sunt spionata, ajutor

salutare tuturor,

as avea nevoie de ajutorul cuiva care pricepe mai mult decat mine, sunt convinsa de faptul ca sunt spionata, asta pentru ca mi se confirma prin lucruri pe care le-am scris sau le-am primit pe yahoo.

am facut o scanare cu hijack si iata rezultatul:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 19:26:50, on 11.04.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\sstray.exe

C:\WINDOWS\VM_STI.EXE

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\WINDOWS\Mixer.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Cosmino\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\bit comet\BitComet\tools\BitCometBHO_1.1.3.28.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE A4 Tech USB PC Camera

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [spyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\bit comet\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\bit comet\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\bit comet\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xport

Crezi ca controleaza PC-ul sau doar intercepteaza convorbirile?

Iti sugerez sa faci un scan si cu gmer: http://www.gmer.net/

cred ca , pana la urma, intercepteaza convorbirile, dar mi-e teama ca o poate face tocmai pentru ca, atunci cand a avut acces la pc, a instalat ceva care ii transmite tot. merci mult

am facut scan cu gmer, dar nu inteleg absolut nimic... cum imi dau seama daca e ceva in neregula?

Salveaza logul de la gmer (butonul Save) si pune-l aici sa-l vedem. Daca persoana respectiva sta in vecini este posibil sa iti intercepteze convorbirile din retea fara sa fi instalat nimic pe calculatorul tau; dar depinde de retea..

Sa zicem ca intr-adever conversatiile tale ajung prin email la persoana respectiva. Cine stie ce altceva mai face.

Cea mai sigura solutie este sa reinstalezi sistemul, pui parola, un firewall si antivirus si apoi stai linistit.

ce conspiratii...e probabil un keylogger si faptul cai ai windows piratat si stelutza microsoft(WGA) ti-a aparut in sistray te face foarte vulnerabil la atacuri...e de ajuns sa iti aflu IP-ul si pot sa iau controlul asupra PC-ului tau cu windows remote desktop....degeaba reinstalezi windows-ul setluta va continua sa apara la scut timp dupa reinstalare....cea mai buna idee e un OS-uriginal si un antivirul licentiat ca sa ai o protectie mai reusita a sistemului....

csifer a scris:

ce conspiratii...e probabil un keylogger si faptul cai ai windows piratat si stelutza microsoft(WGA) ti-a aparut in sistray te face foarte vulnerabil la atacuri...e de ajuns sa iti aflu IP-ul si pot sa iau controlul asupra PC-ului tau cu windows remote desktop....degeaba reinstalezi windows-ul setluta va continua sa apara la scut timp dupa reinstalare....cea mai buna idee e un OS-uriginal si un antivirul licentiat ca sa ai o protectie mai reusita a sistemului....

Nu faptul ca ai un windows piratat te face sa fii vulnerabil ci lipsa update-urilor.. Pot sa am un Windows licentiat fara updateuri si este la fel de vulnerabil ca unul fara licenta. Pe de alta parte pot sa am unul fara licenta si sa opresc toate serviciile de genul pe care l-ai mentionat si nu va mai fi chiar atat de vulnerabil.. Dar sunt de acord.. sistemul trebuie platit ca se munceste greu pentru ele

persoana sta cu mine in casa dar nu are acces la pc-ul meu, pt ca i-am pus parola... utilizeaza un laptop pe care ii vin informatiile. conspiratie sau nu, cert este ca imi violeaza intimitatea...

in timp ce faceam scanarea cu gmer s-a restartat pc-ul fara niciun motiv. fac din nou, sper cu succes de data aceasta.

ok, iata rezultatul:

GMER 1.0.14.14205 - http://www.gmer.net

Rootkit scan 2008-04-12 17:35:09

Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.14 ----

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwConnectPort [0xBAD45040]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xBAD41930]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xBAD4CA80]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreatePort [0xBAD45510]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateProcess [0xBAD4B870]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateProcessEx [0xBAD4BAA0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateSection [0xBAD4EFD0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateWaitablePort [0xBAD45600]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xBAD41F20]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xBAD4D6E0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xBAD4D440]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDuplicateObject [0xBAD4B580]

SSDT sptd.sys ZwEnumerateKey [0xF9906C7E]

SSDT sptd.sys ZwEnumerateValueKey [0xF9906FF6]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadDriver [0xBAD3F3F0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xBAD4D8B0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwMapViewOfSection [0xBAD4F270]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xBAD41D70]

SSDT sptd.sys ZwOpenKey [0xF9906A18]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenProcess [0xBAD4B350]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenThread [0xBAD4B150]

SSDT sptd.sys ZwQueryKey [0xF99070C0]

SSDT sptd.sys ZwQueryValueKey [0xF9906F58]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xBAD4E250]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xBAD4DCB0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRequestWaitReplyPort [0xBAD44C00]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xBAD4E080]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSecureConnectPort [0xBAD45220]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xBAD42120]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetSystemInformation [0xBAD3F1C0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xBAD4D140]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwTerminateProcess [0xBAD4BCD0]

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwUnloadDriver [0xBAD3F5F0]

INT 0x20 srescan.sys F9703C70

---- Kernel code sections - GMER 1.0.14 ----

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 10, 55, D4, BA, 70, B8, D4, ... ]

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.

? C:\WINDOWS\System32\Drivers\SPTD9709.SYS The process cannot access the file because it is being used by another process.

? srescan.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.14 ----

.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1312] ntdll.dll!KiFastSystemCall + 2 7C90EB8D 2 Bytes [ CD, 20 ]

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F990FDB2] sptd.sys

IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F992571E] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F99103B2] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F99102B6] sptd.sys

IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F9910482] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F9910482] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F99103B2] sptd.sys

IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F99102B6] sptd.sys

IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F9925032] sptd.sys

IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F990FF6E] sptd.sys

IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F9925864] sptd.sys

IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F9914F78] sptd.sys

IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F9924C76] sptd.sys

IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F9925864] sptd.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F9924C82] sptd.sys

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [bAD49E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [bAD49E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [bAD57330] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F9902020] sptd.sys

IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F9902020] sptd.sys

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [bAD49E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisDeregisterProtocol] [bAD49E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [bAD49CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [bAD49E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [bAD4A320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [bAD4A1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [bAD42670] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [bAD425C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [bAD42770] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [bAD422D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- User IAT/EAT - GMER 1.0.14 ----

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!AnimateWindow] [63601740] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

IAT C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe[688] @ C:\WINDOWS\system32\SHELL32.dll [uSER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.)

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 827A7A40

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device \Driver\dmio \Device\DmControl\DmIoDaemon 827A83C0

Device \Driver\dmio \Device\DmControl\DmConfig 827A83C0

Device \Driver\dmio \Device\DmControl\DmPnP 827A83C0

Device \Driver\dmio \Device\DmControl\DmInfo 827A83C0

Device \Driver\NetBT \Device\NetBT_Tcpip_{B1567294-86CA-4E20-931E-55DFFAAA350A} 824D2868

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device \Driver\Ftdisk \Device\HarddiskVolume1 827A85F8

Device \Driver\Ftdisk \Device\HarddiskVolume2 827A85F8

Device \FileSystem\Rdbss \Device\FsWrap 823D80E8

Device \Driver\Ftdisk \Device\HarddiskVolume3 827A85F8

Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 824C70D8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 824C70D8

Device \Driver\atapi \Device\Ide\IdePort0 824C70D8

Device \Driver\atapi \Device\Ide\IdePort1 824C70D8

Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f 824C70D8

Device \Driver\NetBT \Device\NetBt_Wins_Export 824D2868

Device \Driver\NetBT \Device\NetbiosSmb 824D2868

Device \FileSystem\Srv \Device\LanmanServer FF3C80E4

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device \Driver\NetBT \Device\NetBT_Tcpip_{9004748C-0318-4F5A-8C67-72846089CCA6} 824D2868

Device \Driver\Disk \Device\Harddisk0\DR0 827A7C78

Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 823C80E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8272B79C

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device \FileSystem\MRxSmb \Device\LanmanRedirector 823C80E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector 8272B79C

Device \FileSystem\Npfs \Device\NamedPipe 82527A20

Device \FileSystem\Npfs \Device\NamedPipe 82455574

Device \Driver\Ftdisk \Device\FtControl 827A85F8

Device \FileSystem\Msfs \Device\Mailslot 823C40E8

Device \FileSystem\Msfs \Device\Mailslot 824C811C

Device \Driver\d344prt \Device\Scsi\d344prt1 8250F8F0

Device \Driver\d344prt \Device\Scsi\d344prt1Port2Path0Target0Lun0 8250F8F0

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer 824780BC

Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer 824780BC

Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer 824780BC

Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer 824780BC

Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer 824780BC

Device \FileSystem\Cdfs \Cdfs 823EE230

Device \FileSystem\Cdfs \Cdfs 8251A9F4

---- Modules - GMER 1.0.14 ----

Module _________ F982B000-F9843000 (98304 bytes)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -838172382

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -351405635

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 364915359

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@QuigleyWiggly\t(TrueType) C:\WINDOWS\Fonts\Quigleyw.ttf

---- EOF - GMER 1.0.14 ----

Pai daca sta cu tine in casa si aveti un hub simplu nu e complicat sa iti intercepteze convorbirile. Iti trimit prin mp un link de la un sniffer de ym si sa incerci sa le interceptezi si tu pe ale lui sa vezi daca e posibil sau nu.

Nu-ti merge mesageria ca ai prea putine mesaje. Trimite-mi tu un email si iti trimit link-ul. Nu-l postez aici ca sa evit sa-l ia persoane prea curioase Uite mailul meu: [email protected]

fiordaliso a scris:

salutare tuturor,

as avea nevoie de ajutorul cuiva care pricepe mai mult decat mine, sunt convinsa de faptul ca sunt spionata, asta pentru ca mi se confirma prin lucruri pe care le-am scris sau le-am primit pe yahoo.

am facut o scanare cu hijack si iata rezultatul:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 19:26:50, on 11.04.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

.....................

in primul rand ai nevoie de un Firewall, cum ari Gozzila, Outpost etc (sunt multe).intra pe site-ul meu ............ EDIT