Sikkerhetstrøbbel - mulig keylogger

6. februar 2008

I jula ble jeg gjort oppmerksom på at noen hadde tilgang til informasjon på pcen min. Det startet med at jeg fikk en mail fra ebay om at noen hadde vært inne på kontoen min. Hver gang jeg byttet passord på ebay, var passordet byttet av noen andre neste gang jeg skulle logge inn. Én uke seinere fikk jeg en mail fra paypal om at de hadde stengt kontoen min ("limited access") grunnet at noen hadde vært inne på den óg.

Jeg la merke til at ebay-passordet mitt ikke ble byttet når jeg brukte laptopen min til å bytte passord, og dro dermed slutningen at problemet lå på den stasjonære datamaskinen min. For å finne problemet kjøpte jeg første ESET Smart Security, og kjørte grundige scans. ESET fant dessverre ingenting, så jeg installerte ad-aware og spybot i tillegg. Ad-aware greide å finne en keylogger, som jeg raskt fikk fjernet. Jeg byttet så alle passord, formaterte hoveddisken og installerte Windows Vista.

Pga. at jeg ikke har en scanner fikk jeg ikke låst opp paypalkontoen min før i går. Det som satt meg litt ut var derimot at jeg fikk en ny mail fra paypal i dag, under 24 timer siden kontoen min var opplåst, om at de hadde stengt den igjen av samme grunn som tidligere.

I dag har jeg kjørt grundige scans med ESET, Ad-Aware og Spybot, samt to online scans (A-square og Symantec). Ingen scans fant noe som helst.

Jeg trenger hjelp til å finne ut hva det er som foregår her. Noen tips til hva jeg kan gjøre for å beskytte datamaskinen min igjen?

Garanti · 6. februar 2008

Har du endret passordet på ebay-kontoen din siden den ble opplåst? Personen som keylogget deg har sikkert prøvd seg på nytt dersom dette ikke er tilfelle...

snippsat · 6. februar 2008

Vi kan se om det er noe og finne med HijackThis

Post-logg.

http://www.trendsecure.com/portal/en-US/to...ckthis/download

Kjør free check.

http://virusinfo.prevx.com/pxparall.asp?PXC=eb9579239860

6. februar 2008

Passordene har blitt endre flere ganger på de forskjellige kontoene (passordbytte var et nødvendig steg for å få tilbake paypalkontoen), så problemet ligger nok ikke der.

Gratissjekken fant en fil i system32-mappa som den mente var "generisk malware". Fila het swreg.exe (SteelwerX Freeware).

HJT loggfil:

Logfile of HijackThis v1.99.1

Scan saved at 20:46:37, on 06.02.2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Razer\Diamondback\razerhid.exe

C:\Windows\System32\rundll32.exe

C:\Windows\SOUNDMAN.EXE

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\Last.fm\LastFMHelper.exe

C:\Windows\System32\mobsync.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Razer\Diamondback\razertra.exe

C:\Program Files\Razer\Diamondback\razerofa.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Hijackthis\HijackThis.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Last.fm\LastFM.exe

C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Endret 6. februar 2008 av Slettet-dUuoCe48tm

norbat · 6. februar 2008

Hvis du har formatert hoveddisken, så ligger det ikke noe malware på den (fila swreg.exe brukes i noen 'fixe-program' for spyware, så i utg.pkt utgjør ikke den fila noen fare).

Da spørs det om du har noen 'slave'-disker som kan inneholde noe skrammel, selv om det høres lite sannsynlig ut da Vista ikke uten videre tillater hva som helst å kjøre. Vista-versjonen er selvfølgelig orginal?!

Hva andre årsaker kan det være:

- er passordene du lager, enkle å knekke?

- har du mulighet til å bytte brukerid, evt. opprette ny konto (m/ny brukerid og passord)?

- Er PC-en satt i nettverk med andre pc-er, har andre tilgang til nettverket/PC-en?

- ....

Du kunne ha kjørt en runde med combofix. Den loggen viser litt mer enn hva en hjt-logg gjør:

Hent Combofix, og legg det på skrivebordet

Kjør combofix.exe, og følg veiledningen.

Post loggfilen fra combofix (c:\combofix.txt)

Endret 6. februar 2008 av norbat

6. februar 2008

Passorden jeg har brukt har alltid vært helt tilfeldige åttetegnspassord med store og små bokstaver samt tegn, så de burde ikke være lette å knekke.

Jeg er på et nettverk med et par andre datamaskiner, men jeg deler ingen filer og vista er satt til å kreve passord hvis noen vil inn her. Vista-versjonen min er også original (Business).

Jeg vet ikke om jeg kan bytte bruker-id så lett, men det burde egentlig ikke være nødvendig med tanke på at passordene mine er vanskelige å knekke. Jeg synes i hvertfall det er svært spesielt at de greier å knekke paypalpassordet mitt få timer etter kontoen er blitt låst opp og fått et nytt passord. Jeg begynner egentlig å bli ganske nervøs, ettersom de mest sannsynelig har det meste av mine personopplysninger (kontonummer etc.).

Jeg kan også nevne at all nettrafikken min har gått gjennom en svensk VPN-service (relakks) i de siste månedene.

Poster Combofix-logg straks.

6. februar 2008

Combofix-logg:

ComboFix 08-02.05.3 - Torbjørn 2008-02-06 21:37:45.2 - NTFSx86

Microsoft® Windows Vista™ Business 6.0.6000.0.1252.47.1033.18.1358 [GMT 1:00]

Running from: C:\Users\Torbjørn\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2008-01-06 to 2008-02-06 )))))))))))))))))))))))))))))))

.

2008-02-06 20:32 . 2008-02-06 20:32 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\PrevxCSI

2008-02-06 19:00 . 2008-02-06 19:00 8,147,968 --a------ C:\Windows\System32\wmploc.DLL

2008-02-06 19:00 . 2008-02-06 19:00 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll

2008-02-06 19:00 . 2008-02-06 19:00 7,680 --a------ C:\Windows\System32\spwmp.dll

2008-02-06 19:00 . 2008-02-06 19:00 4,096 --a------ C:\Windows\System32\msdxm.ocx

2008-02-06 19:00 . 2008-02-06 19:00 4,096 --a------ C:\Windows\System32\dxmasf.dll

2008-02-06 19:00 . 2007-01-03 11:20 1,732 --a------ C:\Windows\System32\drivers\nvphy.bin

2008-02-06 18:59 . 2008-02-06 19:00 <DIR> d-------- C:\Users\Torbjørn\{b7b18379-2f76-41cd-bacb-581f7b84a136}

2008-02-06 18:58 . 2008-02-06 18:58 2,605,568 --a------ C:\Windows\System32\SLsvc.exe

2008-02-06 18:58 . 2008-02-06 18:58 566,784 --a------ C:\Windows\System32\SLCommDlg.dll

2008-02-06 18:58 . 2008-02-06 18:58 351,232 --a------ C:\Windows\System32\SLUI.exe

2008-02-06 18:58 . 2008-02-06 18:58 320,000 --a------ C:\Windows\System32\drivers\csc.sys

2008-02-06 18:58 . 2008-02-06 18:58 268,288 --a------ C:\Windows\System32\mcbuilder.exe

2008-02-06 18:58 . 2008-02-06 18:58 223,232 --a------ C:\Windows\System32\SLC.dll

2008-02-06 18:58 . 2008-02-06 18:58 186,368 --a------ C:\Windows\System32\SLLUA.exe

2008-02-06 18:58 . 2008-02-06 18:58 105,984 --a------ C:\Windows\System32\CscMig.dll

2008-02-06 18:58 . 2008-02-06 18:58 57,856 --a------ C:\Windows\System32\SLUINotify.dll

2008-02-06 18:58 . 2008-02-06 18:58 39,936 --a------ C:\Windows\System32\slcinst.dll

2008-02-06 18:58 . 2008-02-06 18:58 33,280 --a------ C:\Windows\System32\slwmi.dll

2008-02-06 17:45 . 2008-02-06 17:45 <DIR> dr-h----- C:\Users\Torbjørn\AppData\Roaming\SecuROM

2008-02-06 17:20 . 2006-11-02 10:44 315,392 --a------ C:\kmd.exe

2008-02-06 17:03 . 2008-02-06 17:03 <DIR> d-------- C:\Program Files\Microsoft Silverlight

2008-02-06 02:20 . 2008-02-06 02:20 <DIR> d--h----- C:\Windows\PIF

2008-02-06 01:43 . 2008-02-06 01:43 621,056 --a------ C:\Windows\System32\drivers\dxgkrnl.sys

2008-02-06 01:43 . 2008-02-06 01:43 36,864 --a------ C:\Windows\System32\cdd.dll

2008-02-06 01:35 . 2008-02-06 01:35 <DIR> d-------- C:\Users\All Users\Media Center Programs

2008-02-06 01:35 . 2008-02-06 01:35 <DIR> d-------- C:\ProgramData\Media Center Programs

2008-02-06 01:35 . 2007-05-16 16:45 3,497,832 --a------ C:\Windows\System32\d3dx9_34.dll

2008-02-06 01:35 . 2007-05-16 16:45 1,124,720 --a------ C:\Windows\System32\D3DCompiler_34.dll

2008-02-06 01:35 . 2007-05-16 16:45 443,752 --a------ C:\Windows\System32\d3dx10_34.dll

2008-02-06 01:24 . 2008-02-06 01:24 <DIR> d-------- C:\Program Files\Flagship Studios

2008-02-05 00:14 . 2008-02-05 00:14 32 --a------ C:\Windows\metadat32.scn

2008-02-05 00:12 . 2008-02-05 00:12 <DIR> d-------- C:\Windows\driver

2008-02-05 00:12 . 2008-02-05 00:13 <DIR> d-------- C:\Program Files\VPNTunnel Client

2008-02-04 02:02 . 2008-02-04 14:10 <DIR> d-------- C:\Program Files\Common Files\Steam

2008-02-04 01:14 . 2008-02-04 14:56 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Smart S.T.A.L.K.E.R. Mod Manager

2008-02-04 01:14 . 2008-02-04 14:56 <DIR> d-------- C:\Program Files\Smart Mod Manager

2008-02-04 01:00 . 2008-02-06 04:00 <DIR> d-a------ C:\Users\All Users\TEMP

2008-02-04 01:00 . 2008-02-06 04:00 <DIR> d-a------ C:\ProgramData\TEMP

2008-02-04 00:59 . 2008-02-04 01:00 <DIR> d-------- C:\Fraps

2008-02-04 00:42 . 2008-02-04 00:42 107,888 --a------ C:\Windows\System32\CmdLineExt.dll

2008-02-04 00:01 . 2005-05-26 15:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll

2008-02-03 16:17 . 2008-02-03 16:17 <DIR> d-------- C:\Users\All Users\Adobe

2008-02-03 16:17 . 2008-02-03 16:17 <DIR> d-------- C:\Program Files\Common Files\Adobe

2008-02-03 14:55 . 2008-02-04 13:56 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\OpenOffice.org2

2008-02-03 14:52 . 2008-02-03 14:53 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3

2008-02-02 13:24 . 2008-02-02 13:24 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Publish Providers

2008-02-02 13:24 . 2008-02-02 13:24 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\NetMedia Providers

2008-02-01 14:48 . 2008-02-01 14:48 <DIR> d-------- C:\Program Files\Microsoft SQL Server

2008-02-01 14:48 . 1998-10-29 15:45 306,688 --a------ C:\Windows\IsUninst.exe

2008-02-01 14:48 . 2002-12-17 16:23 33,340 --------- C:\Windows\System32\dbmsqlgc.dll

2008-02-01 14:48 . 2002-10-20 14:05 24,576 --------- C:\Windows\System32\dbmsgnet.dll

2008-02-01 14:48 . 2008-02-01 14:48 20,480 --a------ C:\Windows\System32\cliconfg.728

2008-02-01 14:47 . 2008-02-03 06:14 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Sony

2008-02-01 14:47 . 2008-02-01 14:47 <DIR> d-------- C:\Users\All Users\Sony

2008-02-01 14:47 . 2008-02-01 14:47 <DIR> d-------- C:\ProgramData\Sony

2008-02-01 14:41 . 2008-02-01 14:41 <DIR> d-------- C:\Program Files\Vstplugins

2008-02-01 14:40 . 2008-02-01 14:40 <DIR> d-------- C:\Program Files\Sony

2008-02-01 14:39 . 2008-02-01 14:39 <DIR> d-------- C:\Program Files\Sony Setup

2008-02-01 01:33 . 2008-02-01 01:35 <DIR> d-------- C:\Program Files\Citrus Alarm Clock

2008-01-31 22:04 . 2008-01-31 22:08 <DIR> d-------- C:\Program Files\Soulseek

2008-01-31 19:02 . 2008-01-31 19:02 <DIR> d-------- C:\Users\Torbjørn\.thumbnails

2008-01-31 19:00 . 2008-02-03 17:55 <DIR> d-------- C:\Users\Torbjørn\.gimp-2.4

2008-01-31 19:00 . 2008-01-31 19:00 <DIR> d-------- C:\Program Files\GIMP-2.0

2008-01-31 14:56 . 2008-01-31 14:56 <DIR> d-------- C:\Program Files\Unity

2008-01-30 23:55 . 2008-01-30 23:55 <DIR> d-------- C:\Windows\Sun

2008-01-30 23:54 . 2008-01-30 23:54 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Google

2008-01-30 23:52 . 2008-01-30 23:52 <DIR> d-------- C:\Users\All Users\Google

2008-01-30 23:52 . 2008-02-02 18:12 <DIR> d-------- C:\Program Files\Google

2008-01-30 23:52 . 2007-09-24 23:31 69,632 --a------ C:\Windows\System32\javacpl.cpl

2008-01-30 23:51 . 2008-01-30 23:52 <DIR> d-------- C:\Program Files\Java

2008-01-30 23:48 . 2008-01-30 23:48 <DIR> d-------- C:\Program Files\Common Files\Java

2008-01-30 23:23 . 2008-01-30 23:23 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\vlc

2008-01-30 21:33 . 2008-02-04 19:43 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\dvdcss

2008-01-30 21:32 . 2008-01-30 21:32 <DIR> d-------- C:\Program Files\VideoLAN

2008-01-30 15:45 . 2008-01-30 15:45 <DIR> d-------- C:\Program Files\Frameworkx

2008-01-30 15:34 . 2008-01-30 15:35 <DIR> d-------- C:\Users\All Users\Lavasoft

2008-01-30 15:34 . 2008-01-30 15:35 <DIR> d-------- C:\ProgramData\Lavasoft

2008-01-30 15:34 . 2008-01-30 15:34 <DIR> d-------- C:\Program Files\Lavasoft

2008-01-30 15:34 . 2008-01-30 15:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-01-30 15:18 . 2008-01-30 15:31 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy

2008-01-30 15:18 . 2008-01-30 15:31 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy

2008-01-30 15:18 . 2008-01-30 15:18 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-01-30 13:46 . 2008-02-03 17:49 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\gtk-2.0

2008-01-30 13:44 . 2008-02-06 01:36 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\.purple

2008-01-30 13:44 . 2008-01-30 13:44 <DIR> d-------- C:\Program Files\Pidgin

2008-01-30 13:44 . 2008-01-30 13:44 <DIR> d-------- C:\Program Files\Common Files\GTK

2008-01-30 13:06 . 2008-01-30 13:12 <DIR> d-------- C:\Super Turbo Tango Patcher 6000

2008-01-30 07:12 . 2008-01-29 22:19 <DIR> d-------- C:\Windows\Panther

2008-01-30 07:12 . 2006-11-02 10:53 438,840 -rahs---- C:\bootmgr

2008-01-30 07:12 . 2008-01-30 07:12 8,192 -ra-s---- C:\BOOTSECT.BAK

2008-01-30 00:58 . 2008-01-30 00:58 <DIR> d-------- C:\Users\All Users\Last.fm

2008-01-30 00:58 . 2008-01-30 00:58 <DIR> d-------- C:\ProgramData\Last.fm

2008-01-30 00:56 . 2008-01-30 00:56 <DIR> d-------- C:\Program Files\Last.fm

2008-01-30 00:03 . 2008-01-30 00:03 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Macromedia

2008-01-30 00:03 . 2008-02-03 16:19 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Adobe

2008-01-30 00:01 . 2008-01-30 00:13 <DIR> d-------- C:\Users\Torbjørn\AppData\Roaming\Winamp

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-06 20:37 2,359,296 --sha-w C:\Users\Torbjørn\NTUSER.DAT

2008-02-06 19:32 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\PrevxCSI

2008-02-06 18:09 174 --sha-w C:\Program Files\desktop.ini

2008-02-06 18:06 --------- d-----w C:\Program Files\Windows Mail

2008-02-06 18:06 --------- d-----w C:\Program Files\Windows Defender

2008-02-06 18:06 --------- d-----w C:\Program Files\Windows Calendar

2008-02-06 18:01 8,192 ----a-w C:\Windows\System32\riched32.dll

2008-02-06 18:01 77,824 ----a-w C:\Windows\System32\rascfg.dll

2008-02-06 18:01 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr

2008-02-06 18:01 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys

2008-02-06 18:01 694,784 ----a-w C:\Windows\System32\localspl.dll

2008-02-06 18:01 67,584 ----a-w C:\Windows\System32\wlanhlp.dll

2008-02-06 18:01 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys

2008-02-06 18:01 542,720 ----a-w C:\Windows\System32\sysmain.dll

2008-02-06 18:01 52,736 ----a-w C:\Windows\System32\rasdiag.dll

2008-02-06 18:01 502,784 ----a-w C:\Windows\System32\wlansvc.dll

2008-02-06 18:01 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys

2008-02-06 18:01 47,104 ----a-w C:\Windows\System32\wlanapi.dll

2008-02-06 18:01 384,000 ----a-w C:\Windows\System32\netcfgx.dll

2008-02-06 18:01 33,280 ----a-w C:\Windows\System32\traffic.dll

2008-02-06 18:01 32,768 ----a-w C:\Windows\System32\rasmxs.dll

2008-02-06 18:01 297,984 ----a-w C:\Windows\System32\wlansec.dll

2008-02-06 18:01 290,816 ----a-w C:\Windows\System32\wlanmsm.dll

2008-02-06 18:01 286,208 ----a-w C:\Windows\System32\ipnathlp.dll

2008-02-06 18:01 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys

2008-02-06 18:01 24,064 ----a-w C:\Windows\System32\wtsapi32.dll

2008-02-06 18:01 22,016 ----a-w C:\Windows\System32\rasser.dll

2008-02-06 18:01 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys

2008-02-06 18:01 2,923,520 ----a-w C:\Windows\explorer.exe

2008-02-06 18:01 2,027,008 ----a-w C:\Windows\System32\win32k.sys

2008-02-06 18:01 15,360 ----a-w C:\Windows\System32\pacerprf.dll

2008-02-06 18:01 134,656 ----a-w C:\Windows\System32\dps.dll

2008-02-06 18:01 13,824 ----a-w C:\Windows\System32\wshqos.dll

2008-02-06 18:01 13,824 ----a-w C:\Windows\System32\icsunattend.exe

2008-02-06 17:59 8,704 ----a-w C:\Windows\System32\hcrstco.dll

2008-02-06 17:59 8,704 ----a-w C:\Windows\System32\hccoin.dll

2008-02-06 17:59 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys

2008-02-06 17:59 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-02-06 17:59 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys

2008-02-06 17:59 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-02-06 17:59 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll

2008-02-06 17:59 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys

2008-02-06 17:59 229,888 ----a-w C:\Windows\System32\msshsq.dll

2008-02-06 17:59 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys

2008-02-06 17:59 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-02-06 17:59 192,000 ----a-w C:\Windows\system32\drivers\usbhub.sys

2008-02-06 17:59 19,456 ----a-w C:\Windows\system32\drivers\usbohci.sys

2008-02-06 17:59 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-02-06 17:59 1,686,016 ----a-w C:\Windows\System32\gameux.dll

2008-02-06 17:57 974,336 ----a-w C:\Windows\System32\crypt32.dll

2008-02-06 17:57 88,576 ----a-w C:\Windows\System32\avifil32.dll

2008-02-06 17:57 82,944 ----a-w C:\Windows\System32\mciavi32.dll

2008-02-06 17:57 8,138,240 ----a-w C:\Windows\System32\ssBranded.scr

2008-02-06 17:57 712,192 ----a-w C:\Windows\System32\WindowsCodecs.dll

2008-02-06 17:57 69,632 ----a-w C:\Windows\System32\sendmail.dll

2008-02-06 17:57 65,024 ----a-w C:\Windows\System32\avicap32.dll

2008-02-06 17:57 61,440 ----a-w C:\Windows\System32\ntprint.exe

2008-02-06 17:57 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys

2008-02-06 17:57 31,232 ----a-w C:\Windows\System32\msvidc32.dll

2008-02-06 17:57 269,824 ----a-w C:\Windows\System32\schannel.dll

2008-02-06 17:57 220,160 ----a-w C:\Windows\System32\ntprint.dll

2008-02-06 17:57 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys

2008-02-06 17:57 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys

2008-02-06 17:57 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys

2008-02-06 17:57 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys

2008-02-06 17:57 123,904 ----a-w C:\Windows\System32\msvfw32.dll

2008-02-06 17:57 120,320 ----a-w C:\Windows\System32\dhcpcsvc6.dll

2008-02-06 17:57 12,800 ----a-w C:\Windows\System32\msrle32.dll

2008-02-06 17:57 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys

2008-02-06 17:57 10,240 ----a-w C:\Windows\System32\dhcpcmonitor.dll

2008-02-06 17:57 1,984,512 ----a-w C:\Windows\System32\authui.dll

2008-02-06 17:57 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys

2008-02-06 16:45 --------- d--h--r C:\Users\Torbjørn\AppData\Roaming\SecuROM

2008-02-06 16:28 --------- d-s---w C:\Users\Torbjørn\AppData\Roaming\Microsoft

2008-02-06 00:36 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\.purple

2008-02-05 23:27 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\uTorrent

2008-02-04 18:43 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\dvdcss

2008-02-04 13:56 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Smart S.T.A.L.K.E.R. Mod Manager

2008-02-04 12:56 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\OpenOffice.org2

2008-02-03 16:49 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\gtk-2.0

2008-02-03 15:19 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Adobe

2008-02-03 05:14 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Sony

2008-02-03 00:46 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\WinRAR

2008-02-02 12:24 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Publish Providers

2008-02-02 12:24 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\NetMedia Providers

2008-01-30 22:54 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Google

2008-01-30 22:23 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\vlc

2008-01-29 23:13 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Winamp

2008-01-29 23:03 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\Macromedia

2008-01-29 22:45 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\ESET

2008-01-29 22:30 --------- d-----w C:\Users\Torbjørn\AppData\Roaming\InstallShield

2008-01-29 21:53 --------- d-----w C:\Program Files\Windows Sidebar

2008-01-29 21:51 86,016 ----a-w C:\Windows\System32\icfupgd.dll

2008-01-29 21:51 802,816 ----a-w C:\Windows\system32\drivers\tcpip.sys

2008-01-29 21:51 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys

2008-01-29 21:51 61,952 ----a-w C:\Windows\System32\cmifw.dll

2008-01-29 21:51 414,208 ----a-w C:\Windows\System32\msscp.dll

2008-01-29 21:51 396,800 ----a-w C:\Windows\System32\MPSSVC.dll

2008-01-29 21:51 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-30 23:55 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-02-06 19:00 1006264]

"Diamondback"="C:\Program Files\Razer\Diamondback\razerhid.exe" [2007-02-14 11:15 147456]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]

"SoundMan"="SOUNDMAN.EXE" [2007-03-09 16:28 598016 C:\Windows\SOUNDMAN.EXE]

"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

C:\Users\Torbj›rn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-01-30 00:56:37 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []

R3 Razerlow;Razerlow USB Filter Driver;C:\Windows\system32\Drivers\Razerlow.sys [2005-04-24 22:43]

R3 rt61x86;Linksys Wireless-G PCI Adapter Driver;C:\Windows\system32\DRIVERS\WMP54Gv41x86.sys [2007-03-12 10:00]

R3 tap0901;TAP-Win32 Adapter V9;C:\Windows\system32\DRIVERS\tap0901.sys [2007-04-26 00:53]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-04 02:03]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

*Newly Created Service* - SIFILTER

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-06 21:39:04

Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-02-06 21:39:36

ComboFix2.txt 2008-02-06 16:28:18

.

2008-02-06 18:02:09 --- E O F ---

norbat · 6. februar 2008

Loggen ser fin ut. Ingen ting der som viser noe tegn på infeksjoner av noe slag.

Den vpn-tunnelen du har brukt de siste mnd. er 100% trygg? (Probl. startet ikke etter at du begynte å gå via dette?)

6. februar 2008

På en måte er det fint at loggen ser bra ut, men jeg skulle likt å ha noe håndfast å gå etter. Jeg tror egentlig VPN-tunnelen skal være trygg, men man vet jo aldri. Jeg hadde brukt den i en eller to måneder før jeg først fikk problemer. Jeg får fikse nye passord fra en annen pc, og så se om det skjer noe igjen hvis jeg ikke bruker VPN-tunnelen på en stund.

Tusen takk for all hjelp så langt! Hvis noen kommer på noen ting jeg kan gjøre for å sikre pcen bedre, så post i vei. Jeg kommer til å oppdatere tråden hvis jeg finner ut noe mer.

Endret 6. februar 2008 av Slettet-dUuoCe48tm

norbat · 6. februar 2008

Det beste håndfaste, er de tiltak du selv har gjort: formatert og reinstallert PC-en. Den måten fjerner alle evt. keyloggere og andre callback-programmer som evt. måtte ha vært på systemet ditt. At problemet fortsatt er tilstede tyder da på at det enten er noen som fysisk har tilgang til PC-en (evt. via lokalnettverket) eller at det er noe utenfor din kontroll (les: ebay, vpn-servicen ....).

Ville nok ha koblet bort vpn-saken og kjørt 'vanlig' oppkobling for å se om det fortsatt er noe(n) som tukler med kontoen(e)

Logg inn

Sikkerhetstrøbbel - mulig keylogger

Anbefalte innlegg

Gjest Slettet-dUuoCe48tm

Lenke til kommentar

Videoannonse

Garanti

Lenke til kommentar

snippsat

Lenke til kommentar

Gjest Slettet-dUuoCe48tm

Lenke til kommentar

norbat

Lenke til kommentar

Gjest Slettet-dUuoCe48tm

Lenke til kommentar

Gjest Slettet-dUuoCe48tm

Lenke til kommentar

norbat

Lenke til kommentar

Gjest Slettet-dUuoCe48tm

Lenke til kommentar

norbat

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Populær nå

Skal man selv avbryte sykemelding om man blir bedre under sykemelding? Selv om arbeidsgiver er grunnen 1 2

Marius Borg Høiby og vold 1 2 3 4 66

Hvem er aktive 0 medlemmer