[b]SDFix: Version 1.240 [/b] Run by [removed] on Mon 11/17/2008 at 06:38 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: lzx32 [b]Path [/b]: \??\C:\WINDOWS\system32:lzx32.sys lzx32 - Deleted Restoring Default Security Values Restoring Default Hosts File DNSChanger Trojan Found! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kdjah.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\\WINDOWS\\system32\\kdjah.exe" Restoring Default System value Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\kdjah.exe - Deleted C:\WINDOWS\SYSTEM32\NE8401~1.XML - Deleted C:\WINDOWS\SYSTEM32\NE9F80~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEB016~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEB5D5~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEBA27~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEBD51~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWLJM~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWLJM~4.XML - Deleted C:\WINDOWS\SYSTEM32\NE8401~1.XML - Deleted C:\WINDOWS\SYSTEM32\NE9F80~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEB016~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEB5D5~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEBA27~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEBD51~1.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWINC~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWINC~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWLJM~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWLJM~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWMVQ~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWMVQ~4.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWCPC~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDIY~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWDWN~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~2.XML - Deleted C:\WINDOWS\SYSTEM32\NEWGGP~3.XML - Deleted C:\WINDOWS\SYSTEM32\NEWLJM~3.XML - Deleted C:\WINDOWS\SYSTEM32\MNFJRNG.EXE - Deleted C:\WINDOWS\system32\jqcenzc\winlogon.ini - Deleted C:\Documents and Settings\All Users\Documents\ficydynynu.scr - Deleted C:\WINDOWS\navynisij._sy - Deleted C:\WINDOWS\yhyluceqot._sy - Deleted C:\WINDOWS\system32\riqaq._sy - Deleted C:\WINDOWS\system32\1$.tmp - Deleted C:\WINDOWS\system32\wini108014.exe - Deleted C:\WINDOWS\msacm32.drv - Deleted C:\WINDOWS\rasqervy.dll - Deleted C:\WINDOWS\sdfinacs.dll - Deleted C:\WINDOWS\sdfixwcs.dll - Deleted C:\WINDOWS\system32\delself.bat - Deleted C:\WINDOWS\wuasirvy.dll - Deleted C:\WINDOWS\system32\TDSSdxgp.dll - Deleted C:\WINDOWS\system32\TDSSmtpe.dat - Deleted C:\WINDOWS\system32\TDSSoiqt.log - Deleted Could Not Remove C:\WINDOWS\system32\TDSSoitu.dll Could Not Remove C:\WINDOWS\system32\TDSSarxx.dll Could Not Remove C:\WINDOWS\system32\TDSSvoqm.dll Could Not Remove C:\WINDOWS\system32\TDSSnpur.dll Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-17 06:49:56 Windows 5.1.2600 Service Pack 3 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services & system hive ... disk error: C:\WINDOWS\system32\config\system, 0 scanning hidden registry entries ... disk error: C:\WINDOWS\system32\config\software, 0 disk error: C:\Documents and Settings\Adam\ntuser.dat, 0 scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Enabled:Paltalk Messenger 8.1" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Enabled:LEXPPS.EXE" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\GLOBAL ONE CHARTS\\FXChart.exe"="C:\\Program Files\\GLOBAL ONE CHARTS\\FXChart.exe:*:Enabled:FXChart" "C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary" "C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:Morpheus" "C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Enabled:Kazaa" "C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"="C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe:*:Enabled:iMesh" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "C:\\WINDOWS\\LMI7.tmp\\lmi_rescue.exe"="C:\\WINDOWS\\LMI7.tmp\\lmi_rescue.exe:*:Enabled:LogMeIn Rescue" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\WINDOWS\\system32\\lxcycoms.exe"="C:\\WINDOWS\\system32\\lxcycoms.exe:*:Enabled:Lexmark Communications System" "C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:enable" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [b]Remaining Files [/b]: C:\WINDOWS\system32\TDSSoitu.dll Found C:\WINDOWS\system32\TDSSarxx.dll Found C:\WINDOWS\system32\TDSSvoqm.dll Found C:\WINDOWS\system32\TDSSnpur.dll Found File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Thu 30 Dec 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" [b]Finished![/b]