• 20-11-2006, 03:29:32
    #1
    Merhaba arkadaşlar
    benim pc de c:\542fd410c34eb98429fb2aa440\msxml.msi bu şekilde bir dosya oluşmuş ve log tutan msxml4-KB927978-enu adli bi txt dosyasi
    txt dosyasinin iceriginin bir kismi şöyle

    Alıntı
    === Verbose logging started: 19.11.2006 02:00:57 Build type: SHIP UNICODE 3.01.4000.2435 Calling process: C:\WINDOWS\system32\msiexec.exe ===
    MSI (c) (D0:10) [02:00:57:781]: Resetting cached policy values
    MSI (c) (D0:10) [02:00:57:781]: Machine policy value 'Debug' is 0
    MSI (c) (D0:10) [02:00:57:781]: ******* RunEngine:
    ******* Product: c:\542fd410c34eb98429fb2aa440\msxml.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (c) (D0:10) [02:00:57:781]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (D0:10) [02:00:57:781]: Grabbed execution mutex.
    MSI (c) (D0:10) [02:00:57:921]: Cloaking enabled.
    MSI (c) (D0:10) [02:00:57:921]: Attempting to enable all disabled priveleges before calling Install on Server
    MSI (c) (D0:10) [02:00:57:937]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (24:34) [02:00:57:953]: Grabbed execution mutex.
    MSI (s) (24:64) [02:00:57:953]: Resetting cached policy values
    MSI (s) (24:64) [02:00:57:953]: Machine policy value 'Debug' is 0
    MSI (s) (24:64) [02:00:57:953]: ******* RunEngine:
    ******* Product: c:\542fd410c34eb98429fb2aa440\msxml.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (24:64) [02:00:58:531]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (24:64) [02:00:58:546]: File will have security applied from OpCode.
    MSI (s) (24:64) [02:00:58:609]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'c:\542fd410c34eb98429fb2aa440\msxml.msi' against software restriction policy
    MSI (s) (24:64) [02:00:58:609]: SOFTWARE RESTRICTION POLICY: c:\542fd410c34eb98429fb2aa440\msxml.msi has a digital signature
    MSI (s) (24:64) [02:00:59:031]: SOFTWARE RESTRICTION POLICY: c:\542fd410c34eb98429fb2aa440\msxml.msi is permitted to run at the 'unrestricted' authorization level.
    MSI (s) (24:64) [02:00:59:031]: End dialog not enabled
    MSI (s) (24:64) [02:00:59:031]: Original package ==> c:\542fd410c34eb98429fb2aa440\msxml.msi
    MSI (s) (24:64) [02:00:59:031]: Package we're running from ==> c:\WINDOWS\Installer\453400.msi
    MSI (s) (24:64) [02:00:59:078]: APPCOMPAT: looking for appcompat database entry with ProductCode '{37477865-A3F1-4772-AD43-AAFC6BCFF99F}'.
    MSI (s) (24:64) [02:00:59:093]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (24:64) [02:00:59:109]: MSCOREE not loaded loading copy from system32
    MSI (s) (24:64) [02:00:59:234]: Machine policy value 'TransformsSecure' is 0
    MSI (s) (24:64) [02:00:59:234]: User policy value 'TransformsAtSource' is 0
    MSI (s) (24:64) [02:00:59:234]: Machine policy value 'DisablePatch' is 0
    MSI (s) (24:64) [02:00:59:234]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (24:64) [02:00:59:234]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (24:64) [02:00:59:234]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (24:64) [02:00:59:234]: APPCOMPAT: looking for appcompat database entry with ProductCode '{37477865-A3F1-4772-AD43-AAFC6BCFF99F}'.
    MSI (s) (24:64) [02:00:59:234]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (24:64) [02:00:59:234]: Transforms are not secure.
    MSI (s) (24:64) [02:00:59:234]: Command Line: REBOOT=ReallySuppress CURRENTDIRECTORY=c:\542fd410c34eb98429fb2aa440 CLIENTUILEVEL=3 CLIENTPROCESSID=2768
    MSI (s) (24:64) [02:00:59:234]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{2B27DCD9-53FA-4885-B6CD-698623819F4C}'.
    MSI (s) (24:64) [02:00:59:234]: Product Code passed to Engine.Initialize: ''
    MSI (s) (24:64) [02:00:59:234]: Product Code from property table before transforms: '{37477865-A3F1-4772-AD43-AAFC6BCFF99F}'
    MSI (s) (24:64) [02:00:59:234]: Product Code from property table after transforms: '{37477865-A3F1-4772-AD43-AAFC6BCFF99F}'
    MSI (s) (24:64) [02:00:59:234]: Product not registered: beginning first-time install
    MSI (s) (24:64) [02:00:59:234]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (s) (24:64) [02:00:59:234]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (24:64) [02:00:59:234]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (24:64) [02:00:59:234]: Adding new sources is allowed.
    MSI (s) (24:64) [02:00:59:234]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (s) (24:64) [02:00:59:234]: Package name extracted from package path: 'msxml.msi'
    MSI (s) (24:64) [02:00:59:234]: Package to be registered: 'msxml.msi'
    MSI (s) (24:64) [02:00:59:234]: Note: 1: 2729
    MSI (s) (24:64) [02:00:59:281]: Note: 1: 2729
    MSI (s) (24:64) [02:00:59:296]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (s) (24:64) [02:00:59:296]: Machine policy value 'DisableMsi' is 0
    MSI (s) (24:64) [02:00:59:296]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (24:64) [02:00:59:296]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (24:64) [02:00:59:296]: Product installation will be elevated because user is admin and product is being installed per-machine.
    MSI (s) (24:64) [02:00:59:296]: Running product '{37477865-A3F1-4772-AD43-AAFC6BCFF99F}' with elevated privileges: Product is assigned.
    MSI (s) (24:64) [02:00:59:296]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
    MSI (s) (24:64) [02:00:59:296]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'c:\542fd410c34eb98429fb2aa440'.
    MSI (s) (24:64) [02:00:59:296]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (24:64) [02:00:59:296]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '2768'.
    MSI (s) (24:64) [02:00:59:296]: TRANSFORMS property is now:
    MSI (s) (24:64) [02:00:59:296]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (s) (24:64) [02:00:59:296]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Application Data
    MSI (s) (24:64) [02:00:59:296]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Sık Kullanılanlar
    MSI (s) (24:64) [02:00:59:296]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\NetHood
    MSI (s) (24:64) [02:00:59:312]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Belgelerim
    MSI (s) (24:64) [02:00:59:312]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\PrintHood
    MSI (s) (24:64) [02:00:59:312]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Recent
    MSI (s) (24:64) [02:00:59:312]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\SendTo
    MSI (s) (24:64) [02:00:59:328]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Templates
    MSI (s) (24:64) [02:00:59:328]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Application Data
    MSI (s) (24:64) [02:00:59:328]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Local Settings\Application Data
    MSI (s) (24:64) [02:00:59:328]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Belgelerim\Resimlerim
    MSI (s) (24:64) [02:00:59:328]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programlar\Yönetimsel Araçlar
    MSI (s) (24:64) [02:00:59:343]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programlar\Başlangıç
    MSI (s) (24:64) [02:00:59:343]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programlar
    MSI (s) (24:64) [02:00:59:343]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu
    MSI (s) (24:64) [02:00:59:343]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Desktop
    MSI (s) (24:64) [02:00:59:343]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Start Menu\Programlar\Yönetimsel Araçlar
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Start Menu\Programlar\Başlangıç
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Start Menu\Programlar
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Start Menu
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Fatih\Desktop
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Templates
    MSI (s) (24:64) [02:00:59:359]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    ve böyle gidiyor neyin nesi acaba bilgisi olan varmi
  • 20-11-2006, 03:36:17
    #2
    Google da
    http://www.google.com.tr/search?hl=t...btnG=Ara&meta= diye arama yaptim MSXML 4.0 Service Pack 2 diye birşeyler cikti sanirim bir güncelleme olayinin sonuçunda oldu bu
  • 20-11-2006, 04:53:50
    #3
    xfatihx bunlar windows xpnin güncelleme sırasında kendi oluşturduğu dosyalar. bir sorun çıkartmaz.

    kolay gelsin.
  • 20-11-2006, 10:57:49
    #4
    "e6d3036e3ff0602afa2b96d4a434a9" bu isimle bende de var ama içerisine bakınca zararlı bişey gibi görünmedi,bende dokunmadım
  • 20-11-2006, 17:17:13
    #5
    SP2 güncellemesi yapılırken veya kritik güncelleme yapılırken oto kurulum sırasında bu klasörler yaratılır ama 128 bit şifreleme yapıldıktan sonra klasör adı o şifreleme olur. Sabit bir klasör ismiyle microsoft güncelleme yapmaz. Doğal olarakda seninle başkasının bilgisayarına asla aynı klasör ismini vermez. Bu şifreleme içerisinde HDD numarası ve BIOS Numarası baz alınır.
    Bu kadar bilgiden sonra kısa ve net : İstersen silebilirsin, o sadece log tutmuş,,
  • 20-11-2006, 17:37:20
    #6
    Misafir
    keyloger yemişsin aga geçmiş olsun bütün şifrelerin gitti
  • 20-11-2006, 17:45:49
    #7
    Misafir
    windows güncelleştirmesi yaptıysan onun eseri
  • 20-11-2006, 17:48:55
    #8
    ****** adlı üyeden alıntı: mesajı görüntüle
    keyloger yemişsin aga geçmiş olsun bütün şifrelerin gitti
    dur be dostum,korkutma bizi şimdi zaten sitem hacklandi,nasıl oldugunu anlamaya çalışıyorum.bu şekilde şifrem alındı diye bide onla ugraşmaya başlarım
  • 20-11-2006, 17:51:12
    #9
    Misafir
    gerçekler acıdır bap maylesef.