Følgende filer er i dag oprettet i system32 og de var skjulte og har meget mistænksomme navne:
kxnttnkdxwiu.exe
mdsqoxnpxkkb.exe
rundIl32.exe
winnt update.exe
ws977093.ocx
SHIT....har sku lige fundet en fil fra en keylogger:
[18:Sep:2004, 08:44:10] Keylogger Started
[08:45:43] [CTRL] (Changed window)
[08:45:50] [CTRL] (Changed window)
[08:46:13] Kør [End] HKEY_CLASSES_ROOT (Changed window)
[08:46:38] [CTRL] (Changed window)
[08:47:16] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg HJ~LP! lukkende vinduer![TAB] (Return)
[08:47:20] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg [Up][Up][Up]HJ~~~~LP! (Return)
[08:47:35] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg [Del]Jeg har et mindre2[Left]2[End] problem med min pc. (Changed window)
[08:49:41] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg Hvis jeg ]bner joblisten g]r der 2 sek s] lukker den igen ad sig selv.[Left][Leftf[End] det samme med registrerings editoren. Er der nogen der ved hvad jeg kan g're+++100 (Changed window)
[08:50:47] Marker alt a[CTRL] (Changed window)
[08:51:05] Marker alt a[CTRL] (Changed window)
[08:52:46] [Udvikleren.dk] - Diverse forum - Oversigt - Mozilla Firefo winnt update.exe (Return)
[08:52:55] Google Search: winnt update.exe - Mozilla Firefox 2[Home]2 (Return)
[08:53:04] Google Search: "winnt update.exe" - Mozilla Firefox winnt update virus (Return)
[08:53:16] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:53:22] [Udvikleren.dk] - Velkommen til Udvikleren.dk - Mozilla Fir v[CTRL] (Return)
[08:54:54] C:\\WINDOWS\\system32 [F2][Left][Left]1 (Return)
[08:55:00] C:\\WINDOWS\\system32 [F2][Left][Left (Return)
[08:55:02] [CTRL][Del] (Changed window)
[08:55:32] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:55:34] Google Search: rundIl32.exe - Mozilla Firefox v[CTRL] (Return)
[08:55:37] C:\\WINDOWS\\system32 [F2][CTRL]c (Changed window)
[08:55:39] Google Search: kxnttnkdxwiu.exe - Mozilla Firefox v[CTRL] (Return)
[08:56:08] [Udvikleren.dk] - Diverse forum - Mozilla Firefox w (Return)
[08:56:40] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg F'lgende filer er i dag oprettet i system32 og de var skjulte og har meget mist`nksomme navne> (Return)
[08:56:43] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:56:46] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg v[CTRL] (Changed window)
[08:56:48] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:56:50] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg v[CTRL] (Changed window)
[08:56:52] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:56:55] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg v[CTRL] (Return)
[08:56:58] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg [Del] (Changed window)
[08:57:00] C:\\WINDOWS\\system32 [F2]c[CTRL] (Changed window)
[08:57:02] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg v[CTRL] (Changed window)
[08:57:04] C:\\WINDOWS\\system32 [F2][CTRL]c (Changed window)
[08:57:09] [Udvikleren.dk] - Teknologi > Generelt / DiversePost indlæg v[CTRL] (Changed window)
[08:57:26] C:\\WINDOWS\\system32 ssssssssss (Changed window)
[08:58:14] [CTRL] (Changed window)
[08:59:29] main.pas c[CTRL] (Changed window)
[08:59:54] main.pas v[CTRL][CTRL]z[CTRL] (Return)
[09:00:17] main.pas v[CTRLrunningProcessesList* (Changed window)
[09:00:32] main.pas Memo1.Li (Return)
[09:00:38] main.pas (< (Changed window)
[09:00:58] main.pas , ShelLApi (Changed window)
[09:01:17] TextPad c[CTRL] (Changed window)
[09:01:25] main.pas ,[CTRL] v[CTRL] (Changed window)
[09:01:39] Form1 [CTRL]c (Changed window)
[09:02:02] Unavngivet - Notesblok v[CTRL]c[CTRL] (Changed window)
[09:02:18] TextPad - [C:\\Programmer\\Borland\\Delphi7\\Projects\\PC Contro c[CTRL] (Changed window)
[09:02:24] main.pas [Left] (Return)
[09:02:29] main.pas v[CTRL] (Changed window)
[09:02:33] main.pas [End] (Return)
[09:02:49] main.pas KillTask*//[Left]v[CTRL]z[CTRL]winnt update.exe[End](< (Changed window)
-------------------------------------------------------
Jonas (Decko)
-------------------------------------------------------
[Redigeret d. 18/09-04 09:05:46 af Jonas (Decko)]