March 31, 200719 yr Hey guys, I am prettie sure I have got a keylogger but I dont know where it is. I have done scans, on several different virus and spyware scanners, but the problem is still there. I have done a Hijack this log and I was wondering if someone here could check it out. Thanks for any help in advance. Earpy Logfile of HijackThis v1.99.1 Scan saved at 11:06:59, on 31/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] C:\WINDOWS\system32\acs[Caution: ExecutableFile] C:\Program Files\Alwil Software\Avast4\aswUpdSv[Caution: ExecutableFile] C:\Program Files\Alwil Software\Avast4\ashServ[Caution: ExecutableFile] C:\Program Files\IVT Corporation\BlueSoleil\BTNtService[Caution: ExecutableFile] C:\Program Files\TOSHIBA\ConfigFree\CFSvcs[Caution: ExecutableFile] C:\Program Files\Alwil Software\Avast4\ashMaiSv[Caution: ExecutableFile] C:\Program Files\Alwil Software\Avast4\ashWebSv[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\WINDOWS\System32\DLA\DLACTRLW[Caution: ExecutableFile] C:\Program Files\Java\jre1.5.0_11\bin\jusched[Caution: ExecutableFile] C:\WINDOWS\system32\rundll32[Caution: ExecutableFile] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp[Caution: ExecutableFile] C:\Program Files\Microsoft Office\Office12\GrooveMonitor[Caution: ExecutableFile] C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] C:\Program Files\DAEMON Tools\daemon[Caution: ExecutableFile] C:\Program Files\Windows Media Player\WMPNSCFG[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\Program Files\MSN Messenger\usnsvc[Caution: ExecutableFile] C:\PROGRA~1\Mozilla Firefox\firefox[Caution: ExecutableFile] C:\WINDOWS\system32\wuauclt[Caution: ExecutableFile] C:\Documents and Settings\Daniel\Desktop\HijackThis[Caution: ExecutableFile] C:\Documents and Settings\Daniel\Desktop\HijackThis[Caution: ExecutableFile] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/av ... _homepage/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [synTPEnh] ;C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: ExecutableFile] O4 - HKLM\..\Run: [Toshiba Hotkey Utility] ;"C:\Program Files\Toshiba\Windows Utilities\Hotkey[Caution: ExecutableFile]" /lang en O4 - HKLM\..\Run: [TPSMain] ;TPSMain[Caution: ExecutableFile] O4 - HKLM\..\Run: [smoothView] ;C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView[Caution: ExecutableFile] O4 - HKLM\..\Run: [PadTouch] ;C:\Program Files\TOSHIBA\Touch and Launch\PadExe[Caution: ExecutableFile] O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW[Caution: ExecutableFile] O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched[Caution: ExecutableFile]" O4 - HKLM\..\Run: [WinampAgent] ;C:\Program Files\Winamp\winampa[Caution: ExecutableFile] O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32[Caution: ExecutableFile] bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Windows Media Connect 2] ;"C:\Program Files\Windows Media Connect 2\WMCCFG[Caution: ExecutableFile]" /StartQuiet O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp[Caution: ExecutableFile] O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor[Caution: ExecutableFile]" O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio[Caution: ExecutableFile]" /RANDOM O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile]" /background O4 - HKCU\..\Run: [Taskbar Manager] ;C:\Program Files\Askarya\Taskbar Manager\TaskbarManager[Caution: ExecutableFile] O4 - HKCU\..\Run: [ctfmon[Caution: ExecutableFile]] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon[Caution: ExecutableFile]" -lang 1033 O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG[Caution: ExecutableFile] O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL[Caution: ExecutableFile]/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp[Caution: ExecutableFile] O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{75EFE855-C424-4928-BEE8-95BB82D7E98D}: NameServer = 192.168.2.1,192.168.2.5 O17 - HKLM\System\CS1\Services\Tcpip\..\{75EFE855-C424-4928-BEE8-95BB82D7E98D}: NameServer = 192.168.2.1,192.168.2.5 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs[Caution: ExecutableFile] O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc[Caution: ExecutableFile] O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv[Caution: ExecutableFile] O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ[Caution: ExecutableFile] O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv[Caution: ExecutableFile]" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv[Caution: ExecutableFile]" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService[Caution: ExecutableFile] O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs[Caution: ExecutableFile] O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst[Caution: ExecutableFile]" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: ExecutableFile] O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing[Caution: ExecutableFile] O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux[Caution: ExecutableFile] O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc[Caution: ExecutableFile]
April 1, 200719 yr You'd have better luck hitting ctrl alt del and looking up any unknown running processes 485th person to ever play RuneScapeBlue107- perm banned 10/12/2007. $300 USD reward if you can get me in contact with someone who will take 5 seconds to look at evidence and get my original character unbanned.
April 1, 200719 yr You'd have better luck hitting ctrl alt del and looking up any unknown running processes Most viruses, trojans, keyloggers don't show up in the task manager OR startup.
April 2, 200719 yr im to lazy to look in the log but if you dont have Spybot S&D, you should get it, and it run it, and let us know it that helps at all Aefx(started 11/1/2002) Cb: 200 TS: 1900+Bmms--Jr(Started on 1/24/06)(Banned 11/13/09 ) Cb: 119(pre-eoc) TS: 1700+Bmms(Started 8/?/2001)(Banned 1/24/06 ) Cb: 101(pre-eoc) TS: 1350+
April 5, 200719 yr Hi, have you tried uninstalling Java and re - installing it? That somtimes works for me. Science and Religion are not at odds.Science is simpily too young to understand.
April 6, 200719 yr emmm 66and06 , why would uninstalling Java help atall? he believe;s he ahs a keylogger... they cannot hide inside java, as it is a very secure langauge
April 6, 200719 yr emmm 66and06 , why would uninstalling Java help atall? he believe;s he ahs a keylogger... they cannot hide inside java, as it is a very secure langauge Java is not programed in Java so it is not secure and the only reason java is more secure is because it runs byte code off the JVM instead of machine code witch is one of the reasons Java is slower than other languages like C# and C++
April 8, 200719 yr I would try running an anti virus program, and an anti spyware program, just to be safe. Retired
April 27, 200719 yr honestly get spybot s&d and remember to immunize ur comp search for updates regularly and scan ur comp my bro said,"get a life" so i asked "where do i download that...98% Of teenagers surround their minds with rap music, if you're part of the 2% that stayed with rock, put this in your signature, ROCK IS BETTER!
Create an account or sign in to comment