SDFix: Version 1.240 Run by user on Thu 12/18/2008 at 10:28 PMMicrosoft Windows XP [Version 5.1.2600]Running From: C:\SDFix
Checking Services :Restoring Default Security ValuesRestoring Default Hosts FileRebooting
Checking Files : Trojan Files Found:C:\DOCUME~1\user\LOCALS~1\Temp\tmp1.tmp - DeletedRemoving Temp Files
ADS Check :
Final Check :catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
scan 2008-12-18 22:33:42Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ...scanning hidden services & system hive ...[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]"E\6-\6H\6D\6 ?N?e?t? ?1?3?9?4?"=str(7):"1\0""'\6*\0065\6'\6D\6 ?*\6D\6A\0062\6J\6H\6F\6/?A\6J\6/\6J\6H\6 ?M?i?c?r?o?s?o?f?t?"=str(7):"1\0""E\6-\6H\6D\6 ?R?A?S? ?A?s?y?n?c?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ? ?(?L?2?T?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?P?O?E?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?I?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6,\6/\6H\6D\6)\6 ?'\6D\6-\0062\6E\6"=str(7):"1\0002\0003\0004\0"[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]"E\6-\6H\6D\6 ?N?e?t? ?1?3?9?4?"=str(7):"1\0""'\6*\0065\6'\6D\6 ?*\6D\6A\0062\6J\6H\6F\6/?A\6J\6/\6J\6H\6 ?M?i?c?r?o?s?o?f?t?"=str(7):"1\0""E\6-\6H\6D\6 ?R?A?S? ?A?s?y?n?c?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ? ?(?L?2?T?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?P?O?E?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?I?P?)?"=str(7):"1\0""E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6,\6/\6H\6D\6)\6 ?'\6D\6-\0062\6E\6"=str(7):"1\0002\0003\0004\0"scanning hidden registry entries ...[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]"4\69\6'\0061\6'\6*\6 ?W?i?n?d?o?w?s? ?'\6D\6E\6*\6-\0061\6C\6)\6"=""C:\WINDOWS\Cursors\rainbow.ani,,C:\WINDOWS\Cursors\appstart.ani,C:\WINDOWS\Cursors\hourglas.ani,C:\WINDOWS\Cursors\cross.cur,,,,C:\WINDOWS\Cursors\sizens.ani,C:\WINDOWS\Cursors\sizewe.ani,C:\WINDOWS\Cursors\sizenwse.ani,C:\WINDOWS\Cursors\sizenesw.ani,,"""#\6(\6J\0066\6 ?+\6D\6'\6+\6J\6 ?'\6D\6#\6(\69\6'\6/\6"=""C:\WINDOWS\Cursors\3dwarro.cur,,C:\WINDOWS\Cursors\appstar3.ani,C:\WINDOWS\Cursors\hourgla3.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\3dwno.cur,C:\WINDOWS\Cursors\3dwns.cur,C:\WINDOWS\Cursors\3dwwe.cur,C:\WINDOWS\Cursors\3dwnwse.cur,C:\WINDOWS\Cursors\3dwnesw.cur,C:\WINDOWS\Cursors\3dwmove.cur,"""#\6J\6/\6J\6 ?1?"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\handapst.ani,C:\WINDOWS\Cursors\hand.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\hnodrop.cur,C:\WINDOWS\Cursors\hns.cur,C:\WINDOWS\Cursors\hwe.cur,C:\WINDOWS\Cursors\hnwse.cur,C:\WINDOWS\Cursors\hnesw.cur,C:\WINDOWS\Cursors\hmove.cur,"""#\6J\6/\6J\6 ?2?"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\handapst.ani,C:\WINDOWS\Cursors\handwait.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\handno.ani,C:\WINDOWS\Cursors\handns.ani,C:\WINDOWS\Cursors\handwe.ani,C:\WINDOWS\Cursors\handnwse.ani,C:\WINDOWS\Cursors\handnesw.ani,C:\WINDOWS\Cursors\hmove.cur,"""/\6J\6F\0065\6H\0061\6"=""C:\WINDOWS\Cursors\3dgarro.cur,,C:\WINDOWS\Cursors\dinosaur.ani,C:\WINDOWS\Cursors\dinosau2.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\banana.ani,C:\WINDOWS\Cursors\3dsns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dsnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dsmove.cur,"""7\0061\6'\0062\6 ?B\6/\6J\6E\6"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\horse.ani,C:\WINDOWS\Cursors\barber.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\coin.ani,C:\WINDOWS\Cursors\3dgns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dgnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dgmove.cur,"""E\6H\0065\6D\6"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\drum.ani,C:\WINDOWS\Cursors\metronom.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\piano.ani,C:\WINDOWS\Cursors\hns.cur,C:\WINDOWS\Cursors\hwe.cur,C:\WINDOWS\Cursors\hnwse.cur,C:\WINDOWS\Cursors\hnesw.cur,C:\WINDOWS\Cursors\hmove.cur,"""E\6C\6(\0061\6"=""C:\WINDOWS\Cursors\larrow.cur,,C:\WINDOWS\Cursors\lappstrt.cur,C:\WINDOWS\Cursors\lwait.cur,C:\WINDOWS\Cursors\lcross.cur,C:\WINDOWS\Cursors\libeam.cur,,C:\WINDOWS\Cursors\lnodrop.cur,C:\WINDOWS\Cursors\lns.cur,C:\WINDOWS\Cursors\lwe.cur,C:\WINDOWS\Cursors\lnwse.cur,C:\WINDOWS\Cursors\lnesw.cur,C:\WINDOWS\Cursors\lmove.cur,"""*\6A\6'\6H\6*\6'\6*\6"=""C:\WINDOWS\Cursors\fillitup.ani,,C:\WINDOWS\Cursors\raindrop.ani,C:\WINDOWS\Cursors\counter.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\wagtail.ani,C:\WINDOWS\Cursors\sizens.ani,C:\WINDOWS\Cursors\sizewe.ani,C:\WINDOWS\Cursors\sizenwse.ani,C:\WINDOWS\Cursors\sizenesw.ani,"""(\0061\6H\6F\0062\6 ?+\6D\6'\6+\6J\6 ?'\6D\6#\6(\69\6'\6/\6"=""C:\WINDOWS\Cursors\3dgarro.cur,,C:\WINDOWS\Cursors\appstar2.ani,C:\WINDOWS\Cursors\hourgla2.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\3dgno.cur,C:\WINDOWS\Cursors\3dgns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dgnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dgmove.cur,""[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups]"*\0063\6'\6D\6J\6"="'D(1'E, 'DED-B)\*3'DJ"scanning hidden files ...scan completed successfullyhidden processes: 0hidden services: 0hidden files: 0
Remaining Services :Authorized Application Key Export:[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019""C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype""C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger""%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000""C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Enabled

altalkScene""C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger""C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled

xpsp2res.dll,-22019""%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000""C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger""C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :Mon 8 Dec 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Finished!