Temp Save OTS Log

Discussion in 'Malware EDU' started by chaslang, Apr 7, 2011.

  1. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Code:
    [Registry - Safe List]
    < HOSTS File > ([2011/03/27 00:14:41 | 000,000,905 | ---- | M] - 24 lines) -> C:\Windows\SysNative\Drivers\etc\hosts -> 
    Reset Hosts
    127.0.0.1 activate.adobe.com 
    192.168.1.153 developerservices.windowsphone.com
    
    < RunOnce [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> 
    "*catcabedit.exe" -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\catcabedit.exe ["C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\catcabedit.exe"] -> [2011/04/06 09:38:08 | 000,147,456 | ---- | M] ()
    TCP Query User{127F7C9A-E533-41EF-BE32-099922FD1A5E}C:\chevronwp7.exe -> profile=private | protocol=6 | dir=in | action=allow | name=chevronwp7 | app=c:\chevronwp7.exe | 
    TCP Query User{35DB25D3-C1D7-43C6-9A51-5AA83C443ACB}C:\windows\keygen.exe -> profile=private | protocol=6 | dir=in | action=allow | name=keygen | app=c:\windows\keygen.exe | 
    UDP Query User{668F4457-2796-43C6-B956-8515DEE12230}C:\windows\keygen.exe -> profile=private | protocol=17 | dir=in | action=allow | name=keygen | app=c:\windows\keygen.exe | 
    UDP Query User{6B0F3C66-42EA-4036-9AFE-4713B1CD909D}C:\chevronwp7.exe -> profile=private | protocol=17 | dir=in | action=allow | name=chevronwp7 | app=c:\chevronwp7.exe | 
     
    [Files/Folders - Created Within 30 Days]
     {D4B1C59B-3DFB-44AB-97B1-31C2CF7F2C6A} -> C:\Users\Ben\AppData\Local\{D4B1C59B-3DFB-44AB-97B1-31C2CF7F2C6A} -> [2011/04/06 21:56:05 | 000,000,000 | ---D | C]
    
     {C766EE86-DE90-49EF-8C1C-D1F06CD4E615} -> C:\Users\Ben\AppData\Local\{C766EE86-DE90-49EF-8C1C-D1F06CD4E615} -> [2011/03/30 07:13:34 | 000,000,000 | ---D | C]
     {E45B1D3E-BC46-46CA-AC1B-16932832F73E} -> C:\ProgramData\{E45B1D3E-BC46-46CA-AC1B-16932832F73E} -> [2011/03/29 22:43:22 | 000,000,000 | -H-D | C]
     {27FC6CF0-C831-4DFD-98FF-9B6C297C467E} -> C:\Users\Ben\AppData\Local\{27FC6CF0-C831-4DFD-98FF-9B6C297C467E} -> [2011/03/29 10:53:57 | 000,000,000 | ---D | C]
     Microsoft Games for Windows Marketplace -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace -> [2011/03/28 03:04:49 | 000,000,000 | ---D | C]
     {65DE282F-644C-4A35-A293-4AD9BEB9979F} -> C:\Users\Ben\AppData\Local\{65DE282F-644C-4A35-A293-4AD9BEB9979F} -> [2011/03/27 23:07:16 | 000,000,000 | ---D | C]
     {312413CC-C4B7-4D0A-A234-C18CECB96185} -> C:\Users\Ben\AppData\Local\{312413CC-C4B7-4D0A-A234-C18CECB96185} -> [2011/03/27 00:09:12 | 000,000,000 | ---D | C]
     871ed6ff383b4e5425973fb56d71ea1d -> C:\871ed6ff383b4e5425973fb56d71ea1d -> [2011/03/26 10:02:23 | 000,000,000 | ---D | C]
     {E1476F64-092A-4FCA-9E22-DBCB35F202DB} -> C:\Users\Ben\AppData\Local\{E1476F64-092A-4FCA-9E22-DBCB35F202DB} -> [2011/03/26 09:19:25 | 000,000,000 | ---D | C]
     {072D1831-FEB5-4450-A1B2-999798356F69} -> C:\Users\Ben\AppData\Local\{072D1831-FEB5-4450-A1B2-999798356F69} -> [2011/03/24 11:22:45 | 000,000,000 | ---D | C]
     {8AFCB84A-069A-4444-B779-DA334008760F} -> C:\Users\Ben\AppData\Local\{8AFCB84A-069A-4444-B779-DA334008760F} -> [2011/03/23 14:59:20 | 000,000,000 | ---D | C]
     {2E4B8277-7E9D-425E-909D-3F3C258C77A1} -> C:\Users\Ben\AppData\Local\{2E4B8277-7E9D-425E-909D-3F3C258C77A1} -> [2011/03/21 15:09:20 | 000,000,000 | ---D | C]
     {1832BB3F-8597-4376-B505-B85DE322A902} -> C:\Users\Ben\AppData\Local\{1832BB3F-8597-4376-B505-B85DE322A902} -> [2011/03/19 22:32:51 | 000,000,000 | ---D | C]
     {43723186-0175-4D40-8C91-A9831D2863E9} -> C:\Users\Ben\AppData\Local\{43723186-0175-4D40-8C91-A9831D2863E9} -> [2011/03/18 10:14:47 | 000,000,000 | ---D | C]
     {7A9B71D5-D82B-4845-825C-C3EC4D87C1E5} -> C:\Users\Ben\AppData\Local\{7A9B71D5-D82B-4845-825C-C3EC4D87C1E5} -> [2011/03/17 20:31:15 | 000,000,000 | ---D | C]
    
     catcabedit.exe -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\catcabedit.exe -> [2011/04/06 09:38:08 | 000,147,456 | ---- | M] ()
     test.xml -> C:\test.xml -> [2011/04/06 00:03:37 | 000,084,445 | ---- | M] ()
     yf0ztdxw.exe -> C:\Users\Ben\Desktop\yf0ztdxw.exe -> [2011/04/04 22:09:03 | 000,301,568 | ---- | M] ()
    
     1 C:\Users\Ben\AppData\Local\Temp\*.tmp files -> C:\Users\Ben\AppData\Local\Temp\*.tmp -> 
     
    [Files - No Company Name]
     catcabedit.exe -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\catcabedit.exe -> [2011/04/06 09:38:08 | 000,147,456 | ---- | C] ()
     igcompkrng500.bin -> C:\Windows\SysWow64\igcompkrng500.bin -> [2009/08/18 18:46:33 | 000,439,300 | ---- | C] ()
     msjetoledb40.dll -> C:\Windows\SysWow64\msjetoledb40.dll -> [2009/07/13 16:03:59 | 000,364,544 | ---- | C] ()
    
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds