HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (256. sayfa)

ComboFix 08-09-28.01 - Administrator 2008-09-30  0:34:37.1 - NTFSx86 
  Microsoft Windows XP Professional  5.1.2600.2.1254.1.1055.18.680 [GMT 3:00] 
  Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe 
   * Created a new restore point 
   * Resident AV is active 
   
   
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] 
  . 
   
  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
   
  C:\Documents and Settings\Administrator\Cookies\administrator@adsrv.adgroupm[1].txt 
  C:\Documents and Settings\Administrator\Cookies\administrator@ehg-dig.hitbox[2].txt 
  C:\Documents and Settings\Administrator\Cookies\administrator@msn.arabam.milliyet.com[2].txt 
  C:\Documents and Settings\Administrator\Cookies\administrator@t.spike[2].txt 
  C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML 
  C:\Documents and Settings\Administrator\Sık Kullanılanlar\Online Security Test.url 
  C:\WINDOWS\system32\fgi.dll 
  C:\WINDOWS\system32\pha.dll 
   
  . 
  (((((((((((((((((((((((((   Files Created from 2008-08-28 to 2008-09-29  ))))))))))))))))))))))))))))))) 
  . 
   
  2008-09-28 17:11 . 2008-09-29 17:33	<DIR>	d--------	C:\Program Files\TS2009 
  2008-09-24 20:03 . 2008-09-24 20:03	1,169	--a------	C:\WINDOWS\mozver.dat 
  2008-09-24 19:56 . 2008-09-27 17:44	39,878	--a------	C:\WINDOWS\system32\c.ico 
  2008-09-24 19:56 . 2008-09-27 17:44	13,942	--a------	C:\WINDOWS\system32\m.ico 
  2008-09-23 18:21 . 2008-09-23 18:21	<DIR>	d--------	C:\Program Files\Philips 
  2008-09-23 18:21 . 2008-09-25 17:24	<DIR>	d--------	C:\iSiteLogs 
  2008-09-13 22:00 . 2008-09-13 22:47	<DIR>	d--------	C:\WINDOWS\system32\CatRoot_bak 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2008-09-21 18:05	---------	d-----w	C:\Program Files\Play65 
  2008-09-13 20:10	---------	d-----w	C:\Documents and Settings\Administrator\Application Data\BSplayer Pro 
  2008-07-18 19:10	94,920	----a-w	C:\WINDOWS\system32\cdm.dll 
  2008-07-18 19:10	53,448	----a-w	C:\WINDOWS\system32\wuauclt.exe 
  2008-07-18 19:10	45,768	----a-w	C:\WINDOWS\system32\wups2.dll 
  2008-07-18 19:10	36,552	----a-w	C:\WINDOWS\system32\wups.dll 
  2008-07-18 19:09	563,912	----a-w	C:\WINDOWS\system32\wuapi.dll 
  2008-07-18 19:09	325,832	----a-w	C:\WINDOWS\system32\wucltui.dll 
  2008-07-18 19:09	205,000	----a-w	C:\WINDOWS\system32\wuweb.dll 
  2008-07-18 19:09	1,811,656	----a-w	C:\WINDOWS\system32\wuaueng.dll 
  2008-07-07 20:17	253,952	----a-w	C:\WINDOWS\system32\es.dll 
  . 
   
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] 
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] 
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-07 68856] 
  "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 1694208] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-12-11 7311360] 
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-05-08 30208] 
  "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-05-08 49152] 
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496] 
  "GhostStartTrayApp"="C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" [2003-12-17 94208] 
  "snp2std"="C:\WINDOWS\vsnp2std.exe" [2005-11-23 344064] 
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-12-11 86016] 
  "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-08-15 921600] 
  "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328] 
  "nwiz"="nwiz.exe" [2006-12-11 C:\WINDOWS\system32\nwiz.exe] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] 
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] 
  "nlpo_01"="md %USERPROFILE%\Local Settings\Temp" [X] 
  "nlpo_02"="advpack.dll" [2008-06-23 C:\WINDOWS\system32\advpack.dll] 
  "nlpo_03"="advpack.dll" [2008-06-23 C:\WINDOWS\system32\advpack.dll] 
   
  C:\Documents and Settings\All Users\Start Menu\Programlar\BaŸlang‡\ 
  Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] 
  Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] 
  Server4PC.lnk - C:\Program Files\TechniSat DVB\bin\Server4PC.exe [2007-08-15 344064] 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "%windir%\\system32\\sessmgr.exe"= 
  "C:\\Program Files\\ProgDVB\\ProgDVB.exe"= 
  "C:\\Program Files\\ProgDVB PIP\\ProgDVB.exe"= 
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= 
  "C:\\Program Files\\MSN Messenger\\livecall.exe"= 
  "C:\\Program Files\\LimeWire\\LimeWire.exe"= 
  "C:\\Program Files\\Age Of Empires\\EMPIRESX.EXE"= 
   
  R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2003-12-17 5632] 
  R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2005-12-05 10218880] 
  S3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS [2006-03-14 349184] 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] 
  \Shell\AutoRun\command - E:\autorun.exe 
   
  *Newly Created Service* - PROCEXP90 
  *Newly Created Service* - RICHVIDEO 
  . 
  . 
  ------- Supplementary Scan ------- 
  . 
  FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\e4y8z77n.default\ 
  FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= 
  . 
   
  ************************************************************************** 
   
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2008-09-30 00:36:29 
  Windows 5.1.2600 Service Pack 2 NTFS 
   
  scanning hidden processes ...  
   
  scanning hidden autostart entries ... 
   
  scanning hidden files ...  
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
  . 
  --------------------- DLLs Loaded Under Running Processes --------------------- 
   
  PROCESS: C:\WINDOWS\system32\lsass.exe 
  -> C:\Program Files\Eset\pr_imon.dll 
  . 
  Completion time: 2008-09-30  0:37:13 
  ComboFix-quarantined-files.txt  2008-09-29 21:37:11 
   
  Pre-Run: 29.179.932.672 bayt boş 
  Post-Run: 30,518,194,176 bayt boş 
   
  114	--- E O F ---	2008-09-27 14:43:55 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 11:11:06, on 30.09.2008 
  Platform: Windows XP SP2 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe 
  C:\PROGRA~1\SYMANT~1\VPTray.exe 
  C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe 
  C:\Program Files\DAEMON Tools\daemon.exe 
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
  C:\WINDOWS\VM_STI.EXE 
  C:\Program Files\CyberLat\CyberLat RAM Cleaner 2,0\CLRamCleaner.exe 
  C:\WINDOWS\SPCMon\wsys.exe 
  C:\Program Files\Symantec AntiVirus\DefWatch.exe 
  C:\WINDOWS\system32\PnkBstrA.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\MSN Messenger\MsnMsgr.Exe 
  C:\Program Files\Symantec AntiVirus\Rtvscan.exe 
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Xfire\xfire.exe 
  C:\WINDOWS\system32\MsPMSPSv.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\MSN Messenger\usnsvc.exe 
  C:\WINDOWS\system32\wuauclt.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Documents and Settings\enes\Local Settings\Application Data\Google\Update\GoogleUpdate.exe 
  C:\Program Files\Jetico\BCArchive\BCArchive.exe 
  C:\Documents and Settings\enes\Desktop\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
  O1 - Hosts: 208.65.153.243 youtube.com 
  O1 - Hosts: 208.65.153.253 youtube.com 
  O1 - Hosts: 208.65.153.243 www.youtube.com 
  O1 - Hosts: 208.65.153.253 www.youtube.com 
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx 
  O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll 
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll 
  O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll 
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
  O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb124\Dealio.dll 
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" 
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" 
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r 
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE 
  O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k 
  O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera 
  O4 - HKLM\..\Run: [CyberLat Ram Cleaner] C:\Program Files\CyberLat\CyberLat RAM Cleaner 2,0\CLRamCleaner.exe 
  O4 - HKLM\..\Run: [wsys.exe] C:\WINDOWS\SPCMon\wsys.exe 
  O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe 
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
  O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MyWebSearch\bar\2.bin\M3PLUGIN.DLL,UPF 
  O4 - HKLM\..\Run: [C:\WINDOWS\system32\kduxg.exe] C:\WINDOWS\system32\kduxg.exe 
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MyWebSearch\bar\2.bin\MWSBAR.DLL,S 
  O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Axis Defy.exe 
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 
  O4 - HKCU\..\Run: [vc plan] C:\DOCUME~1\enes\APPLIC~1\stupid soap locks\Meta Aim Cdrom.exe 
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe 
  O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm 
  O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm 
  O8 - Extra context menu item: &Search - ?p=ZUfox000 
  O8 - Extra context menu item: &ʹÓÿ쳵(FlashGet)ÏÂÔØ - C:\Program Files\FlashGet Network\Flashget\ComDlls\Bholink.htm 
  O8 - Extra context menu item: &ʹÓÿ쳵(FlashGet)ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\FlashGet Network\Flashget\ComDlls\Bhoall.htm 
  O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\enes\Application Data\Dealio\kb124\res\DealioSearch.html 
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll 
  O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll 
  O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll 
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab 
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe 
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe 
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
  O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing) 
  O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe 
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
  O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MyWebSearch\bar\2.bin\mwssvc.exe (file missing) 
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe 
  O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe 
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe 
  O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe 
   
  -- 
  End of file - 9844 bytes 
  

 
  catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 
 http://www.gmer.net 
   
  scanning hidden processes ... 
   
  scanning hidden services ... 
   
  scanning hidden autostart entries ... 
   
  scanning hidden files ... 
   
  scan completed successfully 
  hidden processes: 0 
  hidden services: 0 
  hidden files: 0 
  

 
   
  [b]SDFix: Version 1.230 [/b] 
  Run by fightclub on 30.09.2008 at 23:49 
   
  Microsoft Windows XP [Srm 5.1.2600] 
  Running From: C:\SDFix 
   
  [b]Checking Services [/b]: 
   
   
  Restoring Default Security Values 
  Restoring Default Hosts File 
   
  Rebooting 
   
   
  [b]Checking Files [/b]:  
   
  No Trojan Files Found 
   
   
   
   
   
   
  Removing Temp Files 
   
  [b]ADS Check [/b]: 
    
   
   
                                   [b]Final Check [/b]: 
   
  catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2008-09-30 23:52:22 
  Windows 5.1.2600 Service Pack 3 NTFS 
   
  scanning hidden processes ... 
   
  scanning hidden services & system hive ... 
   
  scanning hidden registry entries ... 
   
  scanning hidden files ... 
   
  scan completed successfully 
  hidden processes: 0 
  hidden services: 0 
  hidden files: 0 
   
   
  [b]Remaining Services [/b]: 
   
   
   
   
  Authorized Application Key Export: 
   
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] 
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" 
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" 
  "D:\\StubInstaller.exe"="D:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" 
  "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" 
  "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent" 
  "C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary" 
  "C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget" 
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" 
  "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" 
   
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] 
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" 
  "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" 
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" 
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" 
  "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" 
   
  [b]Remaining Files [/b]: 
   
   
   
  [b]Files with Hidden Attributes [/b]: 
   
  Mon 14 Apr 2008     1,695,232 A.SH. --- "C:\Program Files\Messenger\msmsgs.exe" 
  Mon 14 Apr 2008        59,904 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" 
  Fri  2 May 2008     3,493,888 A..H. --- "C:\Documents and Settings\fightclub\Application Data\U3\temp\Launchpad Removal.exe" 
   
  [b]Finished![/b]