Podejrzenie keyloggera

[bandrzal]

Witam przeskanowałem sobie dziś komputer usbfixem i troche się zaniepokoiłem

Found! C:\Users\Bandrzal\AppData\Roaming\dclogs\2013-05-22-4.dc
Found! C:\Users\Bandrzal\AppData\Roaming\dclogs
Found! C:\Windows\system32\secushr.dat
Found! HKCU\Software\DC3_FEXEC
Found! HKU\S-1-5-21-3861928909-2305400966-3731113094-1001\Software\DC3_FEXEC

Nie mam pewności czy to coś poważnego ale lepiej sprawdzić 

logi frst

http://wklej.org/id/1748274/

http://wklej.org/id/1748275/

http://wklej.org/id/1748276/

[jessica]

Nie sądzę, by było to coś poważnego.

 

Otwórz Notatnik i wklej w nim:

 

C:\ProgramData\DT0001.dat
S3 AsrCDDrv; \??\C:\Windows\system32\Drivers\AsrCDDrv.sys [X]
S3 cpuz136; \??\C:\Users\Bandrzal\AppData\Local\Temp\cpuz136\cpuz136_x32.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 GGMXMIEDGO; \??\C:\Windows\system32\drivers\GGMXMI.sys [X]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]
S3 hamachi; system32\DRIVERS\hamachi.sys [X]
S3 USBPNPA; system32\drivers\CM108.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S3 vvftav303; system32\drivers\vvftav303.sys [X]
S3 WinRing0_1_2_0; No ImagePath
S3 ZSMC0303; System32\Drivers\usbVM303.sys [X]
FF Extension: PriceFountain - C:\Users\Bandrzal\AppData\Roaming\Mozilla\Firefox\Profiles\npahywwu.default-1368875828711\Extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi [2014-10-11]
HKLM\...\RunOnce: [] => [X]
HKU\S-1-5-21-3861928909-2305400966-3731113094-1001\...\Run: [AdobeBridge] => [X]
Task: {E9C4B4B7-C67C-4607-9DBE-B93577B2BF09} - System32\Tasks\{72110989-16D0-49FA-A5EF-1ACDDC21E37C} => pcalua.exe -a C:\Users\Bandrzal\Desktop\Setup\en_visual_c++_2010_sp1_redistributable_package_x86_651767.exe -d C:\Users\Bandrzal\Desktop\Setup
Task: {DB70CC1F-2257-4457-97B3-7B2B5C807104} - System32\Tasks\{9DB5C4F1-ACB6-410A-8205-D040C2B9EAAF} => pcalua.exe -a "C:\Users\Bandrzal\Desktop\minecraftbijacz\Minecraft 1.7.9.exe" -d C:\Users\Bandrzal\Desktop\minecraftbijacz
Task: {C2CDB58D-E765-423B-81DA-608CCBE6BF1A} - System32\Tasks\{1CA69BCF-4592-4B4E-B07E-177F2B1A5D79} => pcalua.exe -a "C:\Program Files\Nero\Nero 12\Uninstall.exe"
Task: {C47F63B0-E6BC-493F-B139-F569DD18E468} - System32\Tasks\{93258980-B526-4C2E-9068-F0E76DB85FBC} => pcalua.exe -a C:\Users\Bandrzal\Downloads\GameRangerSetup.exe -d C:\Users\Bandrzal\Downloads
Task: {871F2DEB-4E64-4B33-9ED0-AEFB754AB61B} - System32\Tasks\{31C0FE04-C032-4992-8215-9F5B0B3AE3E0} => pcalua.exe -a C:\Users\Bandrzal\Downloads\TagesSetup.exe -d C:\Users\Bandrzal\Downloads
Task: {483F6BB4-D510-4267-9239-657BFB9D09CB} - System32\Tasks\{6056E63B-7711-4589-BD80-0283A70B8ADD} => pcalua.exe -a H:\Redist\DirectX\dxsetup.exe -d H:\Redist\DirectX
Task: {3252662B-5756-4A30-8F37-C9AD0F8A416A} - System32\Tasks\{5F239F31-B899-4C79-9A82-2CA7099BA569} => pcalua.exe -a "C:\Users\Bandrzal\Downloads\Nero Lite 12.0.28001full_registered.exe" -d C:\Users\Bandrzal\Downloads
C:\Users\Bandrzal\AppData\Roaming\dclogs
C:\Windows\system32\secushr.dat
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

 

jessi

[bandrzal]

http://wklej.org/id/1748681/

log z usbfix

http://wklej.org/id/1748685/