Problem z keyloggerem

[pysio]

Witam, mam problem z pewnym komputerem, prawdopodobnie ma jakiegos dobrego trojana,

 

 

OTL:

Wklej.to - po prostu wklej to - paste: LUTJ

Extras :

Wklej.to - po prostu wklej to - paste: k89i

 

logi nie są moje

Prosze o pomoc w rozwiazaniu teog problemu.

Edytowane 19 Czerwca 2010 przez pysio

[Kolobos]

Zrob skan przy pomocy mbam oraz cureit i usun to co wykryja.

 

Odinstaluj Ask Toolbar.

 

Wklej to do OTL i nacisnij Run Fix:

 

:OTL

PRC - [2010-05-21 11:46:08 | 000,408,064 | ---- | M] () -- C:\WINDOWS\intlib.exe

IE - HKU\S-1-5-21-1229272821-1303643608-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15003&l=dis

IE - HKU\S-1-5-21-1229272821-1303643608-1417001333-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Ask.com"

FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.6.117

FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=en_US&q="

[2010-04-27 18:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\martek\Dane aplikacji\Mozilla\Firefox\Profiles\tbejhx9a.default\extensions\toolbar@ask.com

[2010-04-27 18:01:46 | 000,002,425 | ---- | M] () -- C:\Documents and Settings\martek\Dane aplikacji\Mozilla\Firefox\Profiles\tbejhx9a.default\searchplugins\askcom.xml

O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O3 - HKU\S-1-5-21-1229272821-1303643608-1417001333-1003\..\Toolbar\WebBrowser: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O4 - HKLM..\Run: [intlib] C:\WINDOWS\intlib.exe ()

O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

[2010-06-17 15:39:33 | 000,000,000 | ---- | M] () -- C:\Program Files\Common Files\userInit.dll

[2010-06-12 14:42:44 | 000,408,064 | ---- | C] () -- C:\WINDOWS\intlib.exe

[2010-06-17 15:01:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

@Alternate Data Stream - 85 bytes -> C:\Documents and Settings\All Users\Pulpit:$SS_DESCRIPTOR_PBVUV9VK9V89VPTVWV4XT4VY5EVVVVVJVTVV4VV

 

 

Po wykonaniu daj log z combofix.