Hello, I ran SDFix as directed and here's the report:
SDFix: Version 1.240 Run by Administrator on Tue 05/26/2009 at 11:04 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Checking Services :
Name :
TDSSserv.sys
Path :
\systemroot\system32\drivers\TDSSrfdc.sys
TDSSserv.sys - Deleted
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\WINDOWS\system32\drivers\TDSSrfdc.sys - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-05-26 23:11:28
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:5a,df,82,b4,a5,21,63,8a,c6,d3,5d,dd,37,df,16,8e,7d,06,5a,a9,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,0e,4c,16,d6,3c,45,6f,f9,54,2a,67,37,ac,30,9d,3f,..
"khjeh"=hex:e1,7f,d1,09,3d,03,7f,1e,4c,c6,a8,e7,95,30,72,9e,37,ec,43,97,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,60,96,2c,75,4e,11,ae,38,1e,41,84,e1,86,59,1d,36,2f,78,e9,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:b9,5e,38,bf,1a,39,3c,90,43,c4,af,5b,6a,20,64,ff,f0,96,c2,ea,99,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:5a,df,82,b4,a5,21,63,8a,c6,d3,5d,dd,37,df,16,8e,7d,06,5a,a9,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,0e,4c,16,d6,3c,45,6f,f9,54,2a,67,37,ac,30,9d,3f,..
"khjeh"=hex:e1,7f,d1,09,3d,03,7f,1e,4c,c6,a8,e7,95,30,72,9e,37,ec,43,97,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,60,96,2c,75,4e,11,ae,38,1e,41,84,e1,86,59,1d,36,2f,78,e9,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:b9,5e,38,bf,1a,39,3c,90,43,c4,af,5b,6a,20,64,ff,f0,96,c2,ea,99,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:5a,df,82,b4,a5,21,63,8a,c6,d3,5d,dd,37,df,16,8e,7d,06,5a,a9,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,0e,4c,16,d6,3c,45,6f,f9,54,2a,67,37,ac,30,9d,3f,..
"khjeh"=hex:e1,7f,d1,09,3d,03,7f,1e,4c,c6,a8,e7,95,30,72,9e,37,ec,43,97,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,60,96,2c,75,4e,11,ae,38,1e,41,84,e1,86,59,1d,36,2f,78,e9,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:b9,5e,38,bf,1a,39,3c,90,43,c4,af,5b,6a,20,64,ff,f0,96,c2,ea,99,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000002
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000023
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{C67FB98D-BAC5-4BAE-8922-3800AB4E92F0}\Properties]
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV\EncryptedDirectories]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:acc8b642
"s1"=dword:006aa215
"s2"=dword:98f4b4df
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:5a,df,82,b4,a5,21,63,8a,c6,d3,5d,dd,37,df,16,8e,7d,06,5a,a9,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,0e,4c,16,d6,3c,45,6f,f9,54,2a,67,37,ac,30,9d,3f,..
"khjeh"=hex:e1,7f,d1,09,3d,03,7f,1e,4c,c6,a8,e7,95,30,72,9e,37,ec,43,97,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,60,96,2c,75,4e,11,ae,38,1e,41,84,e1,86,59,1d,36,2f,78,e9,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:b9,5e,38,bf,1a,39,3c,90,43,c4,af,5b,6a,20,64,ff,f0,96,c2,ea,99,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000002
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000023
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Control\Class\{C67FB98D-BAC5-4BAE-8922-3800AB4E92F0}\Properties]
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Services\MRxDAV\EncryptedDirectories]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:5a,df,82,b4,a5,21,63,8a,c6,d3,5d,dd,37,df,16,8e,7d,06,5a,a9,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,0e,4c,16,d6,3c,45,6f,f9,54,2a,67,37,ac,30,9d,3f,..
"khjeh"=hex:e1,7f,d1,09,3d,03,7f,1e,4c,c6,a8,e7,95,30,72,9e,37,ec,43,97,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,60,96,2c,75,4e,11,ae,38,1e,41,84,e1,86,59,1d,36,2f,78,e9,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:b9,5e,38,bf,1a,39,3c,90,43,c4,af,5b,6a,20,64,ff,f0,96,c2,ea,99,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Michael Pijoan\\Local Settings\\Temp\\Blizzard Launcher Temporary - 16078aa8\\Launcher.exe"="C:\\Documents and Settings\\Michael Pijoan\\Local Settings\\Temp\\Blizzard Launcher Temporary - 16078aa8\\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\\Documents and Settings\\Michael Pijoan\\Local Settings\\Temp\\Blizzard Launcher Temporary - 338e0fc0\\Launcher.exe"="C:\\Documents and Settings\\Michael Pijoan\\Local Settings\\Temp\\Blizzard Launcher Temporary - 338e0fc0\\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"="C:\\Program Files\\World of Warcraft Public Test\\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\\Program Files\\World of Warcraft Public Test\\WoW-0.1.0.9637-to-0.1.0.9658-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft Public Test\\WoW-0.1.0.9637-to-0.1.0.9658-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\Launcher.exe"="C:\\Program Files\\World of Warcraft\\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Wed 28 Jun 2006 4,900,464 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Tue 20 Mar 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 24 May 2009 0 A..H. --- "C:\Documents and Settings\Michael Pijoan\Local Settings\Temp\g.exe"
Tue 27 Jan 2009 1,424,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8c6322a455d51e8a1346db4713089043\BITE.tmp"
Tue 27 Jan 2009 8,981,856 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9de5dbc7caed13f6a2349c5fdc61cdb6\BITC.tmp"
Tue 27 Jan 2009 7,256,928 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a2850ba2c561d0bfb4e8c8fd3f9bf263\BITD.tmp"
Tue 27 Jan 2009 242,743,296 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d346b7396358ac7bd3dcc0e62b35367d\BITB.tmp"
Finished!