Victim på min windows xp

[saluttknall]

Da var systemscann med Sas gjort. Pcen er nå restartet og igjen har jeg prøvd å slette filene uten resultat.

 

Noen logg var ikke å oppdrive i programmet.

[snippsat]

Mener du at MoveOnBoot ikke greide og slette de filene?

Kan finne andere metoder,de filene må bort.

[saluttknall]

Nettopp, move On boot greide ikke å fjerne filene verken før eller etter scanningen med Sas

[snippsat]

Hmm rart.

Prøv denne.

http://ccollomb.free.fr/unlocker/#download

[saluttknall]

Ingen låshånterer funnet. Unlocker kan hjelpe deg med dette problemet. Når jeg da trykker ok avsluttes programmet.

[saluttknall]

Jeg vet btw hvilken nettside hackeren har brukt. Her er hva som stod på den. Hack by: Chameleon <[email protected]>

 

WINDOWS 95

Go to a dos prompt after you started dial up networking

type by the way if you don't know what victim.com stands for

you are a dumb mother fucker

 

TYPE

ftp victim.com

server will ask for username press enter

server will ask for password press enter

at the prompt type

quote user ftp

then type

quote cwd ~root

then type

quote pass ftp

 

Make sure that you delt the log file they might look at it and see that

you where on.

The password file for who is and isnt allowed on the system is

in the directory /etc/passwd so for you lamers once you got on the

system type cd etc the type get passwd.

If you have done the above right and the server is a little old

you will have root access. For you lamers root acces is the highest

security status you can have.

 

Note: This will work on most servers the older ones like

University's use.

 

UNIX

Do the same as above at the unix prompt.

 

LINUX

Do the same as unix.

 

OS/2

Do the same as windows 95 but open a OS/2 windows

[snippsat]

Du må velge slett.

[saluttknall]

Da lukker programmet seg og alt er som før.

[saluttknall]

Da jeg prøvde nå kom det derimot opp en feilmelding: Kunne ikke slette objekt. Ønsker du å slette dette objektet med neste systemstart? Ønsker jeg dette?

[snippsat]

Gjør du dette.

 

Du går i explorer.

Går til denne filen "C:\WINDOWS\system32\socks.exe"

Høyere kilkk,her velger du unlocker.

Kommer ingen handling,da velger du slett.

[snippsat]

Kunne ikke slette objekt. Ønsker du å slette dette objektet med neste systemstart? Ønsker jeg dette?

Ja.

[saluttknall]

socks.exe er borte

[snippsat]

Ok det samme med de 2 andrer.

Da er det ccleaner og en ny hjt-logg

[saluttknall]

De neste filene er borte når systemet gjenstartes. Betyr det at jeg bør restarte pcen?

[snippsat]

Ja restart husk ccleaner.

Så må jeg ha en ny HijackThis logg.

[saluttknall]

Klikk for å se/fjerne spoilerteksten nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:11:16, on 22.03.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\drivers\video\services.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\Opware14.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\OpScheduler.exe

c:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\HighCriteria\TotalRecorder\TotRecSched.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\system32\crypserv.exe

C:\Programfiler\F-Secure Anti-Virus\fswsclds.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\JAWS510\jfw.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\Programfiler\LogMeIn\x86\LogMeInSystray.exe

C:\Programfiler\Unlocker\UnlockerAssistant.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe

C:\Programfiler\Windows Media Player\WMPNSCFG.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\LogMeIn\x86\RaMaint.exe

C:\Programfiler\LogMeIn\x86\LogMeIn.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\JAWS510\JHookLdr.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fujitsu-siemens.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [snarvei til egenskapsside for High Definition Audio] HDAShCut.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Programfiler\Fellesfiler\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [WorkFlowTray] "C:\Programfiler\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe"

O4 - HKLM\..\Run: [Opware14] "C:\Programfiler\ScanSoft\OmniPagePro14.0\Opware14.exe"

O4 - HKLM\..\Run: [OpScheduler] "C:\Programfiler\ScanSoft\OmniPagePro14.0\OpScheduler.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Programfiler\HighCriteria\TotalRecorder\TotRecSched.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Programfiler\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programfiler\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Programfiler\Unlocker\UnlockerAssistant.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programfiler\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: Advarsel.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: utlånsbetingelser.rtf (User 'SYSTEM')

O4 - .DEFAULT Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT Startup: utlånsbetingelser.rtf (User 'Default user')

O4 - .DEFAULT User Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT User Startup: utlånsbetingelser.rtf (User 'Default user')

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsu-siemens.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1098953506825

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: c209f9drv - C:\WINDOWS\SYSTEM32\xmlst32.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Programfiler\F-Secure Anti-Virus\fswsclds.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: JFWService - Freedom Scientific BLV Group, LLC - C:\JAWS510\jfw.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programfiler\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programfiler\LogMeIn\x86\LogMeIn.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

 

--

End of file - 8818 bytes

[snippsat]

Kun hjt som kjører.

 

Start HijackThis finn disse linjene merk dem,så trykk fix checked.

C:\WINDOWS\system32\drivers\video\services.exe

 

O4 - S-1-5-18 Startup: Advarsel.exe (User 'SYSTEM')

 

O4 - S-1-5-18 Startup: utlånsbetingelser.rtf (User 'SYSTEM')

 

O4 - .DEFAULT Startup: Advarsel.exe (User 'Default user')

 

O4 - .DEFAULT Startup: utlånsbetingelser.rtf (User 'Default user')

 

O4 - .DEFAULT User Startup: Advarsel.exe (User 'Default user')

 

O4 - .DEFAULT User Startup: utlånsbetingelser.rtf (User 'Default user')

 

O20 - Winlogon Notify: c209f9drv - C:\WINDOWS\SYSTEM32\xmlst32.dll

 

 

Må spørre igjen du har slettet denne filen.

"C:\WINDOWS\system32\drivers\video\services.exe"

 

Start->kjør->cmd(enter)

 

Her skriver du dette.

 

sc stop swsclds(enter)

sc delete swsclds(enter)

 

Restart og en ny HijackThis logg.

[saluttknall]

Jeg glemte visst å fortelle at services.exe ikke var mulig å slette. Skal jeg gjøre det andre selv om den ikke er mulig å slette eller må jeg gjøre noe annet først?

 

Var foresten en av filene som jeg ikke fant i hjt. Det var også denne services.exe filen.

[snippsat]

Bare slett den med unlocker.

 

Restart hjt-logg.

[saluttknall]

Hjelpør ikke. Services vil rett og slett ikke forsvinne.