ComboFix 10-07-01.02 - Craig 07/02/2010 19:06:25.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.847 [GMT -4:00]
Running from: c:\users\Craig\Desktop\ComboFix.exe
Command switches used :: c:\users\Craig\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Sunbelt Personal Firewall *enabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
SP: ESET NOD32 Antivirus 4.0 *enabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2010-06-02 to 2010-07-02 )))))))))))))))))))))))))))))))
.
2010-07-02 23:22 . 2010-07-02 23:23 -------- d-----w- c:\users\Craig\AppData\Local\temp
2010-07-02 23:22 . 2010-07-02 23:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-07-02 23:22 . 2010-07-02 23:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-06-26 22:51 . 2010-06-26 22:51 -------- d-----w- c:\windows\ERUNT
2010-06-26 22:36 . 2010-06-26 22:36 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2010-06-26 21:46 . 2010-02-26 23:51 6870864 ---ha-w- c:\users\Craig\AppData\Roaming\mjusbsp\in00000\setup.exe
2010-06-26 21:46 . 2010-02-26 23:45 743872 ---ha-w- c:\users\Craig\AppData\Roaming\mjusbsp\ar00000\install.exe
2010-06-23 05:20 . 2009-11-08 14:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-23 05:20 . 2009-11-08 14:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-23 05:20 . 2009-11-08 14:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-23 05:20 . 2009-11-08 14:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-23 05:20 . 2009-11-08 14:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-23 05:17 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-06-23 05:17 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-06-21 19:27 . 2010-06-21 19:33 -------- d-----w- c:\users\Craig\AppData\Roaming\Digsby
2010-06-21 19:27 . 2010-06-21 19:33 -------- d-----w- c:\programdata\Digsby
2010-06-21 19:27 . 2010-06-21 19:33 -------- d-----w- c:\users\Craig\AppData\Local\Digsby
2010-06-21 19:25 . 2010-06-21 19:26 -------- d-----w- c:\program files\Digsby
2010-06-21 18:54 . 2010-06-09 13:58 85464 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
2010-06-21 18:54 . 2010-06-09 13:58 38872 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINCE\components\WeaveCrypto.dll
2010-06-15 15:01 . 2010-06-15 15:01 -------- d-----w- c:\users\Craig\AppData\Roaming\FireShot
2010-06-15 15:00 . 2009-10-08 14:31 3204096 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll
2010-06-15 15:00 . 2009-10-07 22:06 106496 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll
2010-06-15 15:00 . 2009-09-24 01:29 28672 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
2010-06-15 15:00 . 2009-03-20 03:57 40960 ----a-w- c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe
2010-06-13 17:32 . 2010-06-13 17:32 -------- d-----w- c:\users\Craig\AppData\Roaming\Apple Computer
2010-06-12 11:38 . 2010-06-12 11:38 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-06-12 11:38 . 2010-06-12 11:38 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-06-10 23:08 . 2010-06-10 23:08 -------- d-----w- c:\programdata\FNET
2010-06-10 23:08 . 2010-06-10 23:08 7040 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2010-06-10 23:08 . 2010-06-10 23:08 17792 ----a-w- c:\windows\system32\drivers\FNETTBOH.SYS
2010-06-10 23:08 . 2010-06-10 23:08 -------- d-----w- c:\program files\TurboHddUsb
2010-06-09 03:13 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-09 03:12 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-06-09 03:12 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-09 03:12 . 2010-05-01 14:13 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-06-07 01:16 . 2010-06-07 01:16 -------- d-----w- c:\programdata\Backblaze
2010-06-07 01:16 . 2010-06-07 01:16 -------- d-----w- c:\program files\Backblaze
2010-06-03 03:45 . 2010-06-03 03:45 -------- d-----r- c:\users\Craig\AppData\Roaming\Brother
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-02 22:59 . 2010-03-02 12:52 -------- d-----w- c:\users\Craig\AppData\Roaming\Dropbox
2010-07-02 22:58 . 2010-03-02 15:37 -------- d-----w- c:\program files\Taskbar Shuffle
2010-07-02 22:55 . 2010-03-02 16:18 -------- d-----w- c:\users\Craig\AppData\Roaming\uTorrent
2010-07-01 00:58 . 2010-03-03 22:36 -------- d-----w- c:\users\Craig\AppData\Roaming\Skype
2010-06-29 13:00 . 2010-05-03 18:33 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-06-28 21:53 . 2010-03-04 18:14 -------- d-----w- c:\programdata\FLEXnet
2010-06-26 22:45 . 2010-03-02 21:01 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-26 21:46 . 2010-03-02 13:40 -------- d-----w- c:\users\Craig\AppData\Roaming\mjusbsp
2010-06-26 06:10 . 2010-05-31 21:22 -------- d-----w- c:\program files\Google
2010-06-24 21:45 . 2010-03-06 16:45 -------- d-----w- c:\program files\Steam
2010-06-23 05:30 . 2010-03-03 07:06 -------- d-----w- c:\program files\Microsoft.NET
2010-06-22 02:20 . 2010-03-02 15:40 -------- d-----w- c:\program files\Heroes of Newerth
2010-06-20 01:35 . 2010-03-05 02:03 -------- d-----w- c:\program files\CamStudio
2010-06-19 17:31 . 2010-03-02 13:06 117760 ----a-w- c:\users\Craig\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-06-19 17:26 . 2010-03-02 13:02 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-06-19 17:20 . 2010-05-03 18:33 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-17 21:27 . 2010-04-28 05:48 -------- d-----w- c:\program files\Paint.NET
2010-06-14 20:45 . 2010-04-09 12:03 -------- d-----w- c:\users\Craig\AppData\Roaming\Ventrilo
2010-06-12 11:38 . 2010-06-12 11:38 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-06-12 11:38 . 2010-06-12 11:38 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-06-12 11:38 . 2010-06-12 11:38 49152 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-06-12 11:38 . 2010-06-12 11:38 40960 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-06-12 11:38 . 2010-06-12 11:38 308808 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-06-12 11:38 . 2010-06-12 11:38 14848 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-06-12 11:38 . 2010-06-12 11:38 341600 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-06-12 11:38 . 2010-03-03 15:19 -------- d-----w- c:\program files\Common Files\Real
2010-06-12 11:37 . 2010-06-12 11:36 -------- d-----w- c:\program files\real
2010-06-12 11:37 . 2010-06-12 11:37 -------- d-----w- c:\program files\Common Files\xing shared
2010-06-09 03:59 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-09 03:37 . 2010-03-02 14:46 -------- d-----w- c:\programdata\Microsoft Help
2010-06-09 03:31 . 2010-03-03 15:18 -------- d-----w- c:\program files\mIRC
2010-06-08 02:53 . 2010-03-14 20:56 -------- d-----w- c:\program files\Feed Notifier
2010-06-07 11:55 . 2010-04-04 11:17 -------- d-----w- c:\program files\America Online 8.0
2010-06-04 06:37 . 2010-03-15 03:20 -------- d-----w- c:\program files\Opera
2010-06-04 06:25 . 2010-03-02 16:34 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-02 06:45 . 2010-03-02 15:07 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-02 06:45 . 2010-03-02 15:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-02 06:43 . 2010-06-02 06:43 319488 ----a-w- c:\windows\HideWin.exe
2010-06-01 10:09 . 2010-03-02 15:32 -------- d-----w- c:\program files\Orbit Downloader
2010-06-01 09:45 . 2010-03-02 14:51 -------- d-----w- c:\users\Craig\AppData\Roaming\Winamp
2010-06-01 09:45 . 2010-03-02 15:13 -------- d-----w- c:\users\Craig\AppData\Roaming\IrfanView
2010-05-27 22:41 . 2010-05-27 22:36 -------- d--h--w- c:\program files\Temp
2010-05-25 20:32 . 2010-03-02 16:28 -------- d-----w- c:\program files\Microsoft
2010-05-23 01:59 . 2010-03-02 16:18 -------- d-----w- c:\program files\uTorrent
2010-05-21 18:14 . 2010-03-02 14:19 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-19 20:27 . 2010-05-13 16:10 -------- d-----w- c:\programdata\NVIDIA
2010-05-16 11:14 . 2010-05-16 11:14 -------- d-----w- c:\program files\Sunbelt Software
2010-05-14 04:54 . 2010-05-13 02:34 -------- d-----w- c:\users\Craig\AppData\Roaming\SecondLife
2010-05-13 15:28 . 2010-05-13 15:25 -------- d-----w- c:\users\Craig\AppData\Roaming\Alchemy Mindworks
2010-05-13 11:55 . 2010-04-30 06:53 -------- d-----w- c:\users\Craig\AppData\Roaming\ZumoDrive
2010-05-13 11:41 . 2010-05-13 11:41 -------- d-----w- c:\program files\DebugMode
2010-05-13 02:34 . 2010-05-13 02:33 -------- d-----w- c:\program files\Second Life
2010-05-11 21:10 . 2010-04-10 08:54 -------- d-----w- c:\program files\Continuum
2010-05-11 20:53 . 2010-05-11 20:47 -------- d-----w- c:\users\Craig\AppData\Roaming\NiftyStats
2010-05-11 20:47 . 2010-05-11 20:47 707354 ----a-w- c:\users\Craig\AppData\Roaming\NiftyStats\unins000.exe
2010-05-08 00:42 . 2010-05-07 21:15 -------- d-----w- c:\users\Craig\AppData\Roaming\RJ TextEd
2010-05-08 00:42 . 2010-05-07 21:15 -------- d-----w- c:\program files\RJ TextEd
2010-05-07 02:09 . 2010-05-06 16:35 -------- d-----w- c:\program files\WhatPulse
2010-05-04 05:59 . 2010-06-09 03:14 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-09 03:14 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-09 03:14 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-09 03:14 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-04 02:15 . 2010-03-02 15:32 -------- d-----w- c:\users\Craig\AppData\Roaming\Orbit
2010-04-28 22:07 . 2010-04-28 22:07 766 ----a-r- c:\users\Craig\AppData\Roaming\Microsoft\Installer\{1B485419-875B-428D-816B-2F6627815D7A}\_42fe7987.exe
2010-04-25 08:05 . 2010-03-02 12:34 255920 ----a-w- c:\users\Craig\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-23 14:13 . 2010-05-25 20:07 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-16 16:43 . 2010-06-23 05:17 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-04-16 16:43 . 2010-06-23 05:17 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-04-16 16:43 . 2010-06-23 05:17 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-04-16 16:43 . 2010-06-23 05:17 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-04-16 05:50 . 2010-04-30 06:52 147416 ----a-w- c:\windows\system32\drivers\cbfs.sys
2010-04-13 19:34 . 2010-04-13 19:20 50 ----a-w- c:\windows\system32\bridf08b.dat
2010-04-09 07:45 . 2010-03-02 16:53 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWA\unins000.exe
2010-04-08 05:50 . 2010-04-08 05:50 98304 ----a-w- c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-04-08 05:50 . 2010-04-08 05:50 401408 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
2010-04-08 05:50 . 2010-04-08 05:50 258352 ----a-w- c:\programdata\NexonUS\NGM\unicows.dll
2010-04-08 05:50 . 2010-04-08 05:50 126976 ----a-w- c:\programdata\NexonUS\NGM\nxgameus.dll
2010-04-08 05:50 . 2010-04-08 05:50 765952 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
2010-04-08 05:50 . 2010-04-08 05:50 3355328 ----a-w- c:\programdata\NexonUS\NGM\NGM.exe
2010-04-07 20:20 . 2010-04-07 20:20 10920 ----a-w- C:\aolconnfix.exe
2010-04-04 11:01 . 2010-04-04 10:42 57344 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\ocp\ocpchk.dll
2010-04-04 11:01 . 2010-04-04 10:41 748608 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\ocp\ocpinst.exe
2010-04-04 10:59 . 2010-04-04 10:39 553984 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\flash\flashax.exe
2010-04-04 10:58 . 2010-04-04 10:39 3183256 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\acs\acssetup.exe
2010-04-04 10:58 . 2010-04-04 10:39 17920 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\coach\acpver.dll
2010-04-04 10:58 . 2010-04-04 10:38 615424 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\coach\aolcinst.exe
2010-04-04 10:57 . 2010-04-04 10:38 12288 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\tb\tbinst.dll
2010-04-04 10:57 . 2010-04-04 10:37 516032 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\tb\tbsetup.exe
2010-04-04 10:57 . 2010-04-04 10:37 40960 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\sysinfo\sindinst.dll
2010-04-04 10:57 . 2010-04-04 10:37 474200 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\sysinfo\sinfinst.exe
2010-04-04 10:56 . 2010-04-04 10:37 307289 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\asp\aspcheck.dll
2010-04-04 10:56 . 2010-04-04 10:36 7083361 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\asp\aspsetup.exe
2010-04-04 10:55 . 2010-04-04 10:35 590688 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\tpspd\tssetup.exe
2010-04-04 10:55 . 2010-04-04 10:35 49152 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\vwpt\aolvpchk.dll
2010-04-04 10:55 . 2010-04-04 10:35 61440 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\vwpt\vpprepop.exe
2010-04-04 10:55 . 2010-04-04 10:34 3858056 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\vwpt\vwpt.exe
2010-04-04 10:54 . 2010-04-04 10:34 57344 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\comps\tpspd\tsverchk.dll
2010-04-04 10:50 . 2010-04-04 10:26 792664 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\setup90.exe
2010-04-04 10:42 . 2010-04-04 10:42 170 ----a-w- c:\programdata\AOL Downloads\itunes_setupSTUS\itunessetup.exe
2010-02-24 01:59 . 2010-03-06 03:40 642560 ----a-w- c:\program files\Common Files\SetupDLL.dll
2010-03-04 22:04 . 2010-03-04 21:58 2828 --sha-w- c:\windows\System32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-07-02_21.59.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-07-02 20:34 . 2010-07-02 20:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-07-02 22:14 . 2010-07-02 22:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-07-02 22:14 . 2010-07-02 22:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-07-02 20:34 . 2010-07-02 20:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-04-16 05:53 754176 ----a-w- c:\program files\Zecter\ZumoDrive\ShellExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-04-16 05:53 754176 ----a-w- c:\program files\Zecter\ZumoDrive\ShellExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-04-16 05:53 754176 ----a-w- c:\program files\Zecter\ZumoDrive\ShellExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-04-16 05:53 754176 ----a-w- c:\program files\Zecter\ZumoDrive\ShellExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-04-16 05:53 754176 ----a-w- c:\program files\Zecter\ZumoDrive\ShellExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Craig\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Craig\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Craig\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAlert"="c:\program files\MassGrid\GAlert\GAlert.exe" [2007-12-22 969728]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-17 818176]
"F.lux"="c:\users\Craig\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
"WhatPulse"="c:\program files\WhatPulse\WhatPulse.exe" [2009-04-08 2814976]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"KeyScrambler"="c:\program files\KeyScrambler\keyscrambler.exe" [2009-10-16 424688]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872]
c:\users\Craig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Craig\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Multi]
2008-04-09 22:10 90112 ----a-w- c:\program files\Stardock\ThinkDesk\Multiplicity\MultiWin32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 8.0 Tray Icon.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Craig^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Feed Notifier.lnk]
path=c:\users\Craig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Feed Notifier.lnk
backup=c:\windows\pss\Feed Notifier.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Craig^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Craig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Craig^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^WhatPulse.lnk]
path=c:\users\Craig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WhatPulse.lnk
backup=c:\windows\pss\WhatPulse.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2009-01-19 12:37 1150976 ----a-r- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamserviceDeluxe2]
2007-08-10 18:38 81920 ----a-w- c:\program files\Hercules\Deluxe Optical Glass\CamService.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdloader]
2010-02-26 23:43 50520 ----a-w- c:\users\Craig\AppData\Roaming\mjusbsp\cdloader2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2009-01-09 19:53 114688 ----a-w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Freecorder FLV Service]
2009-11-15 19:59 158752 ----a-w- c:\program files\Freecorder\FLVSrvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 16:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Multiplicity]
2008-12-13 19:56 2508080 ----a-w- c:\program files\Stardock\ThinkDesk\Multiplicity\multipl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-23 01:49 92704 ----a-w- c:\windows\System32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2010-04-05 02:32 2938552 ----a-w- c:\program files\Pando Networks\Media Booster\PMB.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 01:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2010-06-12 11:36 488968 ----a-w- c:\program files\real\realplayer\realplay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shadow Defender Daemon]
2010-02-09 02:37 253132 ----a-w- c:\program files\Shadow Defender\DefenderDaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TK8 StickyNotes]
2010-01-21 03:16 9136976 ----a-w- c:\program files\TK8 StickyNotes\TK8StickyNotes.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-06-12 11:36 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TurboHddUsb]
2010-06-10 23:08 3327488 ----a-w- c:\program files\TurboHddUsb\TurboHddUsb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wmagent.exe]
2009-10-19 11:47 210400 ----a-w- c:\program files\WebMoney Agent\wmagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-04-30 06:52 1780 ----a-w- c:\program files\Zecter\ZumoDrive\ZumoLauncher.lnk
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:8a,a0,f0,fb,69,ba,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1585551341-1056112771-599072059-1000]
"EnableNotificationsRef"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 prio_svc;Prio Service;c:\program files\Prio\prio_svc.exe [2009-09-12 5120]
R3 camfilt2;camfilt2;c:\windows\system32\DRIVERS\camfilt2.sys [2007-08-06 94720]
R3 Multiplicity;Stardock Multiplicity;c:\program files\Stardock\ThinkDesk\Multiplicity\MultiSrv32.exe [2008-02-01 242936]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-03-23 3724760]
R3 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2010-03-17 220128]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]
R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 XDva346;XDva346;c:\windows\system32\XDva346.sys [x]
R3 XDva349;XDva349;c:\windows\system32\XDva349.sys [x]
R4 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 136176]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-06 691696]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S0 diskpt;diskpt;c:\windows\SYSTEM32\drivers\diskpt.sys [2010-02-08 191432]
S0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\DRIVERS\pssnap.sys [2010-03-17 15328]
S1 CbFs;CbFs;c:\windows\system32\drivers\cbfs.sys [2010-04-16 147416]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-11-16 96408]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2010-06-10 7040]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-10-31 270888]
S1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-02-13 123280]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-02-13 41680]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-11-16 735960]
S2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
S2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
S3 FNETTBOH;FNETTBOH;c:\windows\system32\drivers\FNETTBOH.SYS [2010-06-10 17792]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2009-10-16 114928]
S3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-02-13 99152]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-02-13 110096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 10:51]
2010-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 10:51]
2010-06-29 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-06-19 19:31]
2010-06-30 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-06-19 19:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
FF - ProfilePath - c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com/
FF - component: c:\users\Craig\AppData\Roaming\Mozilla\Firefox\Profiles\1h387gke.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Opera\program\plugins\NPMetaStream3.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprjplug.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-07-02 19:22
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
[0] 0x4D000000
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(1092)
c:\program files\Zecter\ZumoDrive\ShellExt.dll
c:\users\Craig\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
Completion time: 2010-07-02 19:28:59
ComboFix-quarantined-files.txt 2010-07-02 23:28
ComboFix2.txt 2010-07-02 22:05
Pre-Run: 260,142,407,680 bytes free
Post-Run: 260,079,120,384 bytes free
- - End Of File - - 31C63C29A9B4E2AB82A020C5FCD23828