SDFix: Version 1.157 Run by Emppu on la 15.03.2008 at 11:51 Microsoft Windows XP [versio 5.1.2600] Running From: C:\DOCUME~1\HEIKKI~1\TYPYT~1\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : No Trojan Files Found Folder C:\WINDOWS\system32\Sys32 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-15 11:57:47 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="G:\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,0e,2b,f1,aa,7b,3d,65,5f,39,b5,3f,04,09,c5,e6,b1,8d,01,e4,14,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5f,67,8a,12,e4,09,56,1c,33,87,4f,07,e1,85,74,7a,81,.. "khjeh"=hex:cd,4c,71,42,c5,77,d5,8c,4f,2f,41,0d,53,06,27,25,66,c8,42,ab,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:dc,fd,68,20,b1,bc,e4,55,a2,95,bb,77,58,bb,aa,29,1a,92,ac,e7,d1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="G:\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,0e,2b,f1,aa,7b,3d,65,5f,39,b5,3f,04,09,c5,e6,b1,8d,01,e4,14,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5f,67,8a,12,e4,09,56,1c,33,87,4f,07,e1,85,74,7a,81,.. "khjeh"=hex:cd,4c,71,42,c5,77,d5,8c,4f,2f,41,0d,53,06,27,25,66,c8,42,ab,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:dc,fd,68,20,b1,bc,e4,55,a2,95,bb,77,58,bb,aa,29,1a,92,ac,e7,d1,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\xb9m\xd3w\2] "AB79C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" Remaining Files : File Backups: - C:\DOCUME~1\HEIKKI~1\TYPYT~1\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 24 Jun 2004 2,932 A..H. --- "C:\WINDOWS\system32\aurl.dat.tmp" Sat 15 Mar 2003 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 15 Aug 2003 400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak" Fri 15 Aug 2003 48 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak" Finished!
