Prośba o sprawdzenie logów

Dla specjalistów Bezpieczeństwo
#1

Mam ogromną prośbę o sprawdzenie logów. Mój problem polega na tym, iż jestem na 60% pewien, że mam na kompie keyloggera. A ciekawostką jest, że takie coś pojawia mi się nim Hijackid zacznie robic te logi:

http://img691.imageshack.us/i/przedlogami.jpg/

A o to moje logi:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:35:18, on 2011-04-01

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16982)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe

C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\PLAY ONLINE\PLAY ONLINE.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

D:\Program Files\Gadu-Gadu 10\gg.exe

C:\Users\Arth\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Arth\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Arth\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Arth\AppData\Local\Google\Chrome\Application\chrome.exe

D:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)

O4 - HKLM…\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM…\Run: [lxecmon.exe] “C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe”

O4 - HKLM…\Run: [EzPrint] “C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe”

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [egui] “C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” /hide /waitservice

O4 - HKCU…\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU…\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

O4 - HKCU…\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\macromed\Flash\NPSWF32_FlashUtil.exe -p

O4 - Startup: OpenOffice.org 2.4.lnk = D:\Program Files\OpenOffice.org 2.4\program\quickstart.exe

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra ‘Tools’ menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O17 - HKLM\System\CCS\Services\Tcpip…{58BD7F4B-6C8E-44BD-902C-5336DB12FE88}: NameServer = 89.108.195.20 217.17.34.10

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: lxecCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\lxecserv.exe

O23 - Service: lxec_device - - C:\Windows\system32\lxeccoms.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

–

End of file - 4798 bytes

#2

To nie jest ciekawostka tylko normalna rzecz - hijack jest za stary na windows 7/viste i niema dostępu do części plików. Wklej logi zgodne z regulaminem.

#3

Arther , proszę zapoznać się z tematem zasady-wklejania-logow-forum-tytulowania-tematow-t253052.html , i zastosować się do niego, używając opcji EDYTUJ.