logcombofix
ComboFix 07-11-19.3 - Per 2007-11-23 16:25:08.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1030.18.1490 [GMT 1:00]
Running from: C:\Documents and Settings\Per\Skrivebord\cleaner\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 )))))))))))))))))))))))))))))))
.
2007-11-23 15:17 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2007-11-23 15:17 <DIR> d-------- C:\Documents and Settings\Per\Application Data\SUPERAntiSpyware.com
2007-11-23 15:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-23 15:02 <DIR> d-------- C:\Programmer\CCleaner
2007-11-21 21:43 <DIR> d-------- C:\Programmer\Lavasoft
2007-11-21 21:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-21 21:02 <DIR> d-------- C:\Documents and Settings\Per\.housecall6.6
2007-11-21 18:58 <DIR> d-------- C:\Programmer\Microsoft.NET
2007-11-21 18:58 <DIR> d-------- C:\Programmer\Microsoft Works
2007-11-21 17:38 <DIR> d-------- C:\Documents and Settings\Per\Application Data\OpenOffice.org2
2007-11-21 17:37 <DIR> d-------- C:\Programmer\OpenOffice.org 2.3
2007-11-21 16:21 <DIR> d-------- C:\Programmer\RegistrySmart
2007-11-21 16:21 <DIR> d-------- C:\Documents and Settings\Per\Application Data\RegistrySmart
2007-11-16 19:07 <DIR> d-------- C:\Programmer\Microsoft ActiveSync
2007-11-14 19:19 <DIR> d-------- C:\Programmer\Golden FTP Server
2007-11-14 17:16 <DIR> d-------- C:\Documents and Settings\Per\Application Data\ScanSoft
2007-11-14 17:11 <DIR> d-------- C:\Documents and Settings\Per\Application Data\Zeon
2007-11-14 17:09 <DIR> d-------- C:\Programmer\ScanSoft
2007-11-14 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\zeon
2007-11-14 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2007-11-11 19:12 <DIR> C:\Programmer\Fælles filer\NSV
2007-11-10 11:39 <DIR> d-------- C:\Programmer\IVT Corporation
2007-11-08 19:24 <DIR> dr------- C:\Documents and Settings\LocalService\Dokumenter
2007-11-07 21:37 <DIR> d-------- C:\Documents and Settings\Per\Application Data\vlc
2007-11-07 21:33 <DIR> d-------- C:\Programmer\VideoLAN
2007-11-05 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-05 14:25 <DIR> d-------- C:\Programmer\Namo
2007-11-05 14:21 <DIR> C:\Programmer\Fælles filer\Adobe
2007-11-04 15:44 <DIR> d-------- C:\Documents and Settings\Per\WINDOWS
2007-10-25 07:09 <DIR> d-------- C:\Programmer\Gyldendal
2007-10-23 15:02 <DIR> d-------- C:\Programmer\MSXML 4.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-23 15:41 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-23 14:16 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2007-11-23 14:05 --------- d-----w C:\Programmer\Fælles filer\Symantec Shared
2007-11-23 09:35 --------- d-----w C:\Documents and Settings\Per\Application Data\mIRC
2007-11-23 09:33 --------- d-----w C:\Programmer\mIRC
2007-11-22 17:57 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-11-21 20:45 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-11-21 20:45 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-11-21 20:17 164 ----a-w C:\install.dat
2007-11-18 17:02 --------- d-----w C:\Programmer\Norton AntiVirus
2007-11-16 16:24 --------- d-----w C:\Documents and Settings\Per\Application Data\Ahead
2007-11-14 16:09 --------- d-----w C:\Programmer\Fælles filer\InstallShield
2007-11-08 18:24 --------- d--h--w C:\Programmer\InstallShield Installation Information
2007-10-22 17:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2007-10-21 13:59 --------- d-----w C:\Documents and Settings\Per\Application Data\Nokia
2007-10-21 13:57 --------- d-----w C:\Programmer\Nokia
2007-10-21 13:54 --------- d-----w C:\Programmer\Fælles filer\PCSuite
2007-10-21 13:54 --------- d-----w C:\Programmer\Fælles filer\Nokia
2007-10-21 13:54 --------- d-----w C:\Programmer\DIFX
2007-10-21 13:54 --------- d-----w C:\Documents and Settings\Per\Application Data\PC Suite
2007-10-21 13:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-10-21 13:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2007-10-18 15:37 --------- d-----w C:\Documents and Settings\Per\Application Data\InstallShield
2007-10-18 15:32 --------- d-----w C:\Programmer\Fælles filer\Ahead
2007-10-18 15:28 --------- d-----w C:\Programmer\Nero
2007-10-18 11:08 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-18 11:08 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-18 11:08 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-18 11:08 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-18 11:08 --------- d-----w C:\Programmer\Symantec
2007-10-15 13:28 --------- d-----w C:\Programmer\Winamp
2007-10-15 13:26 --------- d-----w C:\Documents and Settings\Per\Application Data\Winamp
2007-10-15 08:02 --------- d-----w C:\Programmer\Microsoft CAPICOM 2.1.0.2
2007-10-14 11:54 --------- d-----w C:\Programmer\Java
2007-10-14 11:53 --------- d-----w C:\Programmer\Fælles filer\Java
2007-10-13 20:01 --------- d-----w C:\Programmer\K-Lite Codec Pack
2007-10-13 19:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Tages
2007-10-13 17:34 278,728 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-13 17:34 25,416 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-13 16:16 --------- d-----w C:\Documents and Settings\Per\Application Data\Ventrilo
2007-10-13 16:10 --------- d-----w C:\Programmer\Ventrilo
2007-10-11 17:20 --------- d-----w C:\Programmer\DAEMON Tools
2007-10-11 17:17 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-11 16:27 --------- d-----w C:\Programmer\D-Tools
2007-10-09 16:06 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-10-09 16:06 --------- d-----w C:\Programmer\Realtek
2007-10-09 16:04 --------- d-----w C:\Programmer\Quick Launch Button
2007-10-09 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-10-09 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-10-09 15:09 --------- d-----w C:\Programmer\SystemRequirementsLab
2007-10-09 12:38 --------- d-----w C:\Programmer\Electronic Arts
2007-10-09 11:52 --------- d-----w C:\Programmer\MSN Messenger
2007-10-08 17:25 --------- d-----w C:\Programmer\Fælles filer\SpeechEngines
2007-10-08 17:25 --------- d-----w C:\Programmer\Fælles filer\ODBC
2007-10-08 16:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-08 16:38 --------- d-----w C:\Documents and Settings\Per\Application Data\Symantec
2007-10-08 16:34 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-10-08 16:16 --------- d-----w C:\Programmer\Intel
2007-10-08 15:42 --------- d-----w C:\Programmer\microsoft frontpage
2007-10-08 15:39 --------- d-----w C:\Programmer\Onlinetjenester
2007-10-08 15:38 --------- d-----w C:\Programmer\Fælles filer\Tjenester
2007-10-08 15:38 --------- d-----w C:\Programmer\Fælles filer\MSSoap
2007-10-01 12:49 98,184 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 12:49 542,088 ----a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-01 12:49 31,624 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 12:49 28,040 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 12:49 23,944 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 12:49 189,320 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 12:49 161,160 ----a-w C:\WINDOWS\system32\SymRedir.dll
2007-10-01 12:48 12,680 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programmer\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-26 16:53]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="sm56hlpr.exe" [2005-05-26 11:12 C:\WINDOWS\sm56hlpr.exe]
"BluetoothAuthenticationAgent"="rundll32.exe" [2004-08-26 16:53 C:\WINDOWS\system32\rundll32.exe]
"ccApp"="C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe" []
"NAV CfgWiz"="C:\Programmer\Fælles filer\Symantec Shared\SymProbe.exe" []
"Symantec PIF AlertEng"="C:\Programmer\Fælles filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" []
"NvCplDaemon"="RUNDLL32.exe" [2004-08-26 16:53 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-01-25 09:53 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-26 16:53 C:\WINDOWS\system32\rundll32.exe]
"QLButton"="C:\Programmer\Quick Launch Button\QLButton.exe" [2005-01-06 12:53]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 13:49 C:\WINDOWS\RTHDCPL.exe]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"NeroFilterCheck"="C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe" []
"BtTray"="C:\Programmer\IVT Corporation\BlueSoleil\BtTray.exe" [2007-09-10 11:08]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ISUSPM Startup"="C:\PROGRA~1\FLLESF~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 12:41]
"ISUSScheduler"="C:\Programmer\Fælles filer\InstallShield\UpdateService\issch.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-26 16:53]
[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Programmer\DAEMON Tools\daemon.exe -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Programmer\Microsoft ActiveSync\Wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2006-07-25 14:55 1043968 --a------ C:\Programmer\Nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Programmer\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-10-10 06:28 36352 --a------ C:\Programmer\Winamp\winampa.exe
R2 BlueSoleilCS;BlueSoleilCS;C:\Programmer\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
R2 NetCM;Network Connection Manager;C:\Programmer\Common Files\Microsoft Shared\Speech\svchost.exe
R3 BsHelpCS;BsHelpCS;C:\Programmer\IVT Corporation\BlueSoleil\BsHelpCS.exe
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b7c6e34-8073-11dc-9cdf-0018de478868}]
\Shell\AutoRun\command - setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 18:42:36 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Per.job"
"2007-11-21 15:21:37 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Programmer\RegistrySmart\RegistrySmart.ex
- C:\Programmer\RegistrySmart
.
**************************************************************************
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2007-11-23 16:30:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-23 16:42:02 - machine was rebooted
.
--- E O F ---