[Closed] Virus seems fixed by SDfix

SDFix: Version 1.240
Run by [removed] on Fri 24/07/2009 at 22:14

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
FCI
ICF

Path :
C:\WINDOWS\system32\fci.exe.exe:ext.exe
C:\WINDOWS\system32\icf.exe.exe:exe.exe

FCI - Deleted
ICF - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-24 22:23:26
Windows 5.1.2600 Service Pack 2 FAT NTAPI

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 24 Jul 2009 494,832 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\d46f6be166354510ddea6ce350a55528\BIT9.tmp"

Finished!

Hello wlhksar,
Welcome to What the Tech.
My name is OCD, I will be helping you today.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please do not run any additional tools unless instructed to do so.

In order to be able to help you I need for you to run the following program and provide me with the log generated so I can evaluate your computer.

Download HijackThis from http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe .

• Choose the default location of C:\Program Files\Trend Micro\HijackThis as the destination. HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!
• Click the Install button.
• Accept the license agreement .
• The progam will place a shortcut on your desktop. This will make it easier for you to access the tool when required.
• Click Do a system scan and save a log file. A Notepad file will open.
• To post the text, first you must highlight the entire text and then press the (Ctrl+C) keys which copies it to your clipboard.
• Now paste the log into this thread using the (Ctrl + V) buttons.

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

- - - - - Next - - - - -

On your next post please provide the following:

• HijackThis log

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log