MyCity » Ambulanta -> Arhiva Ambulante » Keylogger

Keylogger

Napisano na dan: 28.1.2009

Keylogger

Sledeća strana

Pagination

Odgovori

Sale_cancer Poslao: 28 Jan 2009 19:14 Idi na vrh
offline Sale_cancer Novi MyCity građanin Pridružio: 23 Jan 2009 Poruke: 8	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pozdrav svima. Prvi put postujem i potrebno mi je misljenje, tj. pomoc. Pre par dana keylogger mi je skinuo neke lozinke i napravio mali kursum. Pokusao sam da resim problem ali obzirom na skromno znanje nisam siguran te vas molim za pomoc u oceni statusa mog compa trenutno. Prema uputstvu : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:06:52, on 28.1.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\User\Desktop\Sugavi\TH1.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [Link mogu videti samo ulogovani korisnici] O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici] O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcSandraSrv.exe -- End of file - 4841 bytes Svaka vrsta pomoci ili komentara, saveta je dobro dosla. Sale

Profil

bobby Poslao: 28 Jan 2009 19:31 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Klikni desnim tasterom miša na avast! ikonicu ( ) u donjem, desnom uglu ekrana i izaberi Zaustavi Stalnu zaštitu. Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja. Skini ComboFix sa jedne od sledecih adresa na Desktop: [Link mogu videti samo ulogovani korisnici] [Link mogu videti samo ulogovani korisnici] [Link mogu videti samo ulogovani korisnici] Startuj ga i ne diraj prozor programa dok skenira. Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Profil

Sale_cancer Poslao: 28 Jan 2009 19:52 Idi na vrh
offline Sale_cancer Novi MyCity građanin Pridružio: 23 Jan 2009 Poruke: 8	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! ComboFix 09-01-21.04 - User 2009-01-28 19:47:30.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.2046.1455 [GMT 1:00] Running from: d:\downloads\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090128-0] On-access scanning disabled (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-28 ))))))))))))))))))))))))))))))) . 2009-01-22 19:36 . 2009-01-22 19:36 <DIR> d-------- c:\program files\Trend Micro 2009-01-19 20:39 . 2009-01-19 20:39 153 --a------ c:\windows\wininit.ini 2009-01-19 20:01 . 2009-01-19 20:22 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2009-01-19 20:01 . 2009-01-20 07:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-19 19:53 . 2009-01-20 17:25 <DIR> d-------- c:\program files\SpywareBlaster 2009-01-19 19:53 . 2009-01-20 17:25 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP 2009-01-19 14:49 . 2009-01-18 22:35 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d----c--- c:\windows\system32\DRVSTORE 2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d-------- c:\program files\Lavasoft 2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-01-19 14:35 . 2009-01-19 14:35 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-19 14:35 . 2009-01-18 22:30 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-01-05 19:37 . 2009-01-20 14:10 7,680 --ahs---- c:\windows\Thumbs.db . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-28 18:01 --------- d-----w c:\program files\Windows Media Connect 2 2009-01-28 18:01 --------- d-----w c:\program files\Real Alternative 2009-01-28 18:01 --------- d-----w c:\program files\QuickTime Alternative 2009-01-28 18:01 --------- d-----w c:\program files\Mv2Player 2009-01-28 18:01 --------- d-----w c:\program files\Codec Pack - All In 1 2009-01-20 16:32 --------- d-----w c:\documents and settings\User\Application Data\Skype 2009-01-20 15:00 --------- d-----w c:\documents and settings\User\Application Data\skypePM 2009-01-19 19:39 --------- d-----w c:\documents and settings\User\Application Data\RegClean 2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2002-12-31 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "HijackThis startup scan"="c:\program files\Trend Micro\HijackThis\HijackThis.exe" [2009-01-22 396288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-22 507224] "RTHDCPL"="RTHDCPL.EXE" [2007-02-26 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\sandra.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\RpcSandraSrv.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional 2005\\RpcDataSrv.exe"= "d:\\Program Files\\World of Warcraft\\World of Warcraft\\Repair.exe"= "d:\\Program Files\\World of Warcraft\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\backup\\d\\Program Files\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-19 64160] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-17 111184] R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2007-12-06 13696] R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2007-12-06 414592] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-07-17 20560] R4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416] . Contents of the 'Scheduled Tasks' folder 2009-01-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-22 18:30] 2008-10-10 c:\windows\Tasks\Schedule Task Weekly.job - c:\program files\Registry Easy\RE.exe [] . - - - - ORPHANS REMOVED - - - - Notify-WgaLogon - (no file) . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\User\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici] . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici] Rootkit scan 2009-01-28 19:48:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2009-01-28 19:49:28 ComboFix-quarantined-files.txt 2009-01-28 18:49:26 Pre-Run: 32.061.251.584 bytes free Post-Run: 32,119,025,664 bytes free 110 --- E O F --- 2009-01-13 23:48:28

Profil

bobby Poslao: 28 Jan 2009 19:59 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Jesi li pokretao ranije ComboFix na svoju ruku?

Profil

Sale_cancer Poslao: 28 Jan 2009 20:13 Idi na vrh
offline Sale_cancer Novi MyCity građanin Pridružio: 23 Jan 2009 Poruke: 8	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Nisam. Prvi put koristim taj program, skroz prema uputstvu iz ovog posta.

Profil

bobby Poslao: 28 Jan 2009 20:24 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Sale_cancer ::Nisam. Prvi put koristim taj program, skroz prema uputstvu iz ovog posta. OK. Zbog nekih linija iz loga sam stekao utisak da je ComboFix pustan i ranije, pa sam hteo da vidim log od prethodnog pustanja. S obzirom da nije pustan ranije, onda nista. Sto se tice samog loga, a i prethodnog loga napravljenog uz pomoc HijackThisa, oba su cista. Ako i dalje sumnjas da neceg ipak jos ima na kompjuteru, onda mi opisi kako si bio nasao taj keyloger itd, tako da ja mogu da steknem sliku o onome sta se desilo.

Profil

Sale_cancer Poslao: 28 Jan 2009 21:01 Idi na vrh
offline Sale_cancer Novi MyCity građanin Pridružio: 23 Jan 2009 Poruke: 8	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Hvala puno, izgleda da sam ga sredio ciscenjem onda. hvala na odgovoru i vremenu ljudi. Pozdrav

Profil

bobby Poslao: 28 Jan 2009 21:08 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Treba jos i da deinstaliras ComboFix, samo sto ce sada to biti malo komplikovano posto ga nisi skinuo na Desktop, onako kako sam ti ja napisao. Idi na Start > Run pa u dijalogu ukucaj CMD i klikni na OK. Otvorice se konzola. Kucaj redom sledece komande: `D: cd downloads combofix /u`

Profil

Sale_cancer Poslao: 29 Jan 2009 01:13 Idi na vrh
offline Sale_cancer Novi MyCity građanin Pridružio: 23 Jan 2009 Poruke: 8	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Combofix is uninstaled. Hvala za pomoc i brz odgovor, extra ste ljudi Pozdrav

Profil

MyCity » Ambulanta -> Arhiva Ambulante » Keylogger

Ko je trenutno na forumu

Ukupno su 1481 korisnika na forumu :: 52 registrovanih, 10 sakrivenih i 1419 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 6018 - dana 19 Dec 2025 13:41

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: 357magnum, A.R.Chafee.Jr., aramis s, Aska, Asparagus, babaroga, belov, Bickoooo, Cicumile, crnogorac, Daba75, Deki Duga Devetka, dragan_mig31, Electron, Fabius, Feller, HrcAk47, icemilos, In_hero, indja, Jablan, Jonbonjovi, kib, ladro, Lazarus, ljubo70, Lošmi, luka35, MaCS, micke83, milbos, mile.ilic75, mileta4, Milometer, Naj-Turs, nenad81, Paklenica, Perudin_92, Pilipenda, PITT, Promising0, proton, Rebel Frank, sedan, snik, TTN, tubular, VekiJ, Velibor Radoja, VX1, zeka013, zlaya011

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by