SDFix: Version 1.176
Run by ťukasz on 2008-04-28 at 21:16
Microsoft Windows XP [Wersja 5.1.2600]
Running From: H:\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-04-28 21:20:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:13144ce4
"s2"=dword:9062faef
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:19,34,8f,a1,b6,32,fa,e7,a1,56,d1,ca,77,ad,09,37,a1,98,d1,97,29,..
"p0"="H:\Program Files\DAEMON Tools Lite\"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,16,47,5e,2d,3e,1a,37,40,4a,a7,62,72,06,7a,16,9b,d8,..
"khjeh"=hex:80,1f,04,a4,df,46,7d,b5,f7,a6,09,04,42,a3,82,31,2f,56,a5,5b,ce,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b8,cc,44,b6,8f,9f,07,7d,99,c3,e8,d3,84,c1,f0,f8,ba,b3,bc,eb,52,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="I:\gry\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:19,34,8f,a1,b6,32,fa,e7,a1,56,d1,ca,77,ad,09,37,a1,98,d1,97,29,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,60,f1,38,4b,a1,5e,e4,4a,48,3b,03,6b,b4,90,12,de,f6,..
"khjeh"=hex:6d,2a,25,30,6e,96,19,16,bb,d3,3b,1a,17,af,a3,1d,52,eb,14,74,9e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:d8,a8,08,e9,23,52,3c,c7,6f,45,9e,30,6a,8d,c4,ee,06,3a,c9,e2,bb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:19,34,8f,a1,b6,32,fa,e7,a1,56,d1,ca,77,ad,09,37,a1,98,d1,97,29,..
"p0"="H:\Program Files\DAEMON Tools Lite\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,16,47,5e,2d,3e,1a,37,40,4a,a7,62,72,06,7a,16,9b,d8,..
"khjeh"=hex:80,1f,04,a4,df,46,7d,b5,f7,a6,09,04,42,a3,82,31,2f,56,a5,5b,ce,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b8,cc,44,b6,8f,9f,07,7d,99,c3,e8,d3,84,c1,f0,f8,ba,b3,bc,eb,52,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\\WINDOWS\\system32\\PnkBstrA.exe"="H:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"H:\\WINDOWS\\system32\\PnkBstrB.exe"="H:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"I:\\Nowy folder\\iw3mp.exe"="I:\\Nowy folder\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"H:\\Program Files\\Gadu-Gadu\\gg.exe"="H:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny"
"I:\\QUAKE 3\\QuakeIIIArena 1.32 + OSP\\quake3.exe"="I:\\QUAKE 3\\QuakeIIIArena 1.32 + OSP\\quake3.exe:*:Enabled:quake3"
"I:\\QUAKE 3\\BitComet\\BitComet.exe"="I:\\QUAKE 3\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"I:\\programy\\BearShare.exe"="I:\\programy\\BearShare.exe:*:Enabled:BearShare"
"I:\\wow\\World of Warcraft\\BackgroundDownloader.exe"="I:\\wow\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"H:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"="H:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"
"H:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="H:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Disabled:Kaspersky Anti-Virus"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
Remaining Files :
File Backups: - H:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Tue 4 Mar 2008 0 A..H. --- H:\WINDOWS\SOFTWA~1\DOWNLOAD\F7DB87~1\BIT4.TMP
Finished!