Here you go

Question

Now I think I finnally got this right:   SDFix: Version 1.164 Run by Administrator on Sat 03/29/2008 at 11:27 PM Microsoft Windows XP [Version 5.1.2600]Running From: C:\SDFix Checking Services : Restoring Windows Registry ValuesRestoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\LOG48.TMP - DeletedC:\LOG49.TMP - DeletedC:\WINDOWS\dsaip32b.dll  - Deleted     Removing Temp Files ADS Check :                                   Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-03-29 23:37:50Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfullyhidden processes: 0hidden services: 0hidden files: 0 Remaining Services :   Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]'%windir%\system32\sessmgr.exe'='%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019''C:\Program Files\Common Files\AOL\ACS\AOLDial.exe'='C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL''C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe'='C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL''C:\Program Files\America Online 9.0\waol.exe'='C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL''C:\Program Files\Common Files\AOL\Loader\aolload.exe'='C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader''C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE'='C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook''%windir%\Network Diagnostic\xpnetdiag.exe'='%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000''C:\Program Files\Bonjour\mDNSResponder.exe'='C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour''C:\Program Files\iTunes\iTunes.exe'='C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes''C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe'='C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe:LocalSubNet:Enabled:Pure Networks Network Magic Service' [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]'%windir%\system32\sessmgr.exe'='%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019''C:\Program Files\Common Files\AOL\ACS\AOLDial.exe'='C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL''C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe'='C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL''C:\Program Files\America Online 9.0\waol.exe'='C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL''%windir%\Network Diagnostic\xpnetdiag.exe'='%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000' Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 23 Aug 2007           952 A.SH. --- 'C:\WINDOWS\SYSTEM32\KGyGaAvL.sys'Sun 13 Nov 2005         4,348 A.SH. --- 'C:\Documents and Settings\All Users\DRM\DRMv1.bak'Mon 12 Nov 2007             0 A.SH. --- 'C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT1A.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT18.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\BIT1C.tmp'Mon 28 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BITBA.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\b69c46c5109d0f8b0dee9fab84906813\BIT1B.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\BIT1D.tmp'Wed 16 Jan 2008             0 A..H. --- 'C:\WINDOWS\SoftwareDistribution\Download\fa6c916bb150f8a929e7a4ffdfbc120f\BIT19.tmp'Thu 28 Jun 2007     3,096,576 A..H. --- 'C:\Documents and Settings\Evan\Application Data\U3	emp\Launchpad Removal.exe'Thu 23 Aug 2007             8 A..H. --- 'C:\Documents and Settings\Annie\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp'Thu 23 Aug 2007             8 A..H. --- 'C:\Documents and Settings\Annie\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp'Thu 23 Aug 2007             8 A..H. --- 'C:\Documents and Settings\Annie\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp'Thu 23 Aug 2007             8 A..H. --- 'C:\Documents and Settings\Annie\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp'Fri 13 Apr 2007             8 A..H. --- 'C:\Documents and Settings\Evan\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp'Fri 13 Apr 2007             8 A..H. --- 'C:\Documents and Settings\Evan\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp'Fri 13 Apr 2007             8 A..H. --- 'C:\Documents and Settings\Evan\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp'Fri 13 Apr 2007             8 A..H. --- 'C:\Documents and Settings\Evan\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp'Wed 22 Aug 2007             8 A..H. --- 'C:\Documents and Settings\Evan\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u5\lock.tmp' Finished!

Bugbatter · Answer

You already posted that in your other thread. Please run Hijackthis and post the log from that in your original forum thread.

Virus & Spyware

Was this post helpful?