Тема закрыта
В общем проснулся утром, включил ноут, ушел умываться завтракать, в это время через TeamViewer 6 ко мне кто-то подключился, без запросов на подключение, просто взял и подключился(в 6 версии это возможно только если этот комп добавлен и авторизирован с моей стороны, в контактах у меня только 1 контакт, и то мой второй ноут который был выключен, читал по логам Team Viewer'a при подключении были разрешены все способы воздействия: Удаленный контроль, Передача файлов, итд. В общем как-то не по себе стало что ли.
Вот логи:
[OFFTOP]
В общем кто умеет нормально читать логи, и находить все самое нужное почитайте, мб там есть чтото интересное, мб делали чтото во время подключения или файлы какие передавали(пару файлов существенно важных есть с инфой типа паспортных данных, платежных данных, членов моей семьи, пароли от Интернет-банкинга, а это не есть хорошо.
Добавлено через 2 минуты
При подключении ко мне злоумышленник открыл блокнот написал ГЫЫЫ, ОЛОЛО и вставил данные о моих сетевых адаптерах (Wi-Fi адаптер, Tunnge\Hamachi Adapter)
Добавлено через 24 минуты
Узнал кто, подключился, так же потроллил, снес диск D, отключился, все пароли сменил на всякий.
Тема Close.
Вот логи:
[OFFTOP]
2012/04/20 11:04:19.950 3768 3740 S0 Using IPC-Port 5939 2012/04/20 11:04:19.968 3768 3740 S0 CTerminalServer::getPathToApplicationExe(): Choosing standard filename. 2012/04/20 11:04:19.968 3768 3740 S0 CTerminalServer::StartGUIProcess() Filename for GUI process is D:Program FilesTeamViewerVersion6TeamViewer.exe 2012/04/20 11:04:43.882 3768 3740 S0 CTerminalServer::StartGUIProcess() GUI process 5412 started for user gamebookadmin in session 1 2012/04/20 11:04:43.882 3768 3740 S0 CTerminalServer::StartGUIProcess() Event 5 sent to GUI. 2012/04/20 11:04:43.882 3768 3740 S0 UpdateOnlineState newOnlineValue 1 2012/04/20 11:04:43.882 3768 3740 S0 TeamViewer is going online! 2012/04/20 11:04:44.170 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:04:44.170 3768 5828 S0 KeepAliveThread started 2012/04/20 11:04:44.372 3768 5828 S0 CT.Send.CMD_PING From=491464004 To=0 L=4 2012/04/20 11:04:44.507 3768 5828 S0 CT3 CT.Receive.CMD_PINGOK From=0 To=491464004 L=4 2012/04/20 11:04:44.640 3768 5828 S0 NetWatchdog: Ping successful! 2012/04/20 11:04:44.641 3768 5828 S0 Non-Commercial use 2012/04/20 11:04:44.646 3768 5828 S0 Resource-Language:ru 2012/04/20 11:04:44.978 3768 5408 S0 StartWT.Listening P=5938 2012/04/20 11:04:45.034 3768 5828 S0 CT.Send.CMD_MASTERCOMMAND From=491464004 To=0 L=522 2012/04/20 11:04:45.180 3768 5828 S0 CT4 CT.Receive.CMD_MASTERRESPONSE From=0 To=491464004 L=107 2012/04/20 11:04:45.180 3768 5828 S0 CT4 CT.Disconnect 2012/04/20 11:04:45.180 3768 5828 S0 MC.L addonchannels=0&client=VPN&f=Login&gw=0&gwlevel=400&hideonlinestatus=0&httpout=1&ic=638900460&id=491464004&keepalive=1&language=ru&lastkeepaliveperformance=95.211.37.212:1&licensetype=10000&logging=1&mid=0x00ff51b9f59c_1ca042bf9ab9533_346281355&mids=1&midsmac1=18A905CAB270&midsmac2=0CEEE69A550F&midsmguid=9948dee73099480b98b09c4f22e08004&midsoc1=3173&midsoc2=3301&midsuuid=a515d38ddd8c11de9af419a5bf0c205a&noofactivekeepalive=0&os=Win7&port443out=0&runtime=1&supportedfeatures=189&tcpout=1&v=6.0.11052&vpnmac=000000000000 - 0#OK_10000_-_2__176.223.198.34:5938_33903_1_36000_7.115.73.161__178.77.120.7_178.77.120.6_1_491464004_1_0_0 2012/04/20 11:04:45.183 3768 5828 S0 CCT.TM_WaitAtGateway.176.223.198.34:5938 - CT5 - S3 2012/04/20 11:04:45.183 3768 5828 S0 CCT.Connect.176.223.198.34:5938 2012/04/20 11:04:45.365 3768 5828 S0 CCT.Connected 2012/04/20 11:04:45.389 3768 6032 S0 CT5 CT.Run 2012/04/20 11:04:45.390 3768 6032 S0 CT.Send.CMD_IDENTIFY From=491464004 To=0 L=32 2012/04/20 11:04:45.390 3768 6032 S0 CT.Send.CMD_REQUESTKEEPALIVE2 From=491464004 To=0 L=24 2012/04/20 11:04:45.390 3768 6032 S0 CT.Send.CMD_BUDDY From=491464004 To=0 L=63 2012/04/20 11:04:45.390 3768 6032 S0 CConnectionThread::PingRouter(): Router Ping started 2012/04/20 11:04:45.574 3768 6032 S0 CT5 CT.Receive.CMD_SESSIONID From=0 To=491464004 L=8 2012/04/20 11:04:45.575 3768 6032 S0 CT5 CT.Receive.CMD_IDENTIFY From=0 To=491464004 L=32 2012/04/20 11:04:45.576 3768 6032 S0 CT5 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=56 2012/04/20 11:04:45.576 3768 6032 S0 CT5 CConnectionThread::CmdPingRouter(): Router Pong Received with following Hops: 491464004 305220801 2012/04/20 11:04:51.876 3768 5396 S0 EnumComputers.0 2012/04/20 11:05:20.467 3768 4444 S0 CInterProcessNetwork::SetDyngateIDforSession() id=491464004 session=1 ptype=2 2012/04/20 11:05:20.535 3768 4444 S0 UpdateOnlineState newOnlineValue 1 2012/04/20 11:04:46.366 5412 5712 G1 Monitors: PnP-Monitor (Standard), .DISPLAY1, 1366x768, flags=3 2012/04/20 11:05:20.153 5412 5712 G1 Opening local TCP connection to 127.0.0.1:5939 2012/04/20 11:05:20.154 5412 5712 G1 Local TCP connection established 2012/04/20 11:05:20.557 5412 5712 G1 Received Control_InitIPC_Response processtype=1 2012/04/20 11:05:20.557 5412 5712 G1 Received Control_InitIPC_Response runningProcesses=3 2012/04/20 11:05:20.558 5412 5712 G1 Control_InitIPC_Response: all processes 3 completely initialized 2012/04/20 11:05:20.737 5412 5712 G1 MachineHooks: Initialized Shm 2012/04/20 11:05:20.737 5412 5712 G1 MachineHooks: refcount = 1 2012/04/20 11:05:21.039 5412 2604 G1 ProxySearch: found IE setting: 184.106.139.135:80 2012/04/20 11:05:29.797 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:05:31.347 5412 5712 G1 Forwarding: Forward 2012/04/20 11:05:31.464 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:05:31.611 5412 5712 G1 Get best IP Adress 2012/04/20 11:05:33.226 5412 5712 G1 Forwarding: External IP address 2.135.175.219 2012/04/20 11:05:33.230 5412 5712 G1 Forwarding: Internal IP address 192.168.1.2 2012/04/20 11:05:33.990 5412 5712 G1 Forwarding: Port forwarding set. 2012/04/20 11:05:33.990 5412 5712 G1 Forwarding established successfully for this session. 2012/04/20 11:05:34.016 3768 6032 S0 CT.Send.CMD_BUDDY_ENCRYPTED From=491464004 To=305220801 L=280 2012/04/20 11:05:34.016 3768 6032 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY_ENCRYPTED 2012/04/20 11:05:34.029 5412 5712 G1 Tray created! 2012/04/20 11:05:54.012 5412 5712 G1!! BuddyList: SignIn failed. (SignIn Timeout) 2012/04/20 11:06:08.379 3768 6032 S0! S3 NC.Read.Failed5 EC=10054 2012/04/20 11:06:08.379 3768 6032 S0! CConnectionThread::ReconnectInternal: Trying Reconnect 2012/04/20 11:06:08.380 3768 6032 S0!! CloseSocketSafely(): recv failed with error code: 10054, Errorcode=10054 2012/04/20 11:06:08.566 3768 6032 S0 CT.Send.CMD_RECONNECT_TO_SESSION From=491464004 To=305220801 L=8 2012/04/20 11:06:08.751 3768 6032 S0 CT5 CT.Receive.CMD_RECONNECT_TO_SESSION_ANSWER From=305220801 To=491464004 L=4 2012/04/20 11:06:08.752 3768 6032 S0! CConnectionThread::ReconnectInternal: Received negative Answer from Server 2 2012/04/20 11:06:08.752 3768 6032 S0!! CConnectionThread::Reconnect(): Reconnect failed fatal. Close Connection 2012/04/20 11:06:08.752 3768 6032 S0 CT5 CT.Run.LoopEnd 2012/04/20 11:06:08.752 3768 6032 S0!! Terminate called without EndSession 2012/04/20 11:06:08.753 3768 6032 S0 CT5 CT.Disconnect 2012/04/20 11:06:08.951 3768 6032 S0 CT.Disconnect.TM_WaitAtGateway finished 2012/04/20 11:06:08.951 3768 6032 S0 CT5 CT.Term.TM_WaitAtGateway: SendQueueThread stopped 2012/04/20 11:06:08.951 3768 6032 S0!! CConnectionThread::Terminate(): Session was NOT closed gracefuly. ClientID: 305220801 2012/04/20 11:06:08.951 3768 6032 S0 CT5 CT.Term.TM_WaitAtGateway: Terminated 2012/04/20 11:06:08.990 3768 5828 S0!! GWW.KeepAliveLost 2012/04/20 11:06:08.990 3768 5828 S0 CCT.TM_WaitAtGateway.176.223.198.34:5938 - CT6 - S4 2012/04/20 11:06:08.990 3768 5828 S0 CCT.Connect.176.223.198.34:5938 2012/04/20 11:06:09.178 3768 5828 S0 CCT.Connected 2012/04/20 11:06:09.179 3768 1152 S0 CT6 CT.Run 2012/04/20 11:06:09.179 3768 1152 S0 CT.Send.CMD_IDENTIFY From=491464004 To=0 L=32 2012/04/20 11:06:09.180 3768 1152 S0 CT.Send.CMD_REQUESTKEEPALIVE2 From=491464004 To=0 L=24 2012/04/20 11:06:09.180 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=0 L=63 2012/04/20 11:06:09.181 3768 1152 S0 CConnectionThread::PingRouter(): Router Ping started 2012/04/20 11:06:09.364 3768 1152 S0 CT6 CT.Receive.CMD_SESSIONID From=0 To=491464004 L=8 2012/04/20 11:06:09.366 3768 1152 S0 CT6 CT.Receive.CMD_IDENTIFY From=0 To=491464004 L=32 2012/04/20 11:06:09.367 3768 1152 S0 CT6 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=56 2012/04/20 11:06:09.367 3768 1152 S0 CT6 CConnectionThread::CmdPingRouter(): Router Pong Received with following Hops: 491464004 305220801 2012/04/20 11:06:09.388 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=305220801 L=131 2012/04/20 11:06:09.390 3768 1152 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY 2012/04/20 11:06:09.390 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=305220801 L=131 2012/04/20 11:06:09.390 3768 1152 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY 2012/04/20 11:06:09.390 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=305220801 L=131 2012/04/20 11:06:09.391 3768 1152 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY 2012/04/20 11:06:09.576 3768 1152 S0 CT6 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=771 2012/04/20 11:06:09.577 5412 6060 G1 MessageLayer: Received and saved message with ID 1 2012/04/20 11:06:09.579 3768 1152 S0 CT6 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=1051 2012/04/20 11:06:09.581 3768 1152 S0 CT6 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=1155 2012/04/20 11:06:09.581 5412 6060 G1 MessageLayer: Received and saved message with ID 4 2012/04/20 11:06:09.582 5412 6060 G1 MessageLayer: Received and saved message with ID 5 2012/04/20 11:06:42.214 3768 1152 S0 CT6 CT.Receive.CMD_REQUESTCONNECT From=305220801 To=491464004 L=48 2012/04/20 11:06:42.215 3768 1152 S0 CCT.TM_GWout.194.54.80.238 - CT7 - S5 2012/04/20 11:06:42.215 3768 1152 S0 CCT.Connect.194.54.80.238:5938 2012/04/20 11:06:42.373 3768 1152 S0 CCT.Connected 2012/04/20 11:06:42.374 3768 1152 S0 CT.Send.CMD_IDENTIFY From=491464004 To=0 L=32 2012/04/20 11:06:42.374 3768 1152 S0 CT.Send.CMD_CONNECTTOWAITINGTHREAD From=491464004 To=0 L=48 2012/04/20 11:06:42.376 3768 2492 S0 CT8 CT.Run 2012/04/20 11:06:42.376 3768 2492 S0 CT8 TM.TM_TV 2012/04/20 11:06:42.376 3768 1152 S0 Starting desktop process for ID 491464004 in session 1 2012/04/20 11:06:46.801 3768 1152 S0 CTerminalServer::getPathToApplicationExe(): Choosing filename from partner process. 2012/04/20 11:06:46.802 3768 1152 S0 Filename for desktop process is d:program filesteamviewerversion6TeamViewer_Desktop.exe 2012/04/20 11:06:46.822 3768 1152 S0 CToken::GetSystemToken() set session 1 2012/04/20 11:06:46.889 3768 1152 S0 Desktop process started, PID=5632 2012/04/20 11:06:46.889 3768 4536 S0 CT7 CT.Run 2012/04/20 11:06:46.889 3768 4536 S0 CT7 TM.TM_GWout 2012/04/20 11:06:46.890 3768 4536 S0 CT7 CT.Receive.CMD_SESSIONID From=0 To=491464004 L=8 2012/04/20 11:06:46.890 3768 4536 S0 CT7 CT.Receive.CMD_IDENTIFY From=0 To=491464004 L=32 2012/04/20 11:06:46.890 3768 4536 S0 CT7 CT.Receive.CMD_SESSIONMODE From=237946090 To=491464004 L=28 2012/04/20 11:06:46.891 3768 4536 S0 Received encrypted and signed AES 256Bit session key 2012/04/20 11:06:46.892 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=305220801 L=131 2012/04/20 11:06:46.892 3768 1152 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY 2012/04/20 11:06:47.081 3768 1152 S0 CT6 CT.Receive.CMD_BUDDY From=305220801 To=491464004 L=883 2012/04/20 11:06:47.082 5412 6060 G1 MessageLayer: Received and saved message with ID 6 2012/04/20 11:06:47.104 3768 4536 S0 CT.Send.CMD_MASTERCOMMAND_ENCRYPTED From=491464004 To=0 L=392 2012/04/20 11:06:47.122 3768 4444 S0 CInterProcessNetwork::SetDyngateIDforSession() id=491464004 session=1 ptype=2 2012/04/20 11:06:47.124 3768 4444 S0 CInterProcessNetwork::SetDyngateIDforSession() id=491464004 session=1 ptype=4 2012/04/20 11:06:47.127 5412 6060 G1 Received Control_InitIPC processtype=4 2012/04/20 11:06:47.255 3768 4536 S0 CT9 CT.Receive.CMD_MASTERRESPONSE_ENCRYPTED From=0 To=491464004 L=392 2012/04/20 11:06:47.607 3768 4536 S0 CT9 CT.Disconnect 2012/04/20 11:06:47.608 3768 4536 S0 Reading partners signature key 2012/04/20 11:06:47.618 3768 4536 S0 Session key successfully decrypted, signature check ok 2012/04/20 11:06:47.619 3768 4536 S0 CT7 GWT.UDPFlowVersionHandshake.Received 2012/04/20 11:06:47.086 5632 4296 D1 TeamViewerDesktop started, PID=5632 2012/04/20 11:06:47.114 5632 4296 D1 MachineHooks: Initialized Shm 2012/04/20 11:06:47.114 5632 4296 D1 MachineHooks: refcount = 2 2012/04/20 11:06:47.116 5632 4296 D1 Monitors: PnP-Monitor (Standard), .DISPLAY1, 1366x768, flags=3 2012/04/20 11:06:47.118 5632 4296 D1 Opening local TCP connection to 127.0.0.1:5939 2012/04/20 11:06:47.119 5632 4296 D1 Local TCP connection established 2012/04/20 11:06:47.138 5632 4296 D1 Received Control_InitIPC_Response processtype=1 2012/04/20 11:06:47.138 5632 4296 D1 Received Control_InitIPC_Response runningProcesses=7 2012/04/20 11:06:47.157 5632 4296 D1 Received Control_InitIPC_Response processtype=2 2012/04/20 11:06:47.157 5632 4296 D1 Control_InitIPC_Response: all processes 7 completely initialized 2012/04/20 11:06:47.622 5632 4296 D1 ChangeThreadDesktop(): SetThreadDesktop to winlogon successful 2012/04/20 11:06:47.703 5632 664 D1 Connection incoming, sessionID = 438864912 2012/04/20 11:06:47.705 5632 3416 D1 CLogin::run() 2012/04/20 11:06:47.709 5632 3416 D1 CLogin::NegotiateVersionServer() 2012/04/20 11:06:51.013 5632 3416 D1 CLogin::AuthenticateServer() 2012/04/20 11:06:52.090 3768 4536 S0 CT7 GWT.CmdUDPFlowControl.RequestUDP.Received 2012/04/20 11:06:52.091 3768 4536 S0 CT7 GWT.SendUDPPings 2012/04/20 11:06:52.669 3768 4536 S0 CT7 CT.Receive.CMD_UDPPING From=237946090 To=491464004 L=80 2012/04/20 11:06:52.670 3768 4536 S0 CT7 GWT.CmdUDPPing.UDPMasterReply 2.135.175.219:55326 2012/04/20 11:06:52.670 3768 4536 S0 CT7 GWT.CmdUDPPing.PingOK.PunchInit 2012/04/20 11:06:52.670 3768 4536 S0 CT7 GWT.SendUDPPunchRequest 2 2012/04/20 11:06:52.670 5632 3416 D1 CLogin::run(): ConnectionMode == 1 2012/04/20 11:06:52.672 5632 3416 D1 CServerThread::Factory(PseudoSocket) 2012/04/20 11:06:52.673 5632 3416 D1 Default keyboard layout: 04090409 2012/04/20 11:06:52.675 5632 3416 D1 Monitor driver found. Version: 2 2012/04/20 11:06:52.675 5632 3416 D1 Default keyboard layout: 04090409 2012/04/20 11:06:52.676 5632 3416 D1 WindowObserver::SessionStart: -1; type: 1 2012/04/20 11:06:52.679 5412 6060 G1 WindowObserverGUI::SessionStart: 1; type: 1 2012/04/20 11:06:52.679 5632 3524 D1 DesktopThread started 2012/04/20 11:06:52.679 5632 3416 D1 CLogin::run() leave 2012/04/20 11:06:52.680 5632 3524 D1 Number of Cores: 2 2012/04/20 11:06:52.681 5632 3864 D1 ServerThread started 2012/04/20 11:06:53.217 3768 4536 S0 CT7 GWT.SendUDPPunches 2012/04/20 11:06:53.217 3768 4536 S0 CT7 punching version 0, type 3 2012/04/20 11:06:53.227 3768 4536 S0 CT7 GWT.SendUDPPunchRequest 4 2012/04/20 11:06:53.396 5412 6060 G1 ServerThreadInfo connected to 237946090, client version is 7.0.12979, OS=13 2012/04/20 11:06:53.405 5632 3864 D1 ServerThread connected to 237946090, client version is 7.0.12979, OS=13 2012/04/20 11:06:53.411 5632 3864 D1 Caching active, partners version is 2, own version is 2 2012/04/20 11:06:53.427 5632 3524 D1 MachineHooks: Starting w32 Loader 2012/04/20 11:06:53.429 3768 4536 S0 CT7 CT.Receive.CMD_UDPPING From=237946090 To=491464004 L=80 2012/04/20 11:06:53.429 3768 4536 S0 CT7 GWT.CmdUDPPing.PunchReceived, a=2.78.154.141, p=50143 2012/04/20 11:06:53.430 3768 4536 S0 CT7 GWT.SendUDPPunches 2012/04/20 11:06:53.430 3768 4536 S0 CT7 punching version 0, type 0 2012/04/20 11:06:53.473 3768 4444 S0 CToken::GetSystemToken() set session 1 2012/04/20 11:06:53.438 5632 3864 D1 ChangeThreadDesktop(): SetThreadDesktop to Default successful 2012/04/20 11:06:53.488 5632 3864 D1 HandleDesktopChanged: Default 2012/04/20 11:06:53.489 5632 4600 D1 ChangeThreadDesktop(): SetThreadDesktop to default successful 2012/04/20 11:06:53.489 5632 4600 D1 runLLHook(): 002406FF 002206F7 2012/04/20 11:06:53.496 5632 3524 D1 InitDesktop Default Monitor=0 2012/04/20 11:06:53.499 5632 3864 D1 ConnectionAccessSettings: RemoteControl: Разрешено FileTransfer: Разрешено ControlRemoteTV: Разрешено SwitchSides: Разрешено AllowDisableRemoteInput: Разрешено AllowVPN: Разрешено AllowPartnerViewDesktop: Разрешено 2012/04/20 11:06:53.500 5632 3524 D1 using device .DISPLAY1 2012/04/20 11:06:53.501 5632 3524 D1 BPP_USED = 32, BPP_SELECTED = 8, colors = 4294967296 2012/04/20 11:06:53.501 5632 3524 D1 Display is 1368x768x32, selected bpp=8 2012/04/20 11:06:53.501 5632 3524 D1 InitDesktop successful 2012/04/20 11:06:53.535 3768 4444 S0 InterProcessNetwork: Loader process started, pid = 2816 2012/04/20 11:06:53.570 3768 4536 S0 CT7 GWT.UDPFlowPunchReceived.Received 2012/04/20 11:06:53.621 5632 3524 D1 first fullscreen grab time in ms = 124 2012/04/20 11:06:53.708 2816 4164 L32 Starting Loader 2012/04/20 11:05:20:736 5412 5712 H32 : SharedMem Connected seg = 0x4150000, refcnt = 1 2012/04/20 11:05:20:736 5412 5712 H32 teamviewer.exe: SharedMem Connected seg = 0x4150000, refcnt = 2 2012/04/20 11:06:53:724 2816 4164 H32 tv_w32.exe: Starting Update Hook 2012/04/20 11:06:53.832 5632 3864 D1 SendDisplayParams() executed. 2012/04/20 11:06:53.890 3768 4536 S0 CT7 GWT.UDPFlowMTUReceived.Received 2012/04/20 11:06:53.891 3768 4536 S0 CT7 CT.Receive.CMD_UDPPING From=237946090 To=491464004 L=80 2012/04/20 11:06:53.891 3768 4536 S0! CT7 GWT.CmdUDPPing.PunchIgnored state=4 2012/04/20 11:06:53.891 3768 4536 S0 CT7 CT.Receive.CMD_UDPPING From=237946090 To=491464004 L=448 2012/04/20 11:06:53.891 3768 4536 S0 CT7 GWT.CmdUDPPing.MTUReceived 2012/04/20 11:06:54.173 3768 4536 S0 CT7 GWT.UDPFlowMTUReceived.Received 2012/04/20 11:06:54.173 3768 4536 S0 CT7 CT.Receive.CMD_UDPPING From=237946090 To=491464004 L=1008 2012/04/20 11:06:54.173 3768 4536 S0 CT7 GWT.CmdUDPPing.MTUReceived 2012/04/20 11:06:55.905 3768 4536 S0 CT7 GWT.UDPFlowUDPPrepareSwitchToUDP.Received 2012/04/20 11:06:55.906 3768 4536 S0 CT7 GWT.SendDisconnectToUDPAndWaitForResponse 2012/04/20 11:06:55.906 3768 4536 S0 CT.Send.CMD_ENDSESSION From=491464004 To=237946090 L=4 2012/04/20 11:06:56.071 3768 4536 S0 CT7 CT.Receive.CMD_DISCONNECT From=237946090 To=491464004 L=4 2012/04/20 11:07:23.234 3768 4536 S0! CT7 UDP statistics: rp=1191 2012/04/20 11:08:28.412 3768 4536 S0! CT7 UDP statistics: rp=3 dp=4 2012/04/20 11:09:03.887 5412 6060 G1 ServerThreadInfo connected to 237946090, client version is 7.0.12979, OS=13 2012/04/20 11:09:03.986 5632 3864 D1 ServerThread connected to 237946090, client version is 7.0.12979, OS=13 2012/04/20 11:09:04.433 3768 4536 S0! CT7 UDP statistics: rp=1 2012/04/20 11:09:36.677 3768 4536 S0! CT7 UDP statistics: rp=2 dp=1 2012/04/20 11:09:44.227 5632 3272 D1 ShortRemoteInfo::run() 2012/04/20 11:09:50.568 5632 3272 D1 ShortRemoteInfo.SendStream 2012/04/20 11:10:19.239 3768 4536 S0! CT7 UDP statistics: rp=3 2012/04/20 11:10:39.962 5632 5016 D1 ShortRemoteInfo::run() 2012/04/20 11:10:45.056 5632 5016 D1 ShortRemoteInfo.SendStream 2012/04/20 11:10:51.860 3768 4536 S0! CT7 UDP statistics: rp=1 2012/04/20 11:11:00.478 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:11:01.094 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:11:19.417 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:11:20.039 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:11:21.947 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:11:22.479 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:11:22.702 3768 4536 S0 CT7 CT.Receive.CMD_DISCONNECT From=237946090 To=491464004 L=4 2012/04/20 11:11:22.702 3768 4536 S0 CT7 CT.Run.LoopEnd 2012/04/20 11:11:22.702 3768 4536 S0 CT7 CT.Disconnect 2012/04/20 11:11:22.702 3768 4536 S0 Session to 237946090 ended. Estimated bandwidth=126kBit/s, Latency=134ms 2012/04/20 11:11:22.703 3768 1152 S0 CT.Send.CMD_BUDDY From=491464004 To=305220801 L=315 2012/04/20 11:11:22.704 3768 1152 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY 2012/04/20 11:11:22.730 3768 2492 S0 CT8 CT.Run.LoopEnd 2012/04/20 11:11:22.730 3768 2492 S0 CT8 CT.Disconnect 2012/04/20 11:11:22.811 3768 4536 S0 CGatewaySession::ShowSponsoredSessionDialog(): Show SponsoredSession 2012/04/20 11:11:22.812 5632 664 D1 Received Control_TerminateProcess 2012/04/20 11:11:22.818 5632 3864 D1 ServerThread to 237946090 finished 2012/04/20 11:11:22.818 5632 3864 D1 SessionEnded: 0 2012/04/20 11:11:22.825 5632 5744 D1 DisableServerInput: 0 2012/04/20 11:11:22.826 5632 4984 D1 UpdateServerInputState: 0 2012/04/20 11:11:22.826 5632 4984 D1!! DisableServerInput not executed. Error code: 170, Errorcode=170 2012/04/20 11:11:22.896 5412 6060 G1 WindowObserverGUI::SessionEnded: 0 2012/04/20 11:11:22.995 5632 4984 D1 UpdateServerInputState: 0 2012/04/20 11:11:22.995 5632 4984 D1!! DisableServerInput not executed. Error code: 170, Errorcode=170 2012/04/20 11:11:22.996 5632 4984 D1 quit ThreadProc 2012/04/20 11:11:23.003 5632 4600 D1 runLLHook() finished 2012/04/20 11:11:23.005 5632 5744 D1 DesktopThread stopped 2012/04/20 11:11:23.007 3768 4444 S0 CInterProcessNetwork: Received DisconnectIPC from processID 5632 (ProcessType: 4 in Session 1) with reason 4 2012/04/20 11:11:23.007 3768 4444 S0 Process 5632 in session 1 has terminated 2012/04/20 11:11:23.008 5632 664 D1 CTcpProcessConnector::HandleRead(): Socket gracefully closed (PID=3768) 2012/04/20 11:11:23.008 5632 664 D1! CInterProcess::EventFunction(): IPC-Connection Closed 2012/04/20 11:11:23.009 3768 4444 S0 CTcpProcessConnector::HandleRead(): Socket gracefully closed (PID=5632) 2012/04/20 11:11:23.009 3768 4444 S0 CInterProcessNetwork::NewInterProcessDataAvailable(): ConnectionClosed session=1 ptype=4 2012/04/20 11:11:23.009 3768 4444 S0 UpdateOnlineState newOnlineValue 1 2012/04/20 11:11:23.044 5632 5744 D1 ~MachineHooks: refcount = 1 2012/04/20 11:11:28.007 2816 4164 L32 Quitting since not required since 5000s 2012/04/20 11:11:28.008 2816 4164 L32 Exit 2012/04/20 11:11:58.615 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:11:59.426 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:12:02.454 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:12:02.775 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:12:16.186 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:12:16.788 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:17:42.008 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:17:42.556 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:18:31.671 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:18:32.053 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:18:37.589 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:18:37.898 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:18:46.154 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:18:46.505 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:18:50.635 3768 5384 S0 NetWatchdog: Internet is now disconnected 2012/04/20 11:18:50.951 3768 5384 S0 NetWatchdog: Internet is now connected 2012/04/20 11:28:51.662 5412 5712 G1 Forwarding: Remove forwarding 2012/04/20 11:28:52.141 5412 5712 G1 Closing TeamViewer 2012/04/20 11:28:52.165 5412 5712 G1 ~MachineHooks: refcount = 0 2012/04/20 11:28:52.165 5412 5712 G1 MachineHooks: Stopping Loaders! 2012/04/20 11:28:52.178 3768 4444 S0 CInterProcessNetwork: Received DisconnectIPC from processID 5412 (ProcessType: 2 in Session 1) with reason 1 2012/04/20 11:28:52.179 3768 4444 S0 Terminate Session TVSession 438864912 in WindowsSession 1 isOutgoing: 0 2012/04/20 11:28:52.179 3768 4444 S0 Process 5412 in session 1 has terminated 2012/04/20 11:28:52.199 5412 6060 G1 CTcpProcessConnector::HandleRead(): Socket gracefully closed (PID=3768) 2012/04/20 11:28:52.199 5412 6060 G1! CInterProcess::EventFunction(): IPC-Connection Closed 2012/04/20 11:28:52.199 3768 4444 S0 CTcpProcessConnector::HandleRead(): Socket gracefully closed (PID=5412) 2012/04/20 11:28:52.200 3768 4444 S0 CInterProcessNetwork::NewInterProcessDataAvailable(): ConnectionClosed session=1 ptype=2 2012/04/20 11:28:52.200 3768 4444 S0 UpdateOnlineState m_ManualStop 2012/04/20 11:28:52.201 3768 4444 S0 TeamViewer is going offline! 2012/04/20 11:28:52.201 3768 4444 S0 Offline() StopListening.WT 2012/04/20 11:28:52.201 3768 4444 S0 CT.Send.CMD_ENDSESSION From=491464004 To=305220801 L=4 2012/04/20 11:28:52.202 3768 4444 S0 CConnectionThread::Terminate(): Sent EndSession with reason: 11 2012/04/20 11:28:52.385 3768 1152 S0 CT6 CT.Receive.CMD_DISCONNECT From=305220801 To=491464004 L=4 2012/04/20 11:28:52.385 3768 1152 S0 CT6 CT.Run.LoopEnd 2012/04/20 11:28:52.387 3768 4444 S0 CT6 CT.Disconnect 2012/04/20 11:28:52.388 3768 4444 S0 CT.Disconnect.TM_WaitAtGateway finished 2012/04/20 11:28:52.388 3768 4444 S0 CT6 CT.Term.TM_WaitAtGateway: SendQueueThread stopped 2012/04/20 11:28:52.388 3768 4444 S0 CT6 CT.Term.TM_WaitAtGateway: Terminated 2012/04/20 11:28:52.390 3768 5828 S0 KeepAliveThread ended 2012/04/20 11:28:52.422 3768 4444 S0 MainApp.Shutdown.GWS.Disconnect n=0 2012/04/20 11:28:52.422 3768 4444 S0 Offline() CT.Terminate 2012/04/20 11:28:52.422 3768 4444 S0 Offline() Shutdown.WT 2012/04/20 12:50:10.672 3768 4444 S0 CInterProcessNetwork::SetDyngateIDforSession() id=491464004 session=1 ptype=2 2012/04/20 12:50:10.674 3768 4444 S0 UpdateOnlineState newOnlineValue 1 2012/04/20 12:50:10.674 3768 4444 S0 TeamViewer is going online! 2012/04/20 12:50:10.687 3768 2596 S0 NetWatchdog: Internet is now connected 2012/04/20 12:50:10.688 3768 4840 S0 KeepAliveThread started 2012/04/20 12:50:10.710 3768 5572 S0 EnumComputers.0 2012/04/20 12:50:10.448 4452 5648 G1 Monitors: PnP-Monitor (Standard), .DISPLAY1, 1366x768, flags=3 2012/04/20 12:50:10.656 4452 5648 G1 Opening local TCP connection to 127.0.0.1:5939 2012/04/20 12:50:10.658 4452 5648 G1 Local TCP connection established 2012/04/20 12:50:10.705 4452 5648 G1 Received Control_InitIPC_Response processtype=1 2012/04/20 12:50:10.705 4452 5648 G1 Received Control_InitIPC_Response runningProcesses=3 2012/04/20 12:50:10.707 4452 5648 G1 Control_InitIPC_Response: all processes 3 completely initialized 2012/04/20 12:50:10.749 4452 5648 G1 ProxySearch: found IE setting: 184.106.139.135:80 2012/04/20 12:50:10.779 4452 3436 G1 MachineHooks: Initialized Shm 2012/04/20 12:50:10.779 4452 3436 G1 MachineHooks: refcount = 1 2012/04/20 12:50:10.852 3768 4840 S0 CT.Send.CMD_PING From=491464004 To=0 L=4 2012/04/20 12:50:10.932 3768 4840 S0 CT12 CT.Receive.CMD_PINGOK From=0 To=491464004 L=4 2012/04/20 12:50:11.006 3768 4840 S0 NetWatchdog: Ping successful! 2012/04/20 12:50:11.007 3768 4840 S0 Non-Commercial use 2012/04/20 12:50:11.009 3768 4840 S0 Resource-Language:ru 2012/04/20 12:50:11.195 3768 4840 S0 CT.Send.CMD_MASTERCOMMAND From=491464004 To=0 L=524 2012/04/20 12:50:11.335 3768 4840 S0 CT13 CT.Receive.CMD_MASTERRESPONSE From=0 To=491464004 L=105 2012/04/20 12:50:11.335 3768 4840 S0 CT13 CT.Disconnect 2012/04/20 12:50:11.336 3768 4840 S0 MC.L addonchannels=0&client=VPN&f=Login&gw=0&gwlevel=400&hideonlinestatus=0&httpout=1&ic=638900460&id=491464004&keepalive=1&language=ru&lastkeepaliveperformance=176.223.198.34:-1&licensetype=10000&logging=1&mid=0x00ff51b9f59c_1ca042bf9ab9533_346281355&mids=1&midsmac1=18A905CAB270&midsmac2=0CEEE69A550F&midsmguid=9948dee73099480b98b09c4f22e08004&midsoc1=3173&midsoc2=3301&midsuuid=a515d38ddd8c11de9af419a5bf0c205a&noofactivekeepalive=0&os=Win7&port443out=0&runtime=0&supportedfeatures=189&tcpout=1&v=6.0.11052&vpnmac=000000000000 - 0#OK_10000_-_2__194.54.81.46:5938_33903_1_36000_7.115.73.161__178.77.120.7_178.77.120.6_1_491464004_1_0_0 2012/04/20 12:50:11.341 3768 4840 S0 CCT.TM_WaitAtGateway.194.54.81.46:5938 - CT14 - S10 2012/04/20 12:50:11.342 3768 4840 S0 CCT.Connect.194.54.81.46:5938 2012/04/20 12:50:11.498 3768 4840 S0 CCT.Connected 2012/04/20 12:50:11.499 3768 4612 S0 CT14 CT.Run 2012/04/20 12:50:11.499 3768 4612 S0 CT.Send.CMD_IDENTIFY From=491464004 To=0 L=32 2012/04/20 12:50:11.500 3768 4612 S0 CT.Send.CMD_REQUESTKEEPALIVE2 From=491464004 To=0 L=24 2012/04/20 12:50:11.500 3768 4612 S0 CT.Send.CMD_BUDDY From=491464004 To=0 L=63 2012/04/20 12:50:11.501 3768 4612 S0 CConnectionThread::PingRouter(): Router Ping started 2012/04/20 12:50:11.651 3768 4612 S0 CT14 CT.Receive.CMD_SESSIONID From=0 To=491464004 L=8 2012/04/20 12:50:11.657 3768 4612 S0 CT14 CT.Receive.CMD_IDENTIFY From=0 To=491464004 L=32 2012/04/20 12:50:11.657 3768 4612 S0 CT14 CT.Receive.CMD_BUDDY From=361619794 To=491464004 L=56 2012/04/20 12:50:11.658 3768 4612 S0 CT14 CConnectionThread::CmdPingRouter(): Router Pong Received with following Hops: 491464004 361619794 2012/04/20 12:50:11.675 3768 3744 S0 StartWT.Listening P=5938 2012/04/20 12:50:11.878 4452 3436 G1 Forwarding: Forward 2012/04/20 12:50:11.896 4452 3436 G1 Get best IP Adress 2012/04/20 12:50:13.157 4452 3436 G1 Forwarding: External IP address 2.135.180.46 2012/04/20 12:50:13.165 4452 3436 G1 Forwarding: Internal IP address 192.168.1.2 2012/04/20 12:50:13.785 4452 3436 G1 Forwarding: Port forwarding set. 2012/04/20 12:50:13.786 4452 3436 G1 Forwarding established successfully for this session. 2012/04/20 12:50:13.842 3768 4612 S0 CT.Send.CMD_BUDDY_ENCRYPTED From=491464004 To=361619794 L=280 2012/04/20 12:50:13.843 3768 4612 S0 CConnectionThread::SendCmdsInSendQueue: Sent Command: CMD_BUDDY_ENCRYPTED 2012/04/20 12:50:14.165 3768 4612 S0 CT14 CT.Receive.CMD_BUDDY_ENCRYPTED From=361619794 To=491464004 L=708 2012/04/20 12:50:14.191 4452 3436 G1 Tray created! 2012/04/20 12:50:14.407 4452 4336 G1! CBuddyClientReceive::UpdateBuddyList() Unknown Parameter Type: 65
В общем кто умеет нормально читать логи, и находить все самое нужное почитайте, мб там есть чтото интересное, мб делали чтото во время подключения или файлы какие передавали(пару файлов существенно важных есть с инфой типа паспортных данных, платежных данных, членов моей семьи, пароли от Интернет-банкинга, а это не есть хорошо.
Добавлено через 2 минуты
При подключении ко мне злоумышленник открыл блокнот написал ГЫЫЫ, ОЛОЛО и вставил данные о моих сетевых адаптерах (Wi-Fi адаптер, Tunnge\Hamachi Adapter)
Добавлено через 24 минуты
Узнал кто, подключился, так же потроллил, снес диск D, отключился, все пароли сменил на всякий.
Тема Close.