--------[ AIDA32 (c) 1995-2003 Tamas Miklos ]--------------------
 
Version                  AIDA32 v3.80
Auteur                   tamas.miklos@aida32.hu
Site web                 http://www.aida32.hu
Type de rapport          Rapport rapide
Ordinateur               NETSERVER
Générateur               Fred
Système d'exploitation   Microsoft Windows 2000 Professional 5.0.2195 (Win2000 Retail)
Date                     2003-10-12
Heure                    11:31
 
 
--------[ Processus ]--------------------------------------------
 
aida32.bin C:\Program Files\AIDA32 - Enterprise System Information\aida32.bin 10744 Ko 12300 Ko
Ati2evxx.exe C:\WINNT\System32\Ati2evxx.exe 1220 Ko 268 Ko
ATIPTAXX.EXE C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE 3280 Ko 1500 Ko
ccApp.exe C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe 8880 Ko 5464 Ko
ccEvtMgr.exe C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe 3992 Ko 4152 Ko
dbserv.exe C:\Program Files\Symantec\Ghost\bin\dbserv.exe 1264 Ko 316 Ko
Explorer.EXE C:\WINNT\Explorer.EXE 2644 Ko 9136 Ko
htpatch.exe C:\WINNT\htpatch.exe 1188 Ko 280 Ko
lsass.exe C:\WINNT\system32\lsass.exe 1072 Ko 2464 Ko
mdm.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 3380 Ko 888 Ko
MSTask.exe C:\WINNT\system32\MSTask.exe 4556 Ko 1396 Ko
navapsvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe 5200 Ko 5580 Ko
ngserver.exe C:\Program Files\Symantec\Ghost\ngserver.exe 5804 Ko2416 Ko
regsvc.exe C:\WINNT\system32\regsvc.exe 1008 Ko 272 Ko
rteng7.exe C:\Program Files\Symantec\Ghost\bin\rteng7.exe 4736 Ko 5136 Ko
services.exe C:\WINNT\system32\services.ex 6216 Ko 2772 Ko
smss.exe C:\WINNT\System32\smss.exe 344 Ko 1072 Ko
spoolsv.exe C:\WINNT\system32\spoolsv.exe 4416 Ko 2544 Ko
stisvc.exe C:\WINNT\system32\stisvc.exe 1624 Ko 480 Ko
svchost.exe C:\WINNT\system32\svchost.exe 6372 Ko 4624 Ko
svchost.exe C:\WINNT\system32\svchost.exe 3736 Ko 1364 Ko
svchost.exe C:\WINNT\System32\svchost.exe 9060 Ko 5104 Ko
winlogon.exe C:\WINNT\system32\winlogon.exe 1468 Ko 5548 Ko
WinMgmt.exe C:\WINNT\System32\WBEM\WinMgmt.exe 1164 Ko 884 Ko
 

7. How is Ghost Keylogger uninstalled?
----------------------------------------
Locate the folder where Ghost Keylogger is installed. The default is under
C:\Program Files\Sync Manager\. In this folder, double click the file
syncconfig.exe to start the configuration application. Under the "System"
tab you will find the "Uninstall" button. Click on the button and follow the
instructions.
 
12. Somebody installed Ghost Keylogger on my computer without my knowledge,
how do I uninstall it?
----------------------------------------------------------------------------
Installing Ghost Keylogger on somebody else's computer could be illegal.
Check with your local authorities.
 
Before you can uninstall the keylogger, you have to find it on your
computer. One of the following procedures will find it.
 
Removing an installed keylogger
See question 7. If you can't uninstall it this way, Ghost Keylogger has
probably been deployed on your computer. To remove a deployed keylogger see
the instructions below.
 
Removing a deployed keylogger
A deployed keylogger is much harder to find (see manual for details) and you
will have to trace it through the registry.
 
1. Press "Start" button->Run
2. Type "regedit" and press enter
3. Windows 95/98/ME: Navigate to the following key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
3. Windows NT/2000/XP: Navigate to the following key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
4. You can find a Name called "Synchronization Agent" this will point to a
.exe file. This is the Ghost Keylogger file.
5. Write down the full path of the .exe file pointed out by the
"Synchronization Agent" key.
 
Now you know where Ghost Keylogger is installed, the next step is to
uninstall it. You can do this in two different ways.
 
This first way requires that you restart the computer.
1. Delete the key in the registry. (Select it and press the delete key).
2. Reboot the computer.
3. Use explorer to find the Ghost Keylogger file pointed by the registry
entry.
4. A deployed keylogger comes in three files. An .exe file, a .dll file, and
a .cfg file. All files are named as the .exe file pointed out in the
registry. E.g. if the file pointed out by the registry was named hidden.exe,
there will exist two files called hidden.dll and hidden.cfg as well. Remove
these three files. You have now uninstalled Ghost Keylogger from your
system.
 
The second way requires that you have a little knowledge of the command
prompt.
1. Press the "Start" button->Run
2. Windows 95/98/ME: type "command" and press enter.
2. Windows NT/2000/XP: type "cmd" and press enter.
3. Go to the directory pointed out from the registry.
4. The file pointed out in the registry was an .exe file. Type the name of
the exe file followed by the parameters -uninstall -reportwithmessagebox.
E.g. if the filename is "hidden.exe", type
"hidden -uninstall -reportwithmessagebox" and press enter. A message box
should report success.
5. A deployed keylogger comes in three files. An .exe file, a .dll file, and
a .cfg file. All files are named as the .exe file pointed out in the
registry. E.g. if the file pointed out by the registry was named hidden.exe,
there will exist two files called hidden.dll and hidden.cfg as well. Remove
these three files. You have now uninstalled Ghost Keylogger from your
system.
 
 
Best regards,
 
Jon / Sureshot Software
www.keylogger.net
www.sureshotsoftware.com