Gå til innhold

Trykket på link som jeg tror kan være Keylogger.

Raytee

Av Raytee
i IKT-drift og sikkerhet

Anbefalte innlegg

Videoannonse

Videoannonse
Annonse
norbat

norbat

Skrevet
Skrevet

De fleste antivirus- og antispywareprogrammer finner keyloggere.

 

Du kan gjøre følgende:

 

Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

 

Post loggfilen fra combofix (c:\combofix.txt)

Raytee

Raytee

Skrevet
  • Forfatter
Skrevet (endret)

Klikk for å se/fjerne innholdet nedenfor
ComboFix 08-07-26.1 - Raymond 2008-07-26 21:45:34.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT 2:00]

Running from: C:\Documents and Settings\Raymond\My Documents\ComboFix.exe

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\pskt.ini

C:\WINDOWS\system32\hifpersk.ini

C:\WINDOWS\system32\kmUxxyay.ini

C:\WINDOWS\system32\kmUxxyay.ini2

C:\WINDOWS\system32\mcrh.tmp

 

.

((((((((((((((((((((((((( Files Created from 2008-06-26 to 2008-07-26 )))))))))))))))))))))))))))))))

.

 

2008-07-14 06:07 . 2008-07-14 06:07 <DIR> d-------- C:\Program Files\Winamp Toolbar

2008-07-14 06:07 . 2008-07-14 06:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar

2008-07-14 06:06 . 2008-07-14 06:06 <DIR> d-------- C:\Program Files\Winamp Remote

2008-07-14 06:06 . 2008-07-14 06:07 <DIR> d-------- C:\Program Files\Winamp

2008-07-14 06:06 . 2008-07-14 06:07 <DIR> d-------- C:\Documents and Settings\Raymond\Application Data\Winamp

2008-07-14 06:06 . 2008-07-14 06:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\OrbNetworks

2008-07-12 21:29 . 2008-07-14 23:53 <DIR> d--h----- C:\$AVG8.VAULT$

2008-07-12 21:26 . 2008-07-26 20:09 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg

2008-07-12 21:26 . 2008-07-12 21:26 <DIR> d-------- C:\Program Files\AVG

2008-07-12 21:26 . 2008-07-12 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8

2008-07-12 21:26 . 2008-07-12 21:26 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys

2008-07-12 21:26 . 2008-07-12 21:26 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys

2008-07-12 21:26 . 2008-07-12 21:26 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll

2008-07-12 20:55 . 2008-07-12 20:55 110,419 --a------ C:\WINDOWS\BM6bf2f547.xml

2008-07-11 21:06 . 2008-06-13 15:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-07-11 21:06 . 2008-06-13 15:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-07-11 20:57 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

2008-07-11 20:57 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll

2008-07-11 20:57 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-07-11 20:39 . 2008-07-11 20:39 <DIR> d-------- C:\Program Files\Hamachi

2008-07-11 20:39 . 2008-07-11 23:19 <DIR> d-------- C:\Documents and Settings\Raymond\Application Data\Hamachi

2008-07-11 20:39 . 2008-07-11 20:39 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys

2008-07-11 19:31 . 2008-07-11 19:31 <DIR> d-------- C:\Program Files\VentSrv

2008-07-11 19:31 . 2008-07-11 19:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-07-09 02:55 . 2008-07-09 02:55 <DIR> d-------- C:\Program Files\DivX

2008-07-09 02:05 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

2008-07-09 02:05 . 2001-08-17 13:53 3,328 --a------ C:\WINDOWS\system32\drivers\qv2kux.sys

2008-07-09 02:05 . 2001-08-17 13:53 3,328 --a--c--- C:\WINDOWS\system32\dllcache\qv2kux.sys

2008-07-09 00:11 . 2008-07-09 00:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet

2008-07-09 00:08 . 2008-07-09 00:08 <DIR> d-------- C:\Program Files\Bonjour

2008-07-09 00:04 . 2008-07-09 00:04 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared

2008-07-09 00:03 . 2008-07-09 00:08 <DIR> d-------- C:\Program Files\Common Files\Adobe

2008-07-08 23:50 . 2008-07-08 23:52 139,264 --a------ C:\WINDOWS\War3Unin.exe

2008-07-08 23:50 . 2008-07-09 00:00 76,268 --a------ C:\WINDOWS\War3Unin.dat

2008-07-08 23:50 . 2008-07-08 23:52 2,829 --a------ C:\WINDOWS\War3Unin.pif

2008-07-08 23:49 . 2008-07-11 22:42 <DIR> d-------- C:\Program Files\Warcraft III

2008-07-08 22:36 . 2008-07-08 22:38 <DIR> d-------- C:\Program Files\PowerISO

2008-07-08 22:28 . 2008-07-26 21:49 <DIR> d-------- C:\Program Files\Steam

2008-07-08 22:28 . 2008-07-08 22:29 <DIR> d-------- C:\Program Files\BitLord

2008-07-08 22:21 . 2008-07-08 22:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2008-07-08 22:21 . 2008-07-08 22:21 <DIR> d-------- C:\Documents and Settings\Raymond\Contacts

2008-07-08 22:19 . 2008-07-08 22:19 <DIR> d-------- C:\Program Files\Opera

2008-07-08 22:17 . 2008-07-12 01:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-07-08 22:17 . 2008-07-08 22:21 <DIR> d-------- C:\Program Files\Windows Live

2008-07-08 22:17 . 2008-07-08 22:19 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller

2008-07-08 22:17 . 2008-07-08 22:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

2008-07-08 22:15 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll

2008-07-08 22:15 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui

2008-07-08 22:15 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui

2008-07-08 22:15 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui

2008-07-08 22:15 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui

2008-07-08 22:11 . 2008-07-08 22:11 <DIR> d-------- C:\Documents and Settings\Raymond\Application Data\ATI

2008-07-08 22:11 . 2008-07-08 22:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI

2008-07-08 22:11 . 2008-07-08 22:11 0 --a------ C:\WINDOWS\ativpsrm.bin

2008-07-08 22:10 . 2008-07-08 22:10 <DIR> d-------- C:\Documents and Settings\Raymond\Application Data\vlc

2008-07-08 22:09 . 2008-07-08 22:09 <DIR> d-------- C:\Program Files\Windows Media Connect 2

2008-07-08 22:08 . 2008-07-08 22:08 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2008-07-08 22:08 . 2008-07-08 22:09 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2008-07-08 22:07 . 2008-07-08 22:07 <DIR> d-------- C:\Program Files\VideoLAN

2008-07-08 22:04 . 2008-07-08 22:04 <DIR> d-------- C:\Program Files\ATI Technologies

2008-07-08 22:03 . 2008-07-08 22:03 <DIR> d---s---- C:\Documents and Settings\Raymond\UserData

2008-07-08 22:03 . 2008-07-08 22:03 <DIR> d-------- C:\ATI

2008-07-08 22:03 . 2008-06-02 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe

2008-07-08 22:01 . 2008-07-08 22:01 <DIR> d-------- C:\WINDOWS\system32\Lang

2008-07-08 22:01 . 2008-07-08 22:01 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav

2008-07-08 22:01 . 2008-07-08 22:01 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav

2008-07-08 22:00 . 1998-11-13 13:09 306,688 --a------ C:\WINDOWS\IsUn0414.exe

2008-07-08 22:00 . 2003-10-03 16:28 45,056 --a------ C:\WINDOWS\system32\vusetup.dll

2008-07-08 22:00 . 2005-06-07 03:51 11,264 --a------ C:\WINDOWS\system32\drivers\vulfntr.sys

2008-07-08 22:00 . 2005-01-06 04:02 6,912 --a------ C:\WINDOWS\system32\drivers\vulfnth.sys

2008-07-08 21:58 . 2008-07-08 21:58 <DIR> d-------- C:\Program Files\Realtek

2008-07-08 21:57 . 2008-07-08 21:57 <DIR> d-------- C:\Program Files\VIA

2008-07-08 21:56 . 2008-07-08 21:56 <DIR> d-------- C:\WINDOWS\vnDrvBas

2008-07-08 21:56 . 2005-06-17 13:41 61,440 --a------ C:\WINDOWS\system32\vuins32.dll

2008-07-08 21:56 . 2005-06-22 12:35 43,008 --a------ C:\WINDOWS\system32\drivers\fetnd5bv.sys

2008-07-08 21:55 . 2008-07-08 22:04 <DIR> d--h----- C:\Program Files\InstallShield Installation Information

2008-07-08 21:55 . 2008-07-08 22:03 <DIR> d-------- C:\Program Files\Common Files\InstallShield

2008-07-08 21:55 . 2008-07-08 21:55 <DIR> d-------- C:\Program Files\AMD

2008-07-08 21:55 . 2005-03-09 15:53 38,400 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys

2008-07-08 21:55 . 2008-07-08 21:55 16,174 --a------ C:\WINDOWS\Ascd_tmp.ini

2008-07-08 21:55 . 2004-04-26 18:00 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS

2008-07-08 21:55 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe

2008-06-11 00:07 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-06-11 00:07 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2008-06-11 00:07 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys

2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll

2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2008-06-03 06:20 3,100,160 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys

2008-06-03 03:46 10,276,864 ----a-w C:\WINDOWS\system32\atioglx2.dll

2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll

2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag.dll

2008-06-03 03:11 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll

2008-06-03 03:11 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe

2008-06-03 03:11 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll

2008-06-03 03:11 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll

2008-06-03 03:11 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll

2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx.exe

2008-06-03 03:08 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL

2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2.dll

2008-06-03 03:02 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll

2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag.dll

2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx.dll

2008-06-03 02:33 48,128 ----a-w C:\WINDOWS\system32\amdpcom32.dll

2008-06-03 02:29 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll

2008-06-03 02:28 23,040 ----a-w C:\WINDOWS\system32\atiadlxx.dll

2008-06-03 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll

2008-06-03 02:27 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll

2008-06-03 02:22 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll

2008-06-03 02:21 557,056 ----a-w C:\WINDOWS\system32\ati2cqag.dll

2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-02 21:39 1267040]

 

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

"Steam"="C:\Program Files\Steam\Steam.exe" [2008-07-08 22:28 1271032]

"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]

"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 02:05 200704]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-12 21:26 1232152]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 23:33 36352]

"SkyTel"="SkyTel.EXE" [2006-05-15 21:04 2879488 C:\WINDOWS\SkyTel.exe]

"RTHDCPL"="RTHDCPL.EXE" [2006-09-11 19:58 16264192 C:\WINDOWS\RTHDCPL.EXE]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\BitLord\\BitLord.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=

"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=

 

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-12 21:26]

R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-12 21:26]

R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-12 21:26]

R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-12 21:26]

.

- - - - ORPHANS REMOVED - - - -

 

BHO-{40C0E837-C49A-4BFB-AD78-8827ED61FD5B} - C:\WINDOWS\system32\yayxxUmk.dll

HKLM-Run-68c1c6db - C:\WINDOWS\system32\ksrepfih.dll

HKLM-Run-BM6bf2f547 - C:\WINDOWS\system32\qkkmiouj.dll

Notify-nnnkHaYP - nnnkHaYP.dll

 

 

.

------- Supplementary Scan -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.sol.no/

R1 -: HKCU-Internet Settings,ProxyOverride = *.local

O8 -: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

 

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-26 21:48:40

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\ati2evxx.exe

C:\WINDOWS\system32\ati2evxx.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

.

**************************************************************************

.

Completion time: 2008-07-26 21:51:17 - machine was rebooted [Raymond]

ComboFix-quarantined-files.txt 2008-07-26 19:50:59

 

Pre-Run: 474,840,870,912 bytes free

Post-Run: 476,084,379,648 bytes free

 

219 --- E O F --- 2008-07-11 23:47:20

 

Et spørsmål til, etter jeg hadde en trojan jeg slettet med AVG free, så kommer disse 2 opp hver gang jeg starter PCen;

 

C:\WINDOWS\system32\rundll32.exe |X| |

-----------------------------------------------

 

Error loading C:\WINDOWS\System32\qkkmiouj.dll

 

The specified module could not be found.

|OK|

--------------------------------------------------------------

C:\WINDOWS\system32\rundll32.exe |X| |

------------------------------------------------

Error loading C:\WINDOWS\System32\ksrepfih.dll

 

The specified module could not be found.

|OK|

Endret av Raytee

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste

  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...