[b]SDFix: Version 1.237 [/b] Run by [removed] on Thu 10/23/2008 at 18:47 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Rootkit Found : C:\WINDOWS\system32\drivers\TDSSpqlt.sys - Rootkit.Win32.Agent.cku [b]Name [/b]: tdssserv [b]Path [/b]: \systemroot\system32\drivers\TDSSpqlt.sys tdssserv - Deleted Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\TDSSoiqt.dll - Deleted C:\WINDOWS\system32\TDSSarxx.dll - Deleted C:\WINDOWS\system32\TDSSvkql.dll - Deleted C:\WINDOWS\system32\TDSScfmm.dll - Deleted C:\WINDOWS\system32\TDSSlxcp.dll - Deleted C:\WINDOWS\system32\TDSSxhyf.dll - Deleted C:\DOCUME~1\JENNY\COOKIES\OSYHYFON.SCR - Deleted C:\DOCUME~1\JENNY\COOKIES\XINI.VBS - Deleted C:\Documents and Settings\Jenny\Start Menu\Programs\XP_AntiSpyware\Uninstall.lnk - Deleted C:\Documents and Settings\Jenny\Start Menu\Programs\XP_AntiSpyware\XP_AntiSpyware.lnk - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome.manifest - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\install.rdf - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome\content\main.js - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome\content\main.xul - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome\content\request.js - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome\content\web_progress.js - Deleted C:\Program Files\Mozilla Firefox\extensions\[removed]\defaults\preferences\main.js - Deleted C:\Program Files\XP_Antispyware\AVEngn.dll - Deleted C:\Program Files\XP_Antispyware\htmlayout.dll - Deleted C:\Program Files\XP_Antispyware\pthreadVC2.dll - Deleted C:\Program Files\XP_Antispyware\wscui.cpl - Deleted C:\Program Files\XP_Antispyware\XP_Antispyware.cfg - Deleted C:\Program Files\XP_Antispyware\data\daily.cvd - Deleted C:\Program Files\XP_Antispyware\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest - Deleted C:\Program Files\XP_Antispyware\Microsoft.VC80.CRT\msvcm80.dll - Deleted C:\Program Files\XP_Antispyware\Microsoft.VC80.CRT\msvcp80.dll - Deleted C:\Program Files\XP_Antispyware\Microsoft.VC80.CRT\msvcr80.dll - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries1.cab2 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries1.cab3 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries1.cab4 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries1.cab5 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries1.cab6 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries2.cab3 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries2.cab4 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries3.cab4 - Deleted C:\DOCUME~1\Jenny\LOCALS~1\Temp\Binaries3.cab5 - Deleted C:\WINDOWS\system32\wini10801.exe - Deleted C:\Documents and Settings\Jenny\Application Data\Microsoft\Internet Explorer\Quick Launch\XP_AntiSpyware.lnk - Deleted C:\Documents and Settings\Jenny\Desktop\XP_AntiSpyware.lnk - Deleted C:\WINDOWS\system32\_scui.cpl - Deleted C:\WINDOWS\system32\brastk.exe - Deleted Folder C:\Documents and Settings\Jenny\Start Menu\Programs\XP_AntiSpyware - Removed Folder C:\Program Files\Mozilla Firefox\extensions\[removed] - Removed Folder C:\Program Files\XP_Antispyware - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-23 19:08:08 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"="C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine" "C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"="C:\\TOSHIBA\\IVP\\ISM\\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\myTunes Redux\\mDNSResponder.exe"="C:\\Program Files\\myTunes Redux\\mDNSResponder.exe:*:Enabled:mDNSResponder" "C:\\Program Files\\Ruckus Player\\Ruckus.exe"="C:\\Program Files\\Ruckus Player\\Ruckus.exe:*:Enabled:Ruckus" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\WINDOWS\\system32\\drivers\\svchost.exe"="C:\\WINDOWS\\system32\\drivers\\svchost.exe:*:Disabled:svchost" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Thu 12 Apr 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 28 Jun 2007 192 A..H. --- "C:\Program Files\InterActual\InterActual Player\itiD.tmp" Mon 2 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" Sun 15 Jun 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp" Sun 15 Jun 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp" Sun 15 Jun 2008 8 A..H. --- "C:\Documents and Settings\Jenny\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Sun 15 Jun 2008 8 A..H. --- "C:\Documents and Settings\Jenny\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" [b]Finished![/b]