Results 1 to 6 of 6

Thread: Should I Panic or not ??

  1. #1
    Junior Member
    Join Date
    Apr 2007
    Posts
    4

    Default Should I Panic or not ??

    This is what SPYBOT found.
    Should I Panic or not ??
    Please if anyone can put some light on this...
    These are just traces or ?
    Thanks!!!!
    (XP+all updates, Spybot 1.4 + all updates)


    *******************************************************
    keylogger: Company: Next Generation Count
    Product: NGC PC & Internet Monitor
    Threat: Keylogger
    Company product URL: http://www.nextgen.dk/
    Functionality: Monitors keystrokes, internet activity, applications.
    Description: Stealth, sends log by email or file (network).

    NGC PC & Internet Monitor
    *******************************************************
    NGC PC & Internet Monitor: Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\LockX.Lock

    NGC PC & Internet Monitor: Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{729E478E-E746-11D5-9B2D-525405F95A4C}

    NGC PC & Internet Monitor: Interface (Lock) (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1918B48D-4585-4CFC-A51C-D5481EAE2E22}

    NGC PC & Internet Monitor: Interface (Lock) (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B135FACD-1C0C-467A-85B5-441684C04773}

    NGC PC & Internet Monitor: Type library (LockX) (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{729E478C-E746-11D5-9B2D-525405F95A4C}
    *******************************************************

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,460

    Default

    Hello.

    Could you follow the instructions that I posted in your other topic please: http://forums.spybot.info/showthread.php?t=12645
    You can also follow the procedure in this link:
    "BEFORE you POST"
    We need to see the HJT log, instructions to produce one in "BEFORE you POST"

    Thanks.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member
    Join Date
    Apr 2007
    Posts
    4

    Default

    Quote Originally Posted by tashi View Post
    Hello.

    Could you follow the instructions that I posted in your other topic please: http://forums.spybot.info/showthread.php?t=12645


    We need to see the HJT log, instructions to produce one in "BEFORE you POST"

    Thanks.
    sorry,
    here is my hjthis log
    K

  4. #4
    Junior Member
    Join Date
    Apr 2007
    Posts
    4

    Default

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 22:03:40, on 03.04.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Alati\Zashtita\Nod32\nod32krn.exe
    C:\Alati\Perfect Disk\PDAgent.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Alati\Logitech\iTouch\iTouch.exe
    C:\Alati\Zashtita\Nod32\nod32kui.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Dizajn\PDF\Print2PDF\PrnPack.exe
    C:\Link\DUmeter\DUMeter.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Alati\TClock\tclock.exe
    C:\Link\Skype\Phone\Skype.exe
    C:\Link\Trillian\trillian.exe
    C:\Link\mIRC\mirc.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Alati\totalcmd\TOTALCMD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Alati\totalcmd\TOTALCMD.EXE
    c:\Link\Download\HiJackThis_v2.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\dizajn\pdf\Acrobat Reader\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Alati\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [nod32kui] "C:\Alati\Zashtita\Nod32\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [PrintPack dispatcher] "C:\Dizajn\PDF\Print2PDF\PrnPack.exe" /server
    O4 - HKLM\..\Run: [DU Meter] C:\Link\DUmeter\DUMeter.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Startup: tclock.lnk = C:\Alati\TClock\tclock.exe
    O8 - Extra context menu item: Download with GetRight Pro - C:\Link\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Link\GetRight\GRbrowse.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\system32\Print602.dll
    O9 - Extra 'Tools' menuitem: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\system32\Print602.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Link\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Link\ICQLite\ICQLite.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Link\Yahoo Msngr\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Link\Yahoo Msngr\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1155506964484
    O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/inst...l/pinstall.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5...ws-i586-jc.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B659B31F-5F46-43A6-B8CA-49C336ACF3EC}: NameServer = 62.162.32.5 62.162.32.6
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: BCL easyPDF SDK Loader (bepprldr) - Unknown owner - C:\Program Files\Common Files\BCL Technologies\easyPDF 4\bepprldr.exe
    O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\KraFT\LOCALS~1\Temp\hpdj.exe (file missing)
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Alati\Zashtita\Nod32\nod32krn.exe
    O23 - Service: PDAgent - Raxco Software, Inc. - C:\Alati\Perfect Disk\PDAgent.exe
    O23 - Service: PDEngine - Raxco Software, Inc. - C:\Alati\Perfect Disk\PDEngine.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Link\RealVNC4\WinVNC4.exe
    O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\Media\ATI\Remote\x10nets.exe (file missing)

    --
    End of file - 7345 bytes

  5. #5
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,460

    Default

    Hello.

    Your log shows: Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 22:03:40, on 03.04.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    "BEFORE you POST"
    At the present time, do not run Trend Micro HijackThis v2.0.0 (BETA) to produce a log for this forum, unless specifically requested, or you have a Vista Operating System.
    Please READ: Which HJT Version to use
    Please do not post logs from HJT V2.0 Beta's unless you have Vista installed as your Operating System. All others will be asked to rescan and provide a log from 1.99.1

    Once Trend Micro has their version out of Beta we will review the situation.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  6. #6
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,460

    Default

    This topic has been archived.

    If you need it re-opened, please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •