SDFIX Log

SDFix: Version 1.240 
Run by Administrator on Sat 11/15/2008 at 09:30 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\CHARLI~1\Desktop\SDFix\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files : 

Trojan Files Found:

C:\WINDOWS\system32\TDSSnpvw.dll - Deleted
C:\WINDOWS\system32\TDSSierd.dat - Deleted
C:\WINDOWS\system32\TDSSofxh.log - Deleted


Could Not Remove C:\WINDOWS\system32\TDSSbvan.dll
Could Not Remove C:\WINDOWS\system32\TDSSurta.dll
Could Not Remove C:\WINDOWS\system32\TDSSaewi.dll
Could Not Remove C:\WINDOWS\system32\TDSSyyvb.dll



Removing Temp Files

ADS Check :
 


                                 Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-15 21:51:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Charlie Kierscht\ntuser.dat, 0
scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Enabled:TaskPanl"
"C:\\Program Files\\KODAK\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\KODAK\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater"
"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe:*:Enabled:HP Software Update Client"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer"
"E:\\bin\\IA\\Core\\MDM_Util.exe"="E:\\bin\\IA\\Core\\MDM_Util.exe:*:Enabled:MDM_Util"
"C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Kontiki\\KService.exe"="C:\\Program Files\\Kontiki\\KService.exe:*:Enabled:Delivery Manager Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

C:\WINDOWS\system32\TDSSbvan.dll Found
C:\WINDOWS\system32\TDSSurta.dll Found
C:\WINDOWS\system32\TDSSaewi.dll Found
C:\WINDOWS\system32\TDSSyyvb.dll Found

File Backups: - C:\DOCUME~1\CHARLI~1\Desktop\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 21 Jun 2005        45,568 A.SHR --- "C:\Program Files\Replay Converter\cygz.dll"
Sat  5 Jan 2008     4,378,338 A.SH. --- "C:\Program Files\vixy.net\conv.exe"
Sat 30 Aug 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue  9 Jan 2007       165,376 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0003.tmp"
Tue 13 Apr 2004        36,352 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0004.tmp"
Wed 10 Jan 2007        36,352 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0005.tmp"
Tue 23 Nov 2004        25,600 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0027.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0417.tmp"
Tue 23 Nov 2004        24,064 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0507.tmp"
Mon 22 Nov 2004        25,600 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0814.tmp"
Wed 21 Sep 2005        36,352 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL0943.tmp"
Tue 20 Sep 2005        29,184 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1087.tmp"
Wed 21 Sep 2005        38,912 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1307.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1392.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1441.tmp"
Tue 23 Nov 2004        24,064 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1550.tmp"
Tue 23 Nov 2004        24,064 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1591.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL1643.tmp"
Mon 22 Nov 2004        25,600 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2298.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2452.tmp"
Wed 21 Sep 2005        34,816 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2628.tmp"
Mon  2 Jul 2007        38,400 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2648.tmp"
Tue 23 Nov 2004        24,064 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2655.tmp"
Mon  2 Apr 2007        81,408 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2713.tmp"
Mon 22 Nov 2004        25,088 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2777.tmp"
Thu 22 Sep 2005        41,984 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL2787.tmp"
Sat  7 Apr 2007        39,424 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL3174.tmp"
Mon 22 Nov 2004        26,624 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL3392.tmp"
Thu  7 Jul 2005        25,600 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL3546.tmp"
Mon 22 Nov 2004        27,136 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\~WRL3814.tmp"
Mon 14 Mar 2005       299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.2\Maint.exe"
Mon 28 Feb 2005        61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.2\uinstrsc.dll"
Sat 14 Apr 2007        27,144 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R1E.tmp"
Sat 14 Apr 2007        27,640 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R20.tmp"
Sat 14 Apr 2007        26,440 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R22.tmp"
Sat 14 Apr 2007        14,128 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R24.tmp"
Sat 14 Apr 2007        25,820 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R26.tmp"
Sat 14 Apr 2007        23,468 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R28.tmp"
Sat 14 Apr 2007        23,456 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R2A.tmp"
Sat 14 Apr 2007        27,440 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R2C.tmp"
Sat 14 Apr 2007        28,596 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@R2E.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S1F.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S21.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S23.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S25.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S27.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S29.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S2B.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S2D.tmp"
Sat 14 Apr 2007         1,409 ...H. --- "C:\Documents and Settings\Admin\Local Settings\Temp\Z@S2F.tmp"
Mon 13 Nov 2006       319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Fri 11 Jul 2003         1,206 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
Thu  6 Mar 2003         1,206 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg_old.reg"
Thu  6 Mar 2003        12,368 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient_old.reg"
Fri 11 Jul 2003        12,368 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"
Mon 22 Nov 2004       303,104 ...H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\Microsoft\Word\~WRL3425.tmp"
Tue  9 Aug 2005       488,176 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\156f16c4104b0a36def834ec4ce48b9c\BIT25.tmp"
Tue 14 Feb 2006             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\438592bd0a35d9254fb9860cffa394f2\BITFE.tmp"
Wed 12 Oct 2005             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\6752e343d22c025be1f290a6267a146d\BIT698.tmp"
Tue  9 Aug 2005       494,832 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\99b05056a1cd02f2ee88def3c79553bb\BIT24.tmp"
Mon  9 Nov 1998         8,704 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\etc\Notes\Brief2.1\~WRL0701.tmp"
Sun  8 Nov 1998        26,112 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\etc\Notes\Brief2.1\~WRL1882.tmp"
Sun  8 Nov 1998        25,088 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Desktop\etc\Notes\Brief2.1\~WRL2390.tmp"
Tue 27 Nov 2007        24,663 ..SHR --- "C:\Documents and Settings\Charlie Kierscht\Local Settings\Temp\Juniper Networks\setup\NeoterisSetupApp.exe"
Mon 14 Aug 2006     1,070,008 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\321ca12b9fa3a6e84c5208a19d84f4b9\download\BIT1E9.tmp"
Thu 13 Nov 2008             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch1\lock.tmp"
Thu 13 Nov 2008             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch2\lock.tmp"
Thu 13 Nov 2008             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch3\lock.tmp"
Thu 13 Nov 2008             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch4\lock.tmp"
Thu 13 Nov 2008             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch5\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\Admin\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\Admin\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp"
Sun  8 Apr 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Sun  8 Apr 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sun  8 Apr 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Sun  8 Apr 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Thu 17 May 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u5\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u8\lock.tmp"
Thu 18 Oct 2007             8 A..H. --- "C:\Documents and Settings\Charlie Kierscht\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u9\lock.tmp"
Fri 16 Mar 2007         1,004 ..SH. --- "C:\Documents and Settings\Charlie Kierscht\Local Settings\Application Data\NewSoft\PageManager\7.15.11A\Setting\PM65.BAK"

Finished!