[wazaa]

Os on XP
ja keegi lasi tal msni listi tühjaks ja muutis parooli ära, kuigi sõber mul muutis enda parooli mitu korda.Ni et kuhu siis helistada ja kuidas teada saada kes see inimene on ja kas ta on üldse eestist.

hijackthis log

Logfile of HijackThis v1.97.7
Scan saved at 17:56:15, on 30.06.04
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Abi\Prog\WinSize\WinSize.exe
C:\PROGRAM FILES\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Abi\Prog\Radmin\r_server.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Abi\Prog\GetRight\getright.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Abi/Internet/Home2/home2_1024.htm
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DU Meter] C:\Abi\Prog\DU Meter\DUMETER.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [WinSize] C:\Abi\Prog\WinSize\WinSize.exe
O4 - HKLM\..\Run: [hppwrsav] C:\PROGRAM FILES\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [IconRestore] C:\Abi\Prog\_Noninst\IconSaver\RestoreIcons.vbs
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: Download with GetRight - C:\Abi\Prog\GetRight\GRdownload.htm
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Abi\Prog\GetRight\GRbrowse.htm
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACCBF31B-9AEA-46F5-8035-AFA168E8812D}: NameServer = 194.126.101.34,194.126.115.18
O17 - HKLM\System\CCS\Services\Tcpip\..\{D543B4AB-9014-404A-A506-835C836AA8D9}: NameServer = 194.126.101.34,194.126.115.18


Winlogon.exe on tõenäoliselt keylogger

[Eser]

Winlogon.exe on tõenäoliselt keylogger
tõenäoliselt mitte.. vaata-jälgi meilide liiklust

[wazaa]

[pppd]

[Dominus]

njaa.selle skänni: http://us.mcafee.com/root/mfs/default.asp andmetel peaks mul olema masinas sees selline virus:
http://vil.nai.com/vil/content/v_101058.htm
aga selle lehe järgi otsides ei leia ma ise midagi:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=SPYW_BRISS.C&VSect=T
soovitage mõnda head proget millega keyloggeritest lahti saada ja kaitset nende eest