GMER 1.0.12.12244 -
http://www.gmer.net
Rootkit scan 2007-06-16 16:23:47
Windows 5.1.2600 Service Pack 1
—- System - GMER 1.0.12 —-
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess
—- Devices - GMER 1.0.12 —-
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN F330E7CB
Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP F330B3DF
Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP F330B3DF
Device \FileSystem\Cdfs \Cdfs FastIoCheckIfPossible F330E733
—- EOF - GMER 1.0.12 —-
GMER 1.0.12.12244 -
http://www.gmer.net
Autostart scan 2007-06-16 16:25:13
Windows 5.1.2600 Service Pack 1
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,
HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AVG Anti-Spyware Guard /*AVG Anti-Spyware Guard*/@ = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C-DillaSrv /*C-DillaSrv*/@ = C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
CVPND /*Cisco Systems, Inc. VPN Service*/@ = C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
DVD-RAM_Service /*DVD-RAM_Service*/@ = C:\WINDOWS\System32\DVDRAMSV.exe
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
Fix-It Task Manager /*Fix-It Task Manager*/@ = C:\PROGRA~1\VCOM\Fix-It\mxtask.exe -Service
LxrJD31s /*Lexar JD31*/@ = LxrJD31s.exe
NVSvc /*NVIDIA Driver Helper Service*/@ = %SystemRoot%\System32\nvsvc32.exe
SERVICE32 /*Windows Event Services*/@ = "C:\WINDOWS\system\services.exe" /*file not found*/
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
WANMiniportService /*WAN Miniport (ATW) Service*/@ = "C:\WINDOWS\wanmpsvc.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@nwiznwiz.exe /install = nwiz.exe /install
@CplBTQ00C:\Program Files\EzButton\CplBTQ00.EXE = C:\Program Files\EzButton\CplBTQ00.EXE
@CeEKEYC:\Program Files\TOSHIBA\E-KEY\CeEKey.exe = C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
@LtMohC:\Program Files\ltmoh\Ltmoh.exe = C:\Program Files\ltmoh\Ltmoh.exe
@CpRmtKey"C:\Program Files\Toshiba Controls\CpRmtKey.EXE" = "C:\Program Files\Toshiba Controls\CpRmtKey.EXE"
@CeEPOWERC:\Program Files\TOSHIBA\Power Management\CePMTray.exe = C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
@TPNFC:\Program Files\TOSHIBA\TouchPad\TPTray.exe = C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
@NDSTray.exeNDSTray.exe /*file not found*/ = NDSTray.exe /*file not found*/
@Pingerc:\toshiba\ivp\ism\pinger.exe /run = c:\toshiba\ivp\ism\pinger.exe /run
@Share-to-Web Namespace DaemonC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe = C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
@AdaptecDirectCD"C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
@IVPServiceMgrC:\toshiba\ivp\ism\ivpsvmgr.exe = C:\toshiba\ivp\ism\ivpsvmgr.exe
@pccguide.exe"C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" /*file not found*/ = "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" /*file not found*/
@!AVG Anti-Spyware"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
@VirusScannerProC:\PROGRA~1\VCOM\Fix-It\MemCheck.exe = C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe
@ezShieldProtector for PxC:\WINDOWS\System32\ezSP_Px.exe = C:\WINDOWS\System32\ezSP_Px.exe
@sixer566C:\WINDOWS\system32\sscc.exe = C:\WINDOWS\system32\sscc.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@staeck122C:\WINDOWS\system32\mfceee.exe /*file not found*/ = C:\WINDOWS\system32\mfceee.exe /*file not found*/
@sixer566C:\WINDOWS\system32\sscc.exe = C:\WINDOWS\system32\sscc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{57B86673-276A-48B2-BAE7-C6DBB3020EB8} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\System32\nvshell.dll = C:\WINDOWS\System32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\System32\nvshell.dll = C:\WINDOWS\System32\nvshell.dll
@{8FF43EAA-2BB1-4A53-8E18-D9221E56E593} /*CePMTab Property Sheet*/C:\WINDOWS\System32\CePMTab.dll = C:\WINDOWS\System32\CePMTab.dll
@{9ED66769-A198-41FE-8615-601691C68846} /*TouchPad Property Sheet*/C:\WINDOWS\System32\TPprop.dll = C:\WINDOWS\System32\TPprop.dll
@{955B7B84-5308-419c-8ED8-0B9CA3C56985} /*America Online*/C:\Program Files\Common Files\aolshare\shell\us\shellext.dll = C:\Program Files\Common Files\aolshare\shell\us\shellext.dll
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~4\Office\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~4\Office\OLKFSTUB.DLL
@{5E44E225-A408-11CF-B581-008029601108} /*Adaptec DirectCD Shell Extension*/C:\PROGRA~1\Adaptec\EASYCD~1\DirectCD\Shellex.dll = C:\PROGRA~1\Adaptec\EASYCD~1\DirectCD\Shellex.dll
@{AC1DB655-4F9A-4c39-8AD2-A65324A4C446} /*Autodesk Drawing Preview*/C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll = C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll
@{36A21736-36C2-4C11-8ACB-D4136F2B57BD} /*AutoCAD Digital Signatures Icon Overlay Handler*/C:\WINDOWS\System32\AcSignIcon.dll = C:\WINDOWS\System32\AcSignIcon.dll
@{48F45200-91E6-11CE-8A4F-0080C81A28D4} /*TMD Shell Extension*/C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll = C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll
@{771A9DA0-731A-11CE-993C-00AA004ADB6C} /*VBPropSheet*/C:\Program Files\Trend Micro\Internet Security 2005\VBProp.dll = C:\Program Files\Trend Micro\Internet Security 2005\VBProp.dll
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
@{D9872D13-7651-4471-9EEE-F0A00218BEBB} /*Multiscan*/(null) =
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{BDEADF00-C265-11d0-BCED-00A0C90AB50F} /*Web Folders*/ = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
Fix-It Menu@{A50302A0-8E15-11d2-887B-006008C1C087} = C:\Program Files\VCOM\Fix-It\mxctxmnu.dll
IMMenuShellExt@{F8984111-38B6-11D5-8725-0050DA2761C4} = C:\Program Files\IncrediMail\bin\IMShExt.dll
HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{48F45200-91E6-11CE-8A4F-0080C81A28D4} = C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
Fix-It Menu@{A50302A0-8E15-11d2-887B-006008C1C087} = C:\Program Files\VCOM\Fix-It\mxctxmnu.dll
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{48F45200-91E6-11CE-8A4F-0080C81A28D4} = C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll
HKLM\Software\Microsoft\Internet Explorer\Plugins\Extension\.spop@Location = C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome =
http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
@Start Pageabout:blank = about:blank
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.google.com/ =
http://www.google.com/
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm
HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\System32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\itss.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\System32\itss.dll
mso-offdap@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = C:\WINDOWS\System32\msvidctl.dll
vnd.ms.radio@CLSID = C:\WINDOWS\System32\msdxm.ocx
wia@CLSID = C:\WINDOWS\System32\wiascr.dll
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ >>>
000000000001@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000002@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000003@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000004@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000005@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000006@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000007@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000008@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000009@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000010@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000011@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000012@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000013@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000014@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000015@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000016@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000017@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000018@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000019@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000020@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000021@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
000000000022@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries0000000045@PackedCatalogItem = C:\Program Files\VCOM\Fix-It\MxAVLsp.dll
C:\Documents and Settings\All Users\Start Menu\Programs\Startup >>>
Microsoft Office.lnk = Microsoft Office.lnk
RAMASST.lnk = RAMASST.lnk
—- EOF - GMER 1.0.12 —-
ComboFix 07-06-13.3 - C:\Documents and Settings\holiday\Desktop\ComboFix.exe
"holiday" - 2007-06-16 16:31:32 - Service Pack 1 NTFS
Command switches used :: C:\Documents and Settings\holiday\Desktop\ComboFix-Do.txt
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\SpyWiper
C:\Program Files\SpyWiper\SCAN RESULT.spk
C:\Program Files\SpyWiper\SpyKiller log1-8-06104753.txt
C:\Program Files\SpyWiper\SpyKiller log11-2-06155810.txt
C:\Program Files\SpyWiper\SpyKiller log11-7-068131.txt
C:\Program Files\SpyWiper\SpyKiller log13-3-06145331.txt
C:\Program Files\SpyWiper\SpyKiller log14-1-06113710.txt
C:\Program Files\SpyWiper\SpyKiller log15-4-0694932.txt
C:\Program Files\SpyWiper\SpyKiller log17-12-058429.txt
C:\Program Files\SpyWiper\SpyKiller log17-2-06143515.txt
C:\Program Files\SpyWiper\SpyKiller log17-3-0710243.txt
C:\Program Files\SpyWiper\SpyKiller log18-3-0710255.txt
C:\Program Files\SpyWiper\SpyKiller log18-3-07102644.txt
C:\Program Files\SpyWiper\SpyKiller log18-3-07103736.txt
C:\Program Files\SpyWiper\SpyKiller log18-3-07104119.txt
C:\Program Files\SpyWiper\SpyKiller log20-2-068307.txt
C:\Program Files\SpyWiper\SpyKiller log20-8-06192553.txt
C:\Program Files\SpyWiper\SpyKiller log20-8-06192720.txt
C:\Program Files\SpyWiper\SpyKiller log20-8-0619419.txt
C:\Program Files\SpyWiper\SpyKiller log21-9-06222113.txt
C:\Program Files\SpyWiper\SpyKiller log22-1-0692441.txt
C:\Program Files\SpyWiper\SpyKiller log22-1-0695443.txt
C:\Program Files\SpyWiper\SpyKiller log22-12-057144.txt
C:\Program Files\SpyWiper\SpyKiller log22-8-0618154.txt
C:\Program Files\SpyWiper\SpyKiller log25-9-05113835.txt
C:\Program Files\SpyWiper\SpyKiller log25-9-0512176.txt
C:\Program Files\SpyWiper\SpyKiller log27-9-0519128.txt
C:\Program Files\SpyWiper\SpyKiller log28-9-05213810.txt
C:\Program Files\SpyWiper\SpyKiller log29-1-0610243.txt
C:\Program Files\SpyWiper\SpyKiller log3-9-0682220.txt
C:\Program Files\SpyWiper\SpyKiller log30-10-0565714.txt
C:\Program Files\SpyWiper\SpyKiller log31-12-058137.txt
C:\Program Files\SpyWiper\SpyKiller log5-1-0611557.txt
C:\Program Files\SpyWiper\SpyKiller log5-3-0693954.txt
C:\Program Files\SpyWiper\SpyKiller log6-3-0665810.txt
C:\Program Files\SpyWiper\SpyKiller log6-3-0675433.txt
C:\Program Files\SpyWiper\SpyKiller log7-1-06142713.txt
C:\Program Files\SpyWiper\SpyKiller log8-1-0493045.txt
C:\Program Files\SpyWiper\SpyKiller log8-1-06145328.txt
C:\Program Files\SpyWiper\SpyKiller log8-3-0685717.txt
C:\WINDOWS\system32\sscc.exe
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
——-\LEGACY_SERVICE32
——-\SERVICE32
((((((((((((((((((((((((( Files Created from 2007-05-16 to 2007-06-16 )))))))))))))))))))))))))))))))
2007-06-16 15:58 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-06-16 15:58 d——– C:\WINDOWS\system32\ZoneLabs
2007-06-16 15:56 d——– C:\WINDOWS\Internet Logs
2007-06-16 07:25 d——– C:\DOCUME~1\holiday\APPLIC~1\Avanquest
2007-06-16 06:50 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-14 13:26 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-13 19:22 1,156 –a—— C:\WINDOWS\mozver.dat
2007-06-13 15:48 13,952 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-06-13 11:41 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-12 10:30 4,104 –a—— C:\WINDOWS\system32\tmp.reg
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2018-01-24 05:47:38 1,025 –sha-w C:\WINDOWS\system32\l34501.sys
2007-06-16 02:50:57 ——– d—–w C:\Program Files\Kazaa
2007-06-16 02:30:36 ——– d—–w C:\Program Files\Hemera Products
2007-06-16 01:42:18 ——– d—–w C:\Program Files\America Online 8.0
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2003-06-24 20:32 C:\WINDOWS\system32\nwiz.exe]
"CplBTQ00"="C:\Program Files\EzButton\CplBTQ00.EXE" [2003-06-27 20:33]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-06-09 21:07]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-01-22 16:54]
"CpRmtKey"="C:\Program Files\Toshiba Controls\CpRmtKey.EXE" [2003-05-29 15:54]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-08-05 21:07]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-06-11 19:46]
"NDSTray.exe"="NDSTray.exe" []
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 15:21]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 07:19]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-01-23 15:09]
"IVPServiceMgr"="C:\toshiba\ivp\ism\ivpsvmgr.exe" [2002-10-17 15:15]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-16 09:00]
"VirusScannerPro"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2006-09-07 19:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
Contents of the 'Scheduled Tasks' folder
2006-02-20 18:00:00 C:\WINDOWS\tasks\Liquid Audio Auto Update Agent.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-06-16 16:34:27
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-16 16:35:41 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-16 16:35
C:\ComboFix2.txt … 2007-06-16 06:52
— E O F —