log2:
»»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»
Thu 05 Aug 04 21:38:43
9:38pm up 0 days, 0:04
Microsoft Windows XP [version 5.1.2600]
»»»IE build and last SP(s)
6.0.2800.1106 SP1-Q823353-Q832894-Q831167-Q867801
Filsystemtypen er NTFS.
C: er ikke ‘ndret.
»»»»»»»»»»»»»»»»»»***LOG2!(*updated 7/30)***»»»»»»»»»»»»»»»»
This log will confirm if the file was successfully moved, and/or
the right file was selected...
Scanning for file(s) in System32...
»»»»»»» (1) »»»»»»»
\\?\C:\WINDOWS\SYSTEM32\EMJKB.DLL +++ File read error
C:\WINDOWS\System32\EMJKB.DLL +++ File read error
»»»»»»» (2) »»»»»»»
EMJKB.DLL Can't Open!
HLG.DLL Can't Open!
INJAC.DLL Can't Open!
NPNFCAA.DLL Can't Open!
»»»»»»» (3) »»»»»»»
No matches found.
Unknown/hidden files...
No matches found.
»»»»»»» (4) »»»»»»»
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»»»(5)»»»»»
¯ Access denied ® ..................... EMJKB.DLL .....30720 03.08.2004
¯ Access denied ® ..................... HLG.DLL .....30720 01.08.2004
¯ Access denied ® ..................... INJAC.DLL .....30720 31.07.2004
¯ Access denied ® ..................... NPNFCAA.DLL .....30720 04.08.2004
»»»»»(6)»»»»»
fgrep: can't open input C:\WINDOWS\SYSTEM32\EMJKB.DLL
fgrep: can't open input C:\WINDOWS\SYSTEM32\HLG.DLL
fgrep: can't open input C:\WINDOWS\SYSTEM32\INJAC.DLL
fgrep: can't open input C:\WINDOWS\SYSTEM32\NPNFCAA.DLL
»»»»»»» Search by size...
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»*»»» Scanning for moved file... »»»*»»»
\\?\C:\FINDnFIX\junkxxx\COMOHD.333 +++ File read error
C:\FINDnFIX\junkxxx\COMOHD.333 +++ File read error
C:\FINDNFIX\JUNKXXX\
comohd.333 Sun 25 Jul 2004 15.27.04 A.... 57.344 56,00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57.344 bytes 56,00 K
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\FINDNFIX\JUNKXXX\COMOHD.333
SNiF 1.34 statistics
Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.*
fgrep: can't open input C:\FINDNFIX\JUNKXXX\COMOHD.333
A----- COMOHD .333 0000E000 15:27.04 25/07/2004
--a-- - - - - - 57,344 07-25-2004 comohd.333
A C:\FINDnFIX\junkxxx\comohd.333
CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
MD5 Message Digest Algorithm by RSA Data Security, Inc.
File name Size Date Time MD5 Hash
________________________________________________________________________C:\FINDnFIX\junkxxx\COMOHD.333 can't be opened.
CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk
C:\FINDNFIX\JUNKXXX
File: <C:\FINDnFIX\junkxxx\comohd.333>
#######################################################
*Known files are...
--------------------
File: ((56k; (57,344 bytes)
(CRC16 : 3138)
CRC-32 : D5C9FB2E
MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249
--------------------
File: ((35k; (35,840 bytes)
(CRC16 : EEB1)
CRC-32 : 33081C8B
MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE
--------------------
File: ((21k; (21,504 bytes)
(CRC16 : 90A5)
CRC-32 : 2258F59E
MD5 : EFEE2CB3 B342A351 51802356 9637F8E6
#######################################################
»»Permissions:
C:\FINDnFIX\junkxxx\comohd.333 NT AUTHORITY\SYSTEM:F
COMPUTER\Jakob Jørgensen:F
BUILTIN\Administratorer:F
BUILTIN\Brugere:R
Directory "C:\FINDnFIX\junkxxx\."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 0000000B -co- 10000000 ---A ---- ---- \CREATOR OWNER
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administratorer
Allow 00000002 tc-- 00000004 ---- ---- --+- BUILTIN\Brugere
Allow 00000002 tc-- 00000002 ---- ---- -w-- BUILTIN\Brugere
Allow 00000003 tco- 001200A9 ---- -S-- r--x BUILTIN\Brugere
Allow 00000000 t--- 001F01FF ---- DSPO rw+x COMPUTER\Jakob Jørgensen
Allow 00000013 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administratorer
Allow 00000013 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x COMPUTER\Jakob Jørgensen
Allow 0000001B -co- 10000000 ---A ---- ---- \CREATOR OWNER
Allow 00000013 tco- 001200A9 ---- -S-- r--x BUILTIN\Brugere
Allow 00000012 tc-- 00000004 ---- ---- --+- BUILTIN\Brugere
Allow 00000012 tc-- 00000002 ---- ---- -w-- BUILTIN\Brugere
Owner: COMPUTER\Jakob Jørgensen
Primary Group: COMPUTER\Ingen
Directory "C:\FINDnFIX\junkxxx\.."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administratorer
Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000000 t--- 001F01FF ---- DSPO rw+x COMPUTER\Jakob Jørgensen
Allow 0000000B -co- 10000000 ---A ---- ---- \CREATOR OWNER
Allow 00000003 tco- 001200A9 ---- -S-- r--x BUILTIN\Brugere
Allow 00000002 tc-- 00000004 ---- ---- --+- BUILTIN\Brugere
Allow 00000002 tc-- 00000002 ---- ---- -w-- BUILTIN\Brugere
Owner: COMPUTER\Jakob Jørgensen
Primary Group: COMPUTER\Ingen
File "C:\FINDnFIX\junkxxx\comohd.333"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x COMPUTER\Jakob Jørgensen
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administratorer
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Brugere
Owner: COMPUTER\Jakob Jørgensen
Primary Group: COMPUTER\Ingen
C:\FINDnFIX\junkxxx\comohd.333;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\comohd.333;COMPUTER\Jakob J›rgensen:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\comohd.333;BUILTIN\Administratorer:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\comohd.333;BUILTIN\Brugere:RrRaRepX[I]
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450
»»Dumping Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs =
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Brugere
(IO) ALLOW Read BUILTIN\Brugere
(NI) ALLOW Read BUILTIN\Superbrugere
(IO) ALLOW Read BUILTIN\Superbrugere
(NI) ALLOW Full access BUILTIN\Administratorer
(IO) ALLOW Full access BUILTIN\Administratorer
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administratorer
(IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Brugere
Read BUILTIN\Superbrugere
Full access BUILTIN\Administratorer
Full access NT AUTHORITY\SYSTEM
00001150: ?
00001190: vk UDeviceNo
000011D0:tSelectedTimeout 1 5 ( W vk ' z
00001210:GDIProcessHandleQuota" 9 0 F vk X
00001250:Spooler2 y e s vk =pswapdisk
00001290: 8 h vk ( R TransmissionRetryTimeout
000012D0: vk ' USERProcessHandleQuota 8
00001310:h vk y AppInit_DLLs
00001350:
00001390:
000013D0:
00001410: w u
00001450:
00001490: t j m w
000014D0: v k b ] Y Y V I 3 |^ }
00001510:
00001550:
---------- NEWWIN.TXT
AppInit_DLLsÿÿÿÿ¸
--------------
--------------
$011C7: UDeviceNotSelectedTimeout
$0120F: zGDIProcessHandleQuota
$012B8: TransmissionRetryTimeout
$012E8: USERProcessHandleQuota
$01338: AppInit_DLLs
$015EC: dcsbakkglgee
$015F9: ZZRPOOLHIHDFHB
$01DA9: EB8EC5CB4CE2
--------------
--------------
No strings found.
d.... 0 Aug 1 19:13 .
d.... 0 Aug 1 19:13 ..
....a 57344 Jul 25 15:27 comohd.333
3 files found occupying 55296 bytes
===============================================================================
57,344 bytes 955,733 cps
Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.06
VDIR v1.00
Path: C:\FINDNFIX\JUNKXXX\*.*
---------------------------------------+---------------------------------------
. <dir> 08-01-:4 19:13|COMOHD 333 57344 A 07-25-:4 15:27
.. <dir> 08-01-:4 19:13|
---------------------------------------+---------------------------------------
3 files totaling 57344 bytes consuming 65024 bytes of disk space.
17299968 bytes available on Drive C: No volume label
...File dump...
junkxxx\comohd.333
Adgang n‘gtet.
0 fil(er) kopieret.
Detecting...
C:\FINDnFIX\junkxxx
comohd.333 ACL has 4 ACE(s)
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = COMPUTER/Jakob Jørgensen S-1-5-21-583907252-1708537768-1343024091-1003
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administratorer S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Brugere S-1-5-32-545
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001200a9 -R -X
ACL done...
Finished Detecting...
