MyCity » Ambulanta -> Arhiva Ambulante » Keylogger

Keylogger

Napisano na dan: 28.1.2009

Keylogger
Sledeća strana Pagination

Idi na vrh

Poslao: 28 Jan 2009 19:14
Idi na vrh
offline
  • Pridružio: 23 Jan 2009
  • Poruke: 8

Pozdrav svima.

Prvi put postujem i potrebno mi je misljenje, tj. pomoc. Pre par dana keylogger mi je skinuo neke lozinke i napravio mali kursum. Pokusao sam da resim problem ali obzirom na skromno znanje nisam siguran te vas molim za pomoc u oceni statusa mog compa trenutno.

Prema uputstvu :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:52, on 28.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\Sugavi\TH1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcSandraSrv.exe

--
End of file - 4841 bytes

Svaka vrsta pomoci ili komentara, saveta je dobro dosla.

Sale



Poslao: 28 Jan 2009 19:31
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Klikni desnim tasterom miša na avast! ikonicu ( ) u donjem, desnom uglu ekrana i izaberi Zaustavi Stalnu zaštitu.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.


Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 28 Jan 2009 19:52
Idi na vrh
offline
  • Pridružio: 23 Jan 2009
  • Poruke: 8

ComboFix 09-01-21.04 - User 2009-01-28 19:47:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.2046.1455 [GMT 1:00]
Running from: d:\downloads\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090128-0] *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-28 )))))))))))))))))))))))))))))))
.

2009-01-22 19:36 . 2009-01-22 19:36 <DIR> d-------- c:\program files\Trend Micro
2009-01-19 20:39 . 2009-01-19 20:39 153 --a------ c:\windows\wininit.ini
2009-01-19 20:01 . 2009-01-19 20:22 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-19 20:01 . 2009-01-20 07:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-19 19:53 . 2009-01-20 17:25 <DIR> d-------- c:\program files\SpywareBlaster
2009-01-19 19:53 . 2009-01-20 17:25 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-19 14:49 . 2009-01-18 22:35 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d-------- c:\program files\Lavasoft
2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-19 14:35 . 2009-01-18 22:30 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-01-05 19:37 . 2009-01-20 14:10 7,680 --ahs---- c:\windows\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 18:01 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-28 18:01 --------- d-----w c:\program files\Real Alternative
2009-01-28 18:01 --------- d-----w c:\program files\QuickTime Alternative
2009-01-28 18:01 --------- d-----w c:\program files\Mv2Player
2009-01-28 18:01 --------- d-----w c:\program files\Codec Pack - All In 1
2009-01-20 16:32 --------- d-----w c:\documents and settings\User\Application Data\Skype
2009-01-20 15:00 --------- d-----w c:\documents and settings\User\Application Data\skypePM
2009-01-19 19:39 --------- d-----w c:\documents and settings\User\Application Data\RegClean
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2002-12-31 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"HijackThis startup scan"="c:\program files\Trend Micro\HijackThis\HijackThis.exe" [2009-01-22 396288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-22 507224]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\sandra.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\RpcSandraSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\RpcDataSrv.exe"=
"d:\\Program Files\\World of Warcraft\\World of Warcraft\\Repair.exe"=
"d:\\Program Files\\World of Warcraft\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\backup\\d\\Program Files\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-19 64160]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-17 111184]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2007-12-06 13696]
R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2007-12-06 414592]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-07-17 20560]
R4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416]
.
Contents of the 'Scheduled Tasks' folder

2009-01-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-22 18:30]

2008-10-10 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
.
- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\User\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-01-28 19:48:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-28 19:49:28
ComboFix-quarantined-files.txt 2009-01-28 18:49:26

Pre-Run: 32.061.251.584 bytes free
Post-Run: 32,119,025,664 bytes free

110 --- E O F --- 2009-01-13 23:48:28

Poslao: 28 Jan 2009 19:59
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jesi li pokretao ranije ComboFix na svoju ruku?

Poslao: 28 Jan 2009 20:13
Idi na vrh
offline
  • Pridružio: 23 Jan 2009
  • Poruke: 8

Nisam. Prvi put koristim taj program, skroz prema uputstvu iz ovog posta.

Poslao: 28 Jan 2009 20:24
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Sale_cancer ::Nisam. Prvi put koristim taj program, skroz prema uputstvu iz ovog posta.
OK. Zbog nekih linija iz loga sam stekao utisak da je ComboFix pustan i ranije, pa sam hteo da vidim log od prethodnog pustanja. S obzirom da nije pustan ranije, onda nista.

Sto se tice samog loga, a i prethodnog loga napravljenog uz pomoc HijackThisa, oba su cista.

Ako i dalje sumnjas da neceg ipak jos ima na kompjuteru, onda mi opisi kako si bio nasao taj keyloger itd, tako da ja mogu da steknem sliku o onome sta se desilo.

Poslao: 28 Jan 2009 21:01
Idi na vrh
offline
  • Pridružio: 23 Jan 2009
  • Poruke: 8

Hvala puno, izgleda da sam ga sredio ciscenjem onda. hvala na odgovoru i vremenu ljudi.

Pozdrav

Poslao: 28 Jan 2009 21:08
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Treba jos i da deinstaliras ComboFix, samo sto ce sada to biti malo komplikovano posto ga nisi skinuo na Desktop, onako kako sam ti ja napisao.

Idi na Start > Run pa u dijalogu ukucaj CMD i klikni na OK.
Otvorice se konzola.
Kucaj redom sledece komande:
D:
cd downloads
combofix /u

Poslao: 29 Jan 2009 01:13
Idi na vrh
offline
  • Pridružio: 23 Jan 2009
  • Poruke: 8

Combofix is uninstaled.

Hvala za pomoc i brz odgovor, extra ste ljudi Smile

Pozdrav

MyCity » Ambulanta -> Arhiva Ambulante » Keylogger

Ko je trenutno na forumu
 

Ukupno su 975 korisnika na forumu :: 67 registrovanih, 10 sakrivenih i 898 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, acov34, aleksmajstor, Apok, babaroga, bokisha253, Botovac, bpvl, ccoogg123, Cirkon, d.arsenal321, darkkran, drimer, Flanker-G, Frunze, galerija, GrobarPovratak, ivanR164, jalos, Jezekijel, jodzula, kihot, Koca Popovic, Kriglord, kunktator, KUZMAR, kybonacci, luja, Marko1238, mačković, mercedesamg, mikrimaus, Milan A. Nikolic, Milan Miscevic, mile23, Milo97, milos.cbr, milutin134, MiroslavD, mkukoleca, monomah, Mskok, nebidrag, nick79, nikoladim, niksa517, Parker, perunnurep, Prašinar, procesor, rajkoplje, royst33, ruma, Sirius, sombrero, Stoilkovic, stokssone, TheBeastOfMG, tihi-posmatrac, voja64, Volkhov-M, zeka013, ZlatniRez, Zoca, zokilivac, Žrnov, 79693