LittleUzi
ComboFix 07-12-07.3 - Osman 2007-12-08 15:03:03.9 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1221 [GMT -5:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))
.
2007-12-08 00:36 . 2007-12-08 03:56 d——– C:\Program Files\Kali95
2007-12-08 00:10 . 2007-12-08 00:36 d——– C:\Users\Osman\AppData\Roaming\Hamachi
2007-12-08 00:09 . 2007-12-08 00:10 d——– C:\Program Files\Hamachi
2007-12-08 00:09 . 2007-12-08 00:09 25,280 –a—— C:\Windows\System32\drivers\hamachi.sys
2007-12-07 23:27 . 2007-12-07 23:34 139,264 –a—— C:\Windows\War3Unin.exe
2007-12-07 23:27 . 2007-12-07 23:47 76,626 –a—— C:\Windows\War3Unin.dat
2007-12-07 23:27 . 2007-12-07 23:34 2,829 –a—— C:\Windows\War3Unin.pif
2007-12-07 23:03 . 2007-12-08 03:56 d——– C:\Program Files\Warcraft III
2007-12-03 20:33 . 2007-12-03 20:33 823,296 –a—— C:\Windows\System32\divx_xx0c.dll
2007-12-03 20:33 . 2007-12-03 20:33 823,296 –a—— C:\Windows\System32\divx_xx07.dll
2007-12-03 20:33 . 2007-12-03 20:33 802,816 –a—— C:\Windows\System32\divx_xx11.dll
2007-12-03 20:33 . 2007-12-03 20:33 682,496 –a—— C:\Windows\System32\DivX.dll
2007-12-03 20:33 . 2007-12-03 20:33 630,784 –a—— C:\Windows\System32\divxdec.ax
2007-12-03 01:42 . 2007-12-05 22:24 d——– C:\Incomplete
2007-11-29 17:55 . 2007-11-29 17:55 d——– C:\sec30
2007-11-29 17:30 . 2007-11-29 17:30 3,596,288 –a—— C:\Windows\System32\qt-dx331.dll
2007-11-29 17:30 . 2007-11-29 17:30 1,044,480 –a—— C:\Windows\System32\libdivx.dll
2007-11-29 17:30 . 2007-11-29 17:30 524,288 –a—— C:\Windows\System32\DivXsm.exe
2007-11-29 17:30 . 2007-11-29 17:30 200,704 –a—— C:\Windows\System32\ssldivx.dll
2007-11-29 17:30 . 2007-11-29 17:30 4,816 –a—— C:\Windows\System32\divxsm.tlb
2007-11-29 17:28 . 2007-11-29 17:28 196,608 –a—— C:\Windows\System32\dtu100.dll
2007-11-29 17:28 . 2007-11-29 17:28 81,920 –a—— C:\Windows\System32\dpl100.dll
2007-11-29 17:28 . 2007-11-29 17:28 416 –a—— C:\Windows\System32\dtu100.dll.manifest
2007-11-29 17:28 . 2007-11-29 17:28 416 –a—— C:\Windows\System32\dpl100.dll.manifest
2007-11-28 16:55 . 2007-11-28 16:55 156,992 –a—— C:\Windows\System32\DivXCodecVersionChecker.exe
2007-11-28 16:53 . 2007-11-28 16:53 593,920 –a—— C:\Windows\System32\dpuGUI11.dll
2007-11-28 16:53 . 2007-11-28 16:53 344,064 –a—— C:\Windows\System32\dpus11.dll
2007-11-28 16:53 . 2007-11-28 16:53 294,912 –a—— C:\Windows\System32\dpu11.dll
2007-11-28 16:53 . 2007-11-28 16:53 294,912 –a—— C:\Windows\System32\dpu10.dll
2007-11-28 16:53 . 2007-11-28 16:53 57,344 –a—— C:\Windows\System32\dpv11.dll
2007-11-28 16:53 . 2007-11-28 16:53 53,248 –a—— C:\Windows\System32\dpuGUI10.dll
2007-11-28 16:52 . 2007-11-28 16:52 12,288 –a—— C:\Windows\System32\DivXWMPExtType.dll
2007-11-25 04:08 . 2007-11-25 04:08 d——– C:\Users\Osman\AppData\Roaming\PC Tools
2007-11-25 04:08 . 2007-11-28 10:56 d——– C:\Program Files\Spyware Doctor
2007-11-25 04:08 . 2005-09-23 08:29 626,688 –a—— C:\Windows\System32\msvcr80.dll
2007-11-25 04:08 . 2007-10-18 00:16 79,688 –a—— C:\Windows\System32\drivers\iksyssec.sys
2007-11-25 04:08 . 2007-10-18 00:15 62,280 –a—— C:\Windows\System32\drivers\iksysflt.sys
2007-11-25 04:08 . 2007-10-18 00:14 41,288 –a—— C:\Windows\System32\drivers\ikfilesec.sys
2007-11-25 04:08 . 2007-10-18 00:16 29,000 –a—— C:\Windows\System32\drivers\kcom.sys
2007-11-25 04:01 . 2007-11-25 04:01 d——– C:\Program Files\SigmaTel
2007-11-25 03:45 . 2007-11-25 03:45 d——– C:\Users\Osman\AppData\Roaming\SystemRequirementsLab
2007-11-25 03:45 . 2007-11-25 03:45 d——– C:\Program Files\SystemRequirementsLab
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Users\All Users\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\ProgramData\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Program Files\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-22 02:37 . 2007-11-22 02:37 97 –a—— C:\Windows\wininit.ini
2007-11-20 23:38 . 2007-11-20 23:38 d——– C:\Users\All Users\Prevx
2007-11-20 23:38 . 2007-11-20 23:38 d——– C:\ProgramData\Prevx
2007-11-20 23:37 . 2007-12-08 00:06 d——– C:\Temp
2007-11-20 12:59 . 2007-10-01 16:24 20,280 –a—— C:\Windows\System32\drivers\SSFS0BB9.sys
2007-11-19 01:21 . 2007-11-19 01:33 d——– C:\Program Files\Starcraft
2007-11-19 01:21 . 2007-11-19 01:22 70,656 –a—— C:\Windows\ScUnin.exe
2007-11-19 01:21 . 2007-11-19 01:22 34,474 –a—— C:\Windows\scunin.dat
2007-11-19 01:21 . 2007-11-19 01:22 967 –a—— C:\Windows\ScUnin.pif
2007-11-18 14:01 . 2007-12-05 22:21 54,156 –ah—– C:\Windows\QTFont.qfn
2007-11-18 14:01 . 2007-11-18 14:01 1,409 –a—— C:\Windows\QTFont.for
2007-11-17 16:15 . 2007-11-17 16:15 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2007-11-16 19:08 . 2007-11-16 19:08 d——– C:\Windows\System32\updater
2007-11-16 19:08 . 2007-11-16 19:08 10 –a—— C:\boot.inf
2007-11-16 12:08 . 2007-11-16 12:08 d——– C:\Users\Osman\Incomplete
2007-11-16 12:07 . 2007-12-05 22:23 d——– C:\Users\Osman\AppData\Roaming\LimeWire
2007-11-16 12:06 . 2007-11-16 19:09 d——– C:\Program Files\LimeWire
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-08 20:01 42,211 —-a-w C:\Users\Osman\AppData\Roaming\nvModes.dat
2007-12-07 23:11 ——— d—–w C:\Users\Osman\AppData\Roaming\AVG7
2007-12-07 07:31 ——— d—–w C:\Users\Osman\AppData\Roaming\Azureus
2007-12-07 06:36 ——— d—–w C:\Program Files\DivX
2007-12-06 20:00 ——— d—–w C:\ProgramData\Microsoft Help
2007-12-03 06:44 ——— d—–w C:\Users\Osman\AppData\Roaming\Winamp
2007-11-30 03:13 ——— d—–w C:\ProgramData\avg7
2007-11-20 17:59 164 —-a-w C:\install.dat
2007-11-20 03:45 ——— d—–w C:\ProgramData\NVIDIA
2007-11-14 22:54 ——— d—–w C:\Program Files\Google
2007-11-14 08:03 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-14 08:03 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2007-11-14 08:03 542,720 —-a-w C:\Windows\System32\sysmain.dll
2007-11-14 08:03 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2007-11-14 08:03 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2007-11-14 08:03 3,504,824 —-a-w C:\Windows\System32\ntkrnlpa.exe
2007-11-14 08:03 3,471,544 —-a-w C:\Windows\System32\ntoskrnl.exe
2007-11-14 08:03 297,984 —-a-w C:\Windows\System32\wlansec.dll
2007-11-14 08:03 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2007-11-14 08:03 28,344 —-a-w C:\Windows\system32\drivers\battc.sys
2007-11-14 08:03 258,232 —-a-w C:\Windows\system32\drivers\acpi.sys
2007-11-14 08:03 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2007-11-14 08:03 20,920 —-a-w C:\Windows\system32\drivers\compbatt.sys
2007-11-14 08:03 2,923,520 —-a-w C:\Windows\explorer.exe
2007-11-14 08:03 2,027,008 —-a-w C:\Windows\System32\win32k.sys
2007-11-14 08:03 14,208 —-a-w C:\Windows\system32\drivers\CmBatt.sys
2007-11-14 08:03 11,264 —-a-w C:\Windows\system32\drivers\wmiacpi.sys
2007-11-14 08:01 ——— d—–w C:\Program Files\Windows Mail
2007-11-06 22:51 ——— d—–w C:\Program Files\QuickTime
2007-11-06 22:50 ——— d—–w C:\ProgramData\Apple Computer
2007-11-03 00:49 ——— d—–w C:\Program Files\Steam
2007-10-30 16:29 ——— d—–w C:\Program Files\Winamp
2007-10-29 00:31 ——— d—–w C:\Program Files\Common Files\Steam
2007-10-25 02:11 ——— d—–w C:\Program Files\Java
2007-10-10 15:53 8,147,968 —-a-w C:\Windows\System32\wmploc.DLL
2007-10-10 15:53 7,680 —-a-w C:\Windows\System32\spwmp.dll
2007-10-10 15:53 4,096 —-a-w C:\Windows\System32\dxmasf.dll
2007-10-10 15:53 356,864 —-a-w C:\Windows\System32\MediaMetadataHandler.dll
2007-10-10 15:51 56,320 —-a-w C:\Windows\System32\iesetup.dll
2007-10-10 15:51 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-10-10 15:51 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2007-10-10 15:50 84,480 —-a-w C:\Windows\System32\INETRES.dll
2007-10-10 15:50 788,992 —-a-w C:\Windows\System32\rpcrt4.dll
2007-10-10 15:50 737,792 —-a-w C:\Windows\System32\inetcomm.dll
2007-10-10 15:49 ——— d—–w C:\Program Files\Enigma Software Group
2007-10-07 10:09 107,132 —-a-w C:\Windows\UninstallFirefox.exe
2007-10-01 21:40 1,526,072 —-a-w C:\Windows\WRSetup.dll
2007-09-10 15:55 692,224 —-a-w C:\Windows\System32\ijjiSetup.exe
2007-08-30 07:14 174 –sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot@2007-12-07_ 2.41.20.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-07 07:38:51 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2007-12-08 20:06:30 67,584 –s-a-w C:\Windows\bootstat.dat
- 2007-12-07 07:31:24 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-12-08 07:18:48 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-07 07:39:19 1,310,720 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2007-12-08 20:06:43 1,310,720 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2007-12-07 07:31:24 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-12-08 07:18:49 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-07 07:39:18 1,310,720 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2007-12-08 20:06:43 1,310,720 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2007-12-07 06:36:31 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-12-08 04:34:13 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-12-07 06:36:31 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-08 04:34:13 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-07 06:36:31 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-12-08 04:34:13 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-12-07 07:37:59 727,640 —-a-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Webroot\Spy Sweeper\Data\settings.dat
+ 2007-12-08 20:05:33 128,152 —-a-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Webroot\Spy Sweeper\Data\settings.dat
- 2007-12-07 07:35:16 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2007-12-08 20:02:57 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2007-12-07 03:02:07 104,024 —-a-w C:\Windows\System32\perfc009.dat
+ 2007-12-08 04:28:01 104,024 —-a-w C:\Windows\System32\perfc009.dat
- 2007-12-07 03:02:07 618,648 —-a-w C:\Windows\System32\perfh009.dat
+ 2007-12-08 04:28:01 618,648 —-a-w C:\Windows\System32\perfh009.dat
- 2007-12-07 02:59:18 8,976 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2916311817-2596600878-1824792842-1000_UserData.bin
+ 2007-12-08 04:23:01 9,242 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2916311817-2596600878-1824792842-1000_UserData.bin
- 2007-12-07 02:59:18 61,648 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-12-08 04:23:01 61,648 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2007-12-07 02:59:16 39,906 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-12-08 04:22:59 39,906 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2007-12-07 02:32:30 271,710 —-a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2007-12-08 20:01:21 274,406 —-a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Offline Files]
@={4E77131D-3629-431c-9818-C5679DC83E81}
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="rundll32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:34]
"Steam"="" []
"googletalk"="C:\Users\Osman\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 16:22]
"Aim6"="" []
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:33]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-06-13 23:55]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2006-11-14 22:27]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-27 17:56]
"BtHidUi"="C:\Program Files\CSR\Vista Profile Pack\BtHidUi.exe" [2006-11-15 14:16]
"WavXMgr"="C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2007-02-15 17:31]
"SecureUpgrade"="C:\Program Files\Wave Systems Corp\SecureUpgrade.exe" [2007-03-08 16:43]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-24 09:30]
"NVHotkey"="rundll32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvSvc"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvCplDaemon"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvMediaCenter"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"SigmatelSysTrayApp"="sttray.exe" [2007-01-12 10:51 C:\Windows\sttray.exe]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 09:30]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-01 20:29:33]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-04 18:37:50]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-07-16 23:00 9216 C:\Windows\System32\avgwlntf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
R0 PBADRV;PBADRV;C:\Windows\system32\DRIVERS\PBADRV.sys
R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\Windows\system32\Drivers\SSFS0BB9.SYS
R2 WavxDMgr;WavxDMgr;C:\Windows\system32\DRIVERS\WavxDMgr.sys
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys
R3 BTHFILT;Bluetooth Command Filter;C:\Windows\system32\DRIVERS\BthFilt.sys
R3 guardian2;guardian2;C:\Windows\system32\Drivers\oz776.sys
R3 nvlddmkm;nvlddmkm;C:\Windows\system32\DRIVERS\nvlddmkm.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\Windows\system32\drivers\WmXlCore.sys
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\Windows\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\Windows\system32\drivers\WmVirHid.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{622a021c-56c8-11dc-8920-0019b975296f}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 04:52:48 C:\Windows\Tasks\wrSpySweeper_L5B081F3E3279464D98972BB433DE8722.job"
.
**************************************************************************
catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 15:07:15
Windows 6.0.6000 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-08 15:08:34 - machine was rebooted
C:\ComboFix2.txt … 2007-12-07 18:13
C:\ComboFix3.txt … 2007-12-07 02:41
.
— E O F —
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1221 [GMT -5:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))
.
2007-12-08 00:36 . 2007-12-08 03:56 d——– C:\Program Files\Kali95
2007-12-08 00:10 . 2007-12-08 00:36 d——– C:\Users\Osman\AppData\Roaming\Hamachi
2007-12-08 00:09 . 2007-12-08 00:10 d——– C:\Program Files\Hamachi
2007-12-08 00:09 . 2007-12-08 00:09 25,280 –a—— C:\Windows\System32\drivers\hamachi.sys
2007-12-07 23:27 . 2007-12-07 23:34 139,264 –a—— C:\Windows\War3Unin.exe
2007-12-07 23:27 . 2007-12-07 23:47 76,626 –a—— C:\Windows\War3Unin.dat
2007-12-07 23:27 . 2007-12-07 23:34 2,829 –a—— C:\Windows\War3Unin.pif
2007-12-07 23:03 . 2007-12-08 03:56 d——– C:\Program Files\Warcraft III
2007-12-03 20:33 . 2007-12-03 20:33 823,296 –a—— C:\Windows\System32\divx_xx0c.dll
2007-12-03 20:33 . 2007-12-03 20:33 823,296 –a—— C:\Windows\System32\divx_xx07.dll
2007-12-03 20:33 . 2007-12-03 20:33 802,816 –a—— C:\Windows\System32\divx_xx11.dll
2007-12-03 20:33 . 2007-12-03 20:33 682,496 –a—— C:\Windows\System32\DivX.dll
2007-12-03 20:33 . 2007-12-03 20:33 630,784 –a—— C:\Windows\System32\divxdec.ax
2007-12-03 01:42 . 2007-12-05 22:24 d——– C:\Incomplete
2007-11-29 17:55 . 2007-11-29 17:55 d——– C:\sec30
2007-11-29 17:30 . 2007-11-29 17:30 3,596,288 –a—— C:\Windows\System32\qt-dx331.dll
2007-11-29 17:30 . 2007-11-29 17:30 1,044,480 –a—— C:\Windows\System32\libdivx.dll
2007-11-29 17:30 . 2007-11-29 17:30 524,288 –a—— C:\Windows\System32\DivXsm.exe
2007-11-29 17:30 . 2007-11-29 17:30 200,704 –a—— C:\Windows\System32\ssldivx.dll
2007-11-29 17:30 . 2007-11-29 17:30 4,816 –a—— C:\Windows\System32\divxsm.tlb
2007-11-29 17:28 . 2007-11-29 17:28 196,608 –a—— C:\Windows\System32\dtu100.dll
2007-11-29 17:28 . 2007-11-29 17:28 81,920 –a—— C:\Windows\System32\dpl100.dll
2007-11-29 17:28 . 2007-11-29 17:28 416 –a—— C:\Windows\System32\dtu100.dll.manifest
2007-11-29 17:28 . 2007-11-29 17:28 416 –a—— C:\Windows\System32\dpl100.dll.manifest
2007-11-28 16:55 . 2007-11-28 16:55 156,992 –a—— C:\Windows\System32\DivXCodecVersionChecker.exe
2007-11-28 16:53 . 2007-11-28 16:53 593,920 –a—— C:\Windows\System32\dpuGUI11.dll
2007-11-28 16:53 . 2007-11-28 16:53 344,064 –a—— C:\Windows\System32\dpus11.dll
2007-11-28 16:53 . 2007-11-28 16:53 294,912 –a—— C:\Windows\System32\dpu11.dll
2007-11-28 16:53 . 2007-11-28 16:53 294,912 –a—— C:\Windows\System32\dpu10.dll
2007-11-28 16:53 . 2007-11-28 16:53 57,344 –a—— C:\Windows\System32\dpv11.dll
2007-11-28 16:53 . 2007-11-28 16:53 53,248 –a—— C:\Windows\System32\dpuGUI10.dll
2007-11-28 16:52 . 2007-11-28 16:52 12,288 –a—— C:\Windows\System32\DivXWMPExtType.dll
2007-11-25 04:08 . 2007-11-25 04:08 d——– C:\Users\Osman\AppData\Roaming\PC Tools
2007-11-25 04:08 . 2007-11-28 10:56 d——– C:\Program Files\Spyware Doctor
2007-11-25 04:08 . 2005-09-23 08:29 626,688 –a—— C:\Windows\System32\msvcr80.dll
2007-11-25 04:08 . 2007-10-18 00:16 79,688 –a—— C:\Windows\System32\drivers\iksyssec.sys
2007-11-25 04:08 . 2007-10-18 00:15 62,280 –a—— C:\Windows\System32\drivers\iksysflt.sys
2007-11-25 04:08 . 2007-10-18 00:14 41,288 –a—— C:\Windows\System32\drivers\ikfilesec.sys
2007-11-25 04:08 . 2007-10-18 00:16 29,000 –a—— C:\Windows\System32\drivers\kcom.sys
2007-11-25 04:01 . 2007-11-25 04:01 d——– C:\Program Files\SigmaTel
2007-11-25 03:45 . 2007-11-25 03:45 d——– C:\Users\Osman\AppData\Roaming\SystemRequirementsLab
2007-11-25 03:45 . 2007-11-25 03:45 d——– C:\Program Files\SystemRequirementsLab
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Users\All Users\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\ProgramData\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Program Files\Lavasoft
2007-11-22 23:30 . 2007-11-22 23:30 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-22 02:37 . 2007-11-22 02:37 97 –a—— C:\Windows\wininit.ini
2007-11-20 23:38 . 2007-11-20 23:38 d——– C:\Users\All Users\Prevx
2007-11-20 23:38 . 2007-11-20 23:38 d——– C:\ProgramData\Prevx
2007-11-20 23:37 . 2007-12-08 00:06 d——– C:\Temp
2007-11-20 12:59 . 2007-10-01 16:24 20,280 –a—— C:\Windows\System32\drivers\SSFS0BB9.sys
2007-11-19 01:21 . 2007-11-19 01:33 d——– C:\Program Files\Starcraft
2007-11-19 01:21 . 2007-11-19 01:22 70,656 –a—— C:\Windows\ScUnin.exe
2007-11-19 01:21 . 2007-11-19 01:22 34,474 –a—— C:\Windows\scunin.dat
2007-11-19 01:21 . 2007-11-19 01:22 967 –a—— C:\Windows\ScUnin.pif
2007-11-18 14:01 . 2007-12-05 22:21 54,156 –ah—– C:\Windows\QTFont.qfn
2007-11-18 14:01 . 2007-11-18 14:01 1,409 –a—— C:\Windows\QTFont.for
2007-11-17 16:15 . 2007-11-17 16:15 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2007-11-16 19:08 . 2007-11-16 19:08 d——– C:\Windows\System32\updater
2007-11-16 19:08 . 2007-11-16 19:08 10 –a—— C:\boot.inf
2007-11-16 12:08 . 2007-11-16 12:08 d——– C:\Users\Osman\Incomplete
2007-11-16 12:07 . 2007-12-05 22:23 d——– C:\Users\Osman\AppData\Roaming\LimeWire
2007-11-16 12:06 . 2007-11-16 19:09 d——– C:\Program Files\LimeWire
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-08 20:01 42,211 —-a-w C:\Users\Osman\AppData\Roaming\nvModes.dat
2007-12-07 23:11 ——— d—–w C:\Users\Osman\AppData\Roaming\AVG7
2007-12-07 07:31 ——— d—–w C:\Users\Osman\AppData\Roaming\Azureus
2007-12-07 06:36 ——— d—–w C:\Program Files\DivX
2007-12-06 20:00 ——— d—–w C:\ProgramData\Microsoft Help
2007-12-03 06:44 ——— d—–w C:\Users\Osman\AppData\Roaming\Winamp
2007-11-30 03:13 ——— d—–w C:\ProgramData\avg7
2007-11-20 17:59 164 —-a-w C:\install.dat
2007-11-20 03:45 ——— d—–w C:\ProgramData\NVIDIA
2007-11-14 22:54 ——— d—–w C:\Program Files\Google
2007-11-14 08:03 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-14 08:03 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2007-11-14 08:03 542,720 —-a-w C:\Windows\System32\sysmain.dll
2007-11-14 08:03 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2007-11-14 08:03 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2007-11-14 08:03 3,504,824 —-a-w C:\Windows\System32\ntkrnlpa.exe
2007-11-14 08:03 3,471,544 —-a-w C:\Windows\System32\ntoskrnl.exe
2007-11-14 08:03 297,984 —-a-w C:\Windows\System32\wlansec.dll
2007-11-14 08:03 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2007-11-14 08:03 28,344 —-a-w C:\Windows\system32\drivers\battc.sys
2007-11-14 08:03 258,232 —-a-w C:\Windows\system32\drivers\acpi.sys
2007-11-14 08:03 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2007-11-14 08:03 20,920 —-a-w C:\Windows\system32\drivers\compbatt.sys
2007-11-14 08:03 2,923,520 —-a-w C:\Windows\explorer.exe
2007-11-14 08:03 2,027,008 —-a-w C:\Windows\System32\win32k.sys
2007-11-14 08:03 14,208 —-a-w C:\Windows\system32\drivers\CmBatt.sys
2007-11-14 08:03 11,264 —-a-w C:\Windows\system32\drivers\wmiacpi.sys
2007-11-14 08:01 ——— d—–w C:\Program Files\Windows Mail
2007-11-06 22:51 ——— d—–w C:\Program Files\QuickTime
2007-11-06 22:50 ——— d—–w C:\ProgramData\Apple Computer
2007-11-03 00:49 ——— d—–w C:\Program Files\Steam
2007-10-30 16:29 ——— d—–w C:\Program Files\Winamp
2007-10-29 00:31 ——— d—–w C:\Program Files\Common Files\Steam
2007-10-25 02:11 ——— d—–w C:\Program Files\Java
2007-10-10 15:53 8,147,968 —-a-w C:\Windows\System32\wmploc.DLL
2007-10-10 15:53 7,680 —-a-w C:\Windows\System32\spwmp.dll
2007-10-10 15:53 4,096 —-a-w C:\Windows\System32\dxmasf.dll
2007-10-10 15:53 356,864 —-a-w C:\Windows\System32\MediaMetadataHandler.dll
2007-10-10 15:51 56,320 —-a-w C:\Windows\System32\iesetup.dll
2007-10-10 15:51 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-10-10 15:51 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2007-10-10 15:50 84,480 —-a-w C:\Windows\System32\INETRES.dll
2007-10-10 15:50 788,992 —-a-w C:\Windows\System32\rpcrt4.dll
2007-10-10 15:50 737,792 —-a-w C:\Windows\System32\inetcomm.dll
2007-10-10 15:49 ——— d—–w C:\Program Files\Enigma Software Group
2007-10-07 10:09 107,132 —-a-w C:\Windows\UninstallFirefox.exe
2007-10-01 21:40 1,526,072 —-a-w C:\Windows\WRSetup.dll
2007-09-10 15:55 692,224 —-a-w C:\Windows\System32\ijjiSetup.exe
2007-08-30 07:14 174 –sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot@2007-12-07_ 2.41.20.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-07 07:38:51 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2007-12-08 20:06:30 67,584 –s-a-w C:\Windows\bootstat.dat
- 2007-12-07 07:31:24 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-12-08 07:18:48 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-07 07:39:19 1,310,720 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2007-12-08 20:06:43 1,310,720 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2007-12-07 07:31:24 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-12-08 07:18:49 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-07 07:39:18 1,310,720 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2007-12-08 20:06:43 1,310,720 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2007-12-07 06:36:31 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-12-08 04:34:13 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-12-07 06:36:31 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-08 04:34:13 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-07 06:36:31 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-12-08 04:34:13 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-12-07 07:37:59 727,640 —-a-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Webroot\Spy Sweeper\Data\settings.dat
+ 2007-12-08 20:05:33 128,152 —-a-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Webroot\Spy Sweeper\Data\settings.dat
- 2007-12-07 07:35:16 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2007-12-08 20:02:57 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2007-12-07 03:02:07 104,024 —-a-w C:\Windows\System32\perfc009.dat
+ 2007-12-08 04:28:01 104,024 —-a-w C:\Windows\System32\perfc009.dat
- 2007-12-07 03:02:07 618,648 —-a-w C:\Windows\System32\perfh009.dat
+ 2007-12-08 04:28:01 618,648 —-a-w C:\Windows\System32\perfh009.dat
- 2007-12-07 02:59:18 8,976 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2916311817-2596600878-1824792842-1000_UserData.bin
+ 2007-12-08 04:23:01 9,242 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2916311817-2596600878-1824792842-1000_UserData.bin
- 2007-12-07 02:59:18 61,648 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-12-08 04:23:01 61,648 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2007-12-07 02:59:16 39,906 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-12-08 04:22:59 39,906 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2007-12-07 02:32:30 271,710 —-a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2007-12-08 20:01:21 274,406 —-a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Offline Files]
@={4E77131D-3629-431c-9818-C5679DC83E81}
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="rundll32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:34]
"Steam"="" []
"googletalk"="C:\Users\Osman\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 16:22]
"Aim6"="" []
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:33]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-06-13 23:55]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2006-11-14 22:27]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-27 17:56]
"BtHidUi"="C:\Program Files\CSR\Vista Profile Pack\BtHidUi.exe" [2006-11-15 14:16]
"WavXMgr"="C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2007-02-15 17:31]
"SecureUpgrade"="C:\Program Files\Wave Systems Corp\SecureUpgrade.exe" [2007-03-08 16:43]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-24 09:30]
"NVHotkey"="rundll32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvSvc"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvCplDaemon"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"NvMediaCenter"="RUNDLL32.exe" [2006-11-02 04:45 C:\Windows\System32\rundll32.exe]
"SigmatelSysTrayApp"="sttray.exe" [2007-01-12 10:51 C:\Windows\sttray.exe]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 09:30]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-01 20:29:33]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-04 18:37:50]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-07-16 23:00 9216 C:\Windows\System32\avgwlntf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
R0 PBADRV;PBADRV;C:\Windows\system32\DRIVERS\PBADRV.sys
R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\Windows\system32\Drivers\SSFS0BB9.SYS
R2 WavxDMgr;WavxDMgr;C:\Windows\system32\DRIVERS\WavxDMgr.sys
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys
R3 BTHFILT;Bluetooth Command Filter;C:\Windows\system32\DRIVERS\BthFilt.sys
R3 guardian2;guardian2;C:\Windows\system32\Drivers\oz776.sys
R3 nvlddmkm;nvlddmkm;C:\Windows\system32\DRIVERS\nvlddmkm.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\Windows\system32\drivers\WmXlCore.sys
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\Windows\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\Windows\system32\drivers\WmVirHid.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{622a021c-56c8-11dc-8920-0019b975296f}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 04:52:48 C:\Windows\Tasks\wrSpySweeper_L5B081F3E3279464D98972BB433DE8722.job"
.
**************************************************************************
catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 15:07:15
Windows 6.0.6000 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-08 15:08:34 - machine was rebooted
C:\ComboFix2.txt … 2007-12-07 18:13
C:\ComboFix3.txt … 2007-12-07 02:41
.
— E O F —