SDFix: Version 1.138

Run by Windows XP on qui 07/02/2008 at 15:12

Microsoft Windows XP [versÆo 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

Trojan Files Found:

C:\Documents and Settings\Windows XP\Menu Iniciar\Programas\Inicializar\MSWin--1110980871.exe - Deleted
C:\WINDOWS\svhoster.exe  - Deleted





Removing Temp Files...

ADS Check:
 


                                 Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 15:26:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"="C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"="C:\\Arquivos de programas\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"="C:\\Arquivos de programas\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Arquivos de programas\\eMule\\eMule.exe"="C:\\Arquivos de programas\\eMule\\eMule.exe:*:Enabled:eMule Plus"
"C:\\Arquivos de programas\\MessengerDiscovery\\MessengerDiscovery Live.exe"="C:\\Arquivos de programas\\MessengerDiscovery\\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\\Arquivos de programas\\DAP\\DAP.exe"="C:\\Arquivos de programas\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)"
"C:\\Arquivos de programas\\uTorrent\\uTorrent.exe"="C:\\Arquivos de programas\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Arquivos de programas\\Warcraft III\\Warcraft III.exe"="C:\\Arquivos de programas\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"="C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"="C:\\Arquivos de programas\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed  5 May 1999        95,698 ..SH. --- "C:\COMMAND.COM"
Wed  6 Feb 2008        45,568 ..SHR --- "C:\WINDOWS\system32\1028j.exe"
Wed  6 Feb 2008        44,544 ..SHR --- "C:\WINDOWS\system32\iasz.exe"
Wed  4 Aug 2004     1,667,584 ..SH. --- "C:\Arquivos de programas\Messenger\msmsgs.exe"
Mon 25 Jun 2007        61,440 A..H. --- "C:\System Volume Information\_restore{5C4EC790-C414-44DC-BBD2-921B48496A6B}\RP96\A0076190.dll"
Mon 25 Jun 2007        61,440 A..H. --- "C:\System Volume Information\_restore{5C4EC790-C414-44DC-BBD2-921B48496A6B}\RP96\A0076191.DLL"
Sun 19 Mar 2006       262,144 A.SH. --- "C:\System Volume Information\_restore{5C4EC790-C414-44DC-BBD2-921B48496A6B}\RP96\A0076192.exe"

Finished!