Код:
SDFix: Version 1.240
Run by Admin on 23.05.2010 at 16:24
Microsoft Windows XP [‚ҐабЁп 5.1.2600]
Running From: D:\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
D:\Documents and Settings\Admin\Local Settings\Temp\NEW4.tmp.exe - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-23 16:27:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"\20\0044\0040\4?\4B\0045\4@\4 ?B?r?o?a?d?c?o?m? ?8?0?2?.?1?1?b?/?g? ?W?L?A?N?"=str(7):"1\0"
"!\0045\4B\0045\0042\4>\49\4 ?0\0044\0040\4?\4B\0045\4@\4 ?1?3?9?4?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ??\4;\0040\4=\48\4@\4>\0042\4I\48\4:\0040\4 ??\0040\4:\0045\4B\4>\0042\4"=str(7):"1\0002\0003\0004\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?L?2?T?P?)?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?P?P?P?o?E?)?"=str(7):"1\0"
"\37\4@\4O\4<\4>\49\4 ??\0040\4@\0040\4;\4;\0045\4;\4L\4=\4K\49\4 ??\4>\4@\4B\4"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?I?P?)?"=str(7):"1\0"
"\24\4@\0040\49\0042\0045\4@\4 ?A\0045\4@\0042\0045\4@\0040\4 ?4\4>\4A\4B\4C\4?\0040\4 ?:\4 ?;\4>\4:\0040\4;\4L\4=\4>\49\4 ?A\0045\4B\48\4 ?B?l?u?e?t?o?o?t?h?"=str(7):"1\0"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="D:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:f1,73,a8,3b,b0,57,3c,0c,ba,b7,d9,40,e1,2e,15,08,91,4f,7d,cd,ad,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"\20\0044\0040\4?\4B\0045\4@\4 ?B?r?o?a?d?c?o?m? ?8?0?2?.?1?1?b?/?g? ?W?L?A?N?"=str(7):"1\0"
"!\0045\4B\0045\0042\4>\49\4 ?0\0044\0040\4?\4B\0045\4@\4 ?1?3?9?4?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ??\4;\0040\4=\48\4@\4>\0042\4I\48\4:\0040\4 ??\0040\4:\0045\4B\4>\0042\4"=str(7):"1\0002\0003\0004\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?L?2?T?P?)?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?P?P?P?o?E?)?"=str(7):"1\0"
"\37\4@\4O\4<\4>\49\4 ??\0040\4@\0040\4;\4;\0045\4;\4L\4=\4K\49\4 ??\4>\4@\4B\4"=str(7):"1\0"
"\34\48\4=\48\4?\4>\4@\4B\4 ?W?A?N? ?(?I?P?)?"=str(7):"1\0"
"\24\4@\0040\49\0042\0045\4@\4 ?A\0045\4@\0042\0045\4@\0040\4 ?4\4>\4A\4B\4C\4?\0040\4 ?:\4 ?;\4>\4:\0040\4;\4L\4=\4>\49\4 ?A\0045\4B\48\4 ?B?l?u?e?t?o?o?t?h?"=str(7):"1\0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="D:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:f1,73,a8,3b,b0,57,3c,0c,ba,b7,d9,40,e1,2e,15,08,91,4f,7d,cd,ad,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"!\4B\0040\4=\0044\0040\4@\4B\4=\0040\4O\4 ?W?i?n?d?o?w?s?"="",,,,,,,,,,,,,""
"\37\4>\0044\0042\48\0046\4=\0040\4O\4 ?W?i?n?d?o?w?s?"=""D:\WINDOWS\Cursors\rainbow.ani,,D:\WINDOWS\Cursors\appstart.ani,D:\WINDOWS\Cursors\hourglas.ani,D:\WINDOWS\Cursors\cross.cur,,,,D:\WINDOWS\Cursors\sizens.ani,D:\WINDOWS\Cursors\sizewe.ani,D:\WINDOWS\Cursors\sizenwse.ani,D:\WINDOWS\Cursors\sizenesw.ani,,""
"\36\0041\4J\0045\4<\4=\0040\4O\4 ?1\0045\4;\0040\4O\4"=""D:\WINDOWS\Cursors\3dwarro.cur,,D:\WINDOWS\Cursors\appstar3.ani,D:\WINDOWS\Cursors\hourgla3.ani,D:\WINDOWS\Cursors\cross.cur,,,D:\WINDOWS\Cursors\3dwno.cur,D:\WINDOWS\Cursors\3dwns.cur,D:\WINDOWS\Cursors\3dwwe.cur,D:\WINDOWS\Cursors\3dwnwse.cur,D:\WINDOWS\Cursors\3dwnesw.cur,D:\WINDOWS\Cursors\3dwmove.cur,""
" \4C\4:\48\4 ?1?"=""D:\WINDOWS\Cursors\harrow.cur,,D:\WINDOWS\Cursors\handapst.ani,D:\WINDOWS\Cursors\hand.ani,D:\WINDOWS\Cursors\hcross.cur,D:\WINDOWS\Cursors\hibeam.cur,,D:\WINDOWS\Cursors\hnodrop.cur,D:\WINDOWS\Cursors\hns.cur,D:\WINDOWS\Cursors\hwe.cur,D:\WINDOWS\Cursors\hnwse.cur,D:\WINDOWS\Cursors\hnesw.cur,D:\WINDOWS\Cursors\hmove.cur,""
" \4C\4:\48\4 ?2?"=""D:\WINDOWS\Cursors\harrow.cur,,D:\WINDOWS\Cursors\handapst.ani,D:\WINDOWS\Cursors\handwait.ani,D:\WINDOWS\Cursors\hcross.cur,D:\WINDOWS\Cursors\hibeam.cur,,D:\WINDOWS\Cursors\handno.ani,D:\WINDOWS\Cursors\handns.ani,D:\WINDOWS\Cursors\handwe.ani,D:\WINDOWS\Cursors\handnwse.ani,D:\WINDOWS\Cursors\handnesw.ani,D:\WINDOWS\Cursors\hmove.cur,""
"\24\48\4=\4>\0047\0040\0042\4@\4"=""D:\WINDOWS\Cursors\3dgarro.cur,,D:\WINDOWS\Cursors\dinosaur.ani,D:\WINDOWS\Cursors\dinosau2.ani,D:\WINDOWS\Cursors\cross.cur,,,D:\WINDOWS\Cursors\banana.ani,D:\WINDOWS\Cursors\3dsns.cur,D:\WINDOWS\Cursors\3dgwe.cur,D:\WINDOWS\Cursors\3dsnwse.cur,D:\WINDOWS\Cursors\3dgnesw.cur,D:\WINDOWS\Cursors\3dsmove.cur,""
"\22\4 ?A\4B\0040\4@\4>\4<\4 ?A\4B\48\4;\0045\4"=""D:\WINDOWS\Cursors\harrow.cur,,D:\WINDOWS\Cursors\horse.ani,D:\WINDOWS\Cursors\barber.ani,D:\WINDOWS\Cursors\hcross.cur,D:\WINDOWS\Cursors\hibeam.cur,,D:\WINDOWS\Cursors\coin.ani,D:\WINDOWS\Cursors\3dgns.cur,D:\WINDOWS\Cursors\3dgwe.cur,D:\WINDOWS\Cursors\3dgnwse.cur,D:\WINDOWS\Cursors\3dgnesw.cur,D:\WINDOWS\Cursors\3dgmove.cur,""
"\24\48\4@\48\0046\0045\4@\4"=""D:\WINDOWS\Cursors\harrow.cur,,D:\WINDOWS\Cursors\drum.ani,D:\WINDOWS\Cursors\metronom.ani,D:\WINDOWS\Cursors\hcross.cur,D:\WINDOWS\Cursors\hibeam.cur,,D:\WINDOWS\Cursors\piano.ani,D:\WINDOWS\Cursors\hns.cur,D:\WINDOWS\Cursors\hwe.cur,D:\WINDOWS\Cursors\hnwse.cur,D:\WINDOWS\Cursors\hnesw.cur,D:\WINDOWS\Cursors\hmove.cur,""
"#\0042\0045\4;\48\4G\0045\4=\4=\0040\4O\4"=""D:\WINDOWS\Cursors\larrow.cur,,D:\WINDOWS\Cursors\lappstrt.cur,D:\WINDOWS\Cursors\lwait.cur,D:\WINDOWS\Cursors\lcross.cur,D:\WINDOWS\Cursors\libeam.cur,,D:\WINDOWS\Cursors\lnodrop.cur,D:\WINDOWS\Cursors\lns.cur,D:\WINDOWS\Cursors\lwe.cur,D:\WINDOWS\Cursors\lnwse.cur,D:\WINDOWS\Cursors\lnesw.cur,D:\WINDOWS\Cursors\lmove.cur,""
"\22\0040\4@\48\0040\4F\48\48\4"=""D:\WINDOWS\Cursors\fillitup.ani,,D:\WINDOWS\Cursors\raindrop.ani,D:\WINDOWS\Cursors\counter.ani,D:\WINDOWS\Cursors\cross.cur,,,D:\WINDOWS\Cursors\wagtail.ani,D:\WINDOWS\Cursors\sizens.ani,D:\WINDOWS\Cursors\sizewe.ani,D:\WINDOWS\Cursors\sizenwse.ani,D:\WINDOWS\Cursors\sizenesw.ani,""
"\36\0041\4J\0045\4<\4=\0040\4O\4 ?1\4@\4>\4=\0047\4>\0042\0040\4O\4"=""D:\WINDOWS\Cursors\3dgarro.cur,,D:\WINDOWS\Cursors\appstar2.ani,D:\WINDOWS\Cursors\hourgla2.ani,D:\WINDOWS\Cursors\cross.cur,,,D:\WINDOWS\Cursors\3dgno.cur,D:\WINDOWS\Cursors\3dgns.cur,D:\WINDOWS\Cursors\3dgwe.cur,D:\WINDOWS\Cursors\3dgnwse.cur,D:\WINDOWS\Cursors\3dgnesw.cur,D:\WINDOWS\Cursors\3dgmove.cur,""
"'\0045\4@\4=\0040\4O\4 ?"="D:\WINDOWS\cursors\arrow_r.cur,D:\WINDOWS\cursors\help_r.cur,D:\WINDOWS\cursors\wait_r.cur,D:\WINDOWS\cursors\busy_r.cur,D:\WINDOWS\cursors\cross_r.cur,D:\WINDOWS\cursors\beam_r.cur,D:\WINDOWS\cursors\pen_r.cur,D:\WINDOWS\cursors\no_r.cur,D:\WINDOWS\cursors\size4_r.cur,D:\WINDOWS\cursors\size3_r.cur,D:\WINDOWS\cursors\size2_r.cur,D:\WINDOWS\cursors\size1_r.cur,D:\WINDOWS\cursors\move_r.cur,D:\WINDOWS\cursors\up_r.cur"
"'\0045\4@\4=\0040\4O\4 ?(?:\4@\4C\4?\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_rm.cur,D:\WINDOWS\cursors\help_rm.cur,D:\WINDOWS\cursors\wait_rm.cur,D:\WINDOWS\cursors\busy_rm.cur,D:\WINDOWS\cursors\cross_rm.cur,D:\WINDOWS\cursors\beam_rm.cur,D:\WINDOWS\cursors\pen_rm.cur,D:\WINDOWS\cursors\no_rm.cur,D:\WINDOWS\cursors\size4_rm.cur,D:\WINDOWS\cursors\size3_rm.cur,D:\WINDOWS\cursors\size2_rm.cur,D:\WINDOWS\cursors\size1_rm.cur,D:\WINDOWS\cursors\move_rm.cur,D:\WINDOWS\cursors\up_rm.cur"
"'\0045\4@\4=\0040\4O\4 ?(?>\0043\4@\4>\4<\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_rl.cur,D:\WINDOWS\cursors\help_rl.cur,D:\WINDOWS\cursors\wait_rl.cur,D:\WINDOWS\cursors\busy_rl.cur,D:\WINDOWS\cursors\cross_rl.cur,D:\WINDOWS\cursors\beam_rl.cur,D:\WINDOWS\cursors\pen_rl.cur,D:\WINDOWS\cursors\no_rl.cur,D:\WINDOWS\cursors\size4_rl.cur,D:\WINDOWS\cursors\size3_rl.cur,D:\WINDOWS\cursors\size2_rl.cur,D:\WINDOWS\cursors\size1_rl.cur,D:\WINDOWS\cursors\move_rl.cur,D:\WINDOWS\cursors\up_rl.cur"
"\30\4=\0042\0045\4@\4A\4=\0040\4O\4"="D:\WINDOWS\cursors\arrow_i.cur,D:\WINDOWS\cursors\help_i.cur,D:\WINDOWS\cursors\wait_i.cur,D:\WINDOWS\cursors\busy_i.cur,D:\WINDOWS\cursors\cross_i.cur,D:\WINDOWS\cursors\beam_i.cur,D:\WINDOWS\cursors\pen_i.cur,D:\WINDOWS\cursors\no_i.cur,D:\WINDOWS\cursors\size4_i.cur,D:\WINDOWS\cursors\size3_i.cur,D:\WINDOWS\cursors\size2_i.cur,D:\WINDOWS\cursors\size1_i.cur,D:\WINDOWS\cursors\move_i.cur,D:\WINDOWS\cursors\up_i.cur"
"\30\4=\0042\0045\4@\4A\4=\0040\4O\4 ?(?:\4@\4C\4?\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_im.cur,D:\WINDOWS\cursors\help_im.cur,D:\WINDOWS\cursors\wait_im.cur,D:\WINDOWS\cursors\busy_im.cur,D:\WINDOWS\cursors\cross_im.cur,D:\WINDOWS\cursors\beam_im.cur,D:\WINDOWS\cursors\pen_im.cur,D:\WINDOWS\cursors\no_im.cur,D:\WINDOWS\cursors\size4_im.cur,D:\WINDOWS\cursors\size3_im.cur,D:\WINDOWS\cursors\size2_im.cur,D:\WINDOWS\cursors\size1_im.cur,D:\WINDOWS\cursors\move_im.cur,D:\WINDOWS\cursors\up_im.cur"
"\30\4=\0042\0045\4@\4A\4=\0040\4O\4 ?(?>\0043\4@\4>\4<\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_il.cur,D:\WINDOWS\cursors\help_il.cur,D:\WINDOWS\cursors\wait_il.cur,D:\WINDOWS\cursors\busy_il.cur,D:\WINDOWS\cursors\cross_il.cur,D:\WINDOWS\cursors\beam_il.cur,D:\WINDOWS\cursors\pen_il.cur,D:\WINDOWS\cursors\no_il.cur,D:\WINDOWS\cursors\size4_il.cur,D:\WINDOWS\cursors\size3_il.cur,D:\WINDOWS\cursors\size2_il.cur,D:\WINDOWS\cursors\size1_il.cur,D:\WINDOWS\cursors\move_il.cur,D:\WINDOWS\cursors\up_il.cur"
"!\4B\0040\4=\0044\0040\4@\4B\4=\0040\4O\4 ?(?:\4@\4C\4?\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_m.cur,D:\WINDOWS\cursors\help_m.cur,D:\WINDOWS\cursors\wait_m.cur,D:\WINDOWS\cursors\busy_m.cur,D:\WINDOWS\cursors\cross_m.cur,D:\WINDOWS\cursors\beam_m.cur,D:\WINDOWS\cursors\pen_m.cur,D:\WINDOWS\cursors\no_m.cur,D:\WINDOWS\cursors\size4_m.cur,D:\WINDOWS\cursors\size3_m.cur,D:\WINDOWS\cursors\size2_m.cur,D:\WINDOWS\cursors\size1_m.cur,D:\WINDOWS\cursors\move_m.cur,D:\WINDOWS\cursors\up_m.cur"
"!\4B\0040\4=\0044\0040\4@\4B\4=\0040\4O\4 ?(?>\0043\4@\4>\4<\4=\0040\4O\4)?"="D:\WINDOWS\cursors\arrow_l.cur,D:\WINDOWS\cursors\help_l.cur,D:\WINDOWS\cursors\wait_l.cur,D:\WINDOWS\cursors\busy_l.cur,D:\WINDOWS\cursors\cross_l.cur,D:\WINDOWS\cursors\beam_l.cur,D:\WINDOWS\cursors\pen_l.cur,D:\WINDOWS\cursors\no_l.cur,D:\WINDOWS\cursors\size4_l.cur,D:\WINDOWS\cursors\size3_l.cur,D:\WINDOWS\cursors\size2_l.cur,D:\WINDOWS\cursors\size1_l.cur,D:\WINDOWS\cursors\move_l.cur,D:\WINDOWS\cursors\up_l.cur"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups]
"\30\0043\4@\4K\4"="!B0=40@B=K5\3@K"
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"="D:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"="D:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"
Remaining Files :
File Backups: - D:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Mon 10 May 2010 4,348 A.SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 25 Nov 2009 308,592 A..H. --- "D:\Program Files\Canon\Easy-WebPrint EX\Maint.exe"
Thu 6 Mar 2008 61,440 A..H. --- "D:\Program Files\Canon\Easy-WebPrint EX\uinstrsc.dll"
Wed 10 Dec 2008 308,576 A..H. --- "D:\Program Files\Canon\MP Navigator EX 3.0\Maint.exe"
Sun 22 Mar 2009 61,440 A..H. --- "D:\Program Files\Canon\MP Navigator EX 3.0\uinstrsc.dll"
Finished!
