
2009-01-14 11:51 --------- d–h--w c:\program files\InstallShield Installation Information
2009-01-14 11:51 --------- d-----w c:\program files\G DATA Software
2009-01-08 09:27 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrueCrypt
2009-01-08 09:21 --------- d-----w c:\program files\TrueCrypt
2009-01-08 09:21 --------- d-----w c:\documents and settings\Tajniak\Dane aplikacji\TrueCrypt
2009-01-07 10:02 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\TrueCrypt
2009-01-07 10:01 215,872 ----a-w c:\windows\system32\drivers\truecrypt.sys
2009-01-07 09:33 253,116 ----a-w c:\windows\PDFCreator_Toolbar_Uninstaller_843.exe
2009-01-07 09:33 14,290 ----a-w c:\program files\settings.dat
2009-01-07 09:33 --------- d-----w c:\program files\PDFCreator Toolbar
2009-01-07 09:33 --------- d-----w c:\program files\PDFCreator
2009-01-07 09:15 --------- d-----w c:\documents and settings\student\Dane aplikacji\TrueCrypt
2009-01-07 09:14 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-01-07 09:07 --------- d-----w c:\documents and settings\Administrator.STACJA004\Dane aplikacji\WoDBO
2009-01-05 13:14 --------- d-----w c:\documents and settings\student\Dane aplikacji\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2004-08-04 15360]
“12CFG914-K641-26SF-N32P”=“c:\recycler\S-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe” [2009-02-18 8552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“IgfxTray”=“c:\windows\system32\igfxtray.exe” [2004-05-06 155648]
“HotKeysCmds”=“c:\windows\system32\hkcmd.exe” [2004-05-06 118784]
“NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe” [2001-07-09 155648]
“RemoteControl”=“c:\program files\CyberLink\PowerDVD\PDVDServ.exe” [2003-12-08 32768]
“HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe” [2005-05-11 49152]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672]
“Hidder”=“c:\progra~1\GDATAS~1\SEKRET~1\Hidder.exe” [2002-06-03 565248]
“SoundMan”=“SOUNDMAN.EXE” [2004-02-26 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-04 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Firewall Client Management.lnk - c:\windows\Installer{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2005-12-13 53248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-1650\Scripts\Logon\0\0]
“Script”=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-2150\Scripts\Logon\0\0]
“Script”=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2106472956-637462658-1320264234-2590\Scripts\Logon\0\0]
“Script”=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2756001398-2085459168-2910692662-2150\Scripts\Logon\0\0]
“Script”=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2756001398-2085459168-2910692662-3211\Scripts\Logon\0\0]
“Script”=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\MSN Messenger\msnmsgr.exe”=
“c:\Program Files\Messenger\msmsgs.exe”=
“c:\Program Files\HP\cs\cs\hl.exe”=
“c:\Documents and Settings\Administrator.STACJA004\Pulpit\cs\cs\hl.exe”=
“c:\Documents and Settings\Administrator.STACJA004\Pulpit\cod na Zsp2-rogas\CoDMP.exe”=
“c:\Program Files\HP\cs\cs\hlds.exe”=
“\\MICHAL\QUAKE3\quake3.exe”=
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“3389:TCP”= 3389:TCP:@xpsp2res.dll,-22009
R0 AFPAnsi;G-DATA UkrywaczAnsi;c:\windows\system32\drivers\AFPAnsi.sys [2009-01-14 31776]
R2 FwcAgent;Firewall Client Agent;c:\program files\Microsoft Firewall Client 2004\FwcAgent.exe [2005-02-10 124176]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\CChat25.inf,PerUserAdd.NT
.
.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride =
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
LSP: c:\program files\Microsoft Firewall Client 2004\FwcWsp.dll
FF - ProfilePath - c:\documents and settings\Tajniak\Dane aplikacji\Mozilla\Firefox\Profiles\4aq59d8r.default\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-25 14:04:08
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
c:\windows\hide.conf 44 bytes
skanowanie pomyślnie ukończone
ukryte pliki: 1
**************************************************************************
.
Czas ukończenia: 2009-02-25 14:05:03
ComboFix-quarantined-files.txt 2009-02-25 13:05:01
Przed: 29,729,538,048 bajtów wolnych
Po: 29,846,941,696 bajtów wolnych
129 — E O F — 2008-12-19 08:49:55
fix w hijackthis
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
File::
c:\documents and settings\student\bv2.exe
c:\documents and settings\Tajniak\bv2.exe
c:\documents and settings\Administrator.STACJA004\bv2.exe
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"12CFG914-K641-26SF-N32P"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->
Rozpocznie się usuwanie i powstanie log, który dasz na forum.
Logi dajesz na http://wklej.org a w poście dajesz tylko link