Infected with fantastigames dot com/440

Newcourt · March 23, 2013

I (foolishly) downloaded software from a sketchy site. I primarily use Opera as my browser, but when I opened Firefox and Chrome, I noticed that the homepage was changed to "hxxp://isearch.fantastigames dot com/440" (changed slightly before posting). I also had new shortcut on my desktop to files in "C:\Program Files (x86)\FGIcon", which contains "helper.dll" and a folder "Res" which contains "fantasticInst.exe" and "icon.ico". If there were other changes, they aren't immediately visible to me.

This is pretty embarassing, because I'm usually pretty tech-savvy, and people come to me for help like this... but I don't want to screw it up.

What I've done so far:

Run Kaspersky, full scan... nothing found or changed

Run Combofix (admittedly, I don't know much about this program, which now seems like a bad idea)... nothing done

At this point I decided I needed help from someone more experienced.

Run Malwarebytes, full scan... nothing found or changed, though it does block the site when I try to connect

Run DDS.scr...

DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.11.2

Run by [my name] at 15:55:08 on 2013-03-23

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.1155 [GMT -4:00]

.

AV: Kaspersky Anti-Virus *Enabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Kaspersky Anti-Virus *Enabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}

FW: Kaspersky Anti-Virus *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\FBAgent.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe

C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Intel\TurboBoost\TurboBoost.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files (x86)\WorthAveGroup\WorthTrack\WorthTrack.exe

C:\Program Files (x86)\puush\puush.exe

C:\Users\[my name]\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Users\[my name]\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe

C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe

C:\Program Files (x86)\Settings Alerter\Datamngr\datamngrUI.exe

C:\Windows\AsScrPro.exe

C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Elantech\ETDCtrlHelper.exe

C:\Windows\SysWOW64\ACEngSvr.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\wuauclt.exe

C:\Users\[my name]\AppData\Local\Genuitec\Eclipse 4.2 IDE for Java\eclipse.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files (x86)\Opera\opera.exe

C:\Windows\explorer.exe

C:\Program Files (x86)\Notepad++\notepad++.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\notepad.exe

C:\Users\[my name]\AppData\Local\Opera\Opera\temporary_downloads\HijackThis.exe

C:\Windows\explorer.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://isearch.fantastigames.com/440

mStart Page = hxxp://asus.msn.com

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

BHO: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: DataMngr: {F2D6C718-7E52-428E-8852-365C4B1A6E36} - C:\Program Files (x86)\Settings Alerter\Datamngr\BrowserConnection.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [Facebook Update] "C:\Users\[my name]\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [puush] C:\Program Files (x86)\puush\puush.exe

uRun: [spotify Web Helper] "C:\Users\[my name]\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

mRun: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

mRun: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"

mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe"

mRun: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide

mRun: [DATAMNGR] C:\PROGRA~2\SETTIN~1\Datamngr\DATAMN~1.EXE

mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\Users\[my name]\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\[my name]\AppData\Roaming\Dropbox\bin\Dropbox.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe

uPolicies-Explorer: NoDriveAutoRun = dword:0

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun_KL_notset = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6}

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

TCP: NameServer = 165.82.1.39 165.82.1.250

TCP: Interfaces\{74C3A4F2-C98B-437D-B872-68926D7DAA16} : DHCPNameServer = 165.82.1.39 165.82.1.250

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1} : DHCPNameServer = 165.82.1.39 165.82.1.250

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\14355535 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\16E6E656474756 : DHCPNameServer = 75.75.76.76 75.75.75.75

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\3427F677E6560205C616A71602C4140284162726F62702630383 : DHCPNameServer = 168.95.1.1

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\354727F6F60777166656C6 : DHCPNameServer = 10.0.0.1

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\841667562766F6274634F6E6E6563647 : DHCPNameServer = 165.82.1.39 165.82.1.250

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\841667562766F62746D27457563747 : DHCPNameServer = 165.82.1.39 165.82.1.250

TCP: Interfaces\{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}\C496D65644F6C6078696E6 : DHCPNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

AppInit_DLLs= C:\PROGRA~2\SETTIN~1\Datamngr\datamngr.dll C:\PROGRA~2\SETTIN~1\Datamngr\IEBHO.dll C:\Windows\SysWOW64\nvinit.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = hxxp://asus.msn.com

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3

x64-Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exe

x64-Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"

x64-Run: [setwallpaper] c:\programdata\SetWallpaper.cmd

x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

x64-Run: [WorthTrack] C:\Program Files (x86)\WorthAveGroup\WorthTrack\WorthTrack.exe

x64-IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6}

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\[my name]\AppData\Roaming\Mozilla\Firefox\Profiles\p7pgtu0z.default\

FF - prefs.js: browser.search.selectedEngine - Web Search

FF - prefs.js: browser.startup.homepage - hxxp://isearch.fantastigames.com/440

FF - prefs.js: keyword.URL - hxxp://isearch.fantastigames.com/web?src=ffb&gct=ds&appid=100&systemid=440&q=

FF - plugin: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\Chem3D\npChem3DPlugin.dll

FF - plugin: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\ChemDraw\NPCDP32.DLL

FF - plugin: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2615434\npmathplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll

FF - plugin: C:\Users\[my name]\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\[my name]\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: C:\Users\[my name]\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\[my name]\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\[my name]\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Users\[my name]\AppData\Roaming\Mozilla\plugins\npo1d.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: !HIDDEN! 2013-03-22 13:13; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; C:\Program Files (x86)\Settings Alerter\Datamngr\FirefoxExtension

.

============= SERVICES / DRIVERS ===============

.

R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2011-5-5 25960]

R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-7-26 17024]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2009-9-14 27736]

R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-5-5 379520]

R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

R2 AVP;Kaspersky Anti-Virus 6.0;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe [2010-3-12 311680]

R2 klnagent;Kaspersky Lab Network Agent;C:\Program Files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe [2010-10-20 141688]

R2 LVPrcS64;Process Monitor;C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe [2009-10-7 191000]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-3-23 398184]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-3-23 682344]

R2 msftesql$CSSQL05;SQL Server FullText Search (CSSQL05);C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe [2010-3-26 91992]

R2 MSSQL$CSSQL05;SQL Server (CSSQL05);C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]

R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-4-16 13832]

R2 TurboBoost;Intel® Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-4-16 134928]

R2 UMVPFSrv;UMVPFSrv;C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [2012-1-18 450848]

R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2011-4-8 138024]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-4-8 317440]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\Windows\System32\drivers\klfltdev.sys [2009-9-3 30736]

R3 LVPr2M64;Logitech LVPr2M64 Driver;C:\Windows\System32\drivers\LVPr2M64.sys [2009-10-7 30232]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-3-23 24176]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-5-5 413800]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-7-30 102240]

S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\System32\drivers\L1C62x64.sys [2009-6-10 57344]

S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\System32\drivers\lvpopf64.sys [2009-10-7 271640]

S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2012-1-18 351136]

S3 LVUVC64;Logitech QuickCam Pro 9000(UVC);C:\Windows\System32\drivers\LVUVC64.sys [2009-10-7 4865568]

S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\rtsuvstor.sys [2011-5-5 290920]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2012-7-30 203104]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-8-14 59392]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-8-13 1255736]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]

.

=============== Created Last 30 ================

.

2013-03-23 14:44:55 -------- d-----w- C:\Users\[my name]\AppData\Roaming\Malwarebytes

2013-03-23 14:44:46 -------- d-----w- C:\ProgramData\Malwarebytes

2013-03-23 14:44:45 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-23 14:44:45 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-23 14:44:29 -------- d-----w- C:\Users\[my name]\AppData\Local\Programs

2013-03-23 10:00:57 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{035C4108-4B9E-4AF4-A44F-B0B0EAFFB748}\offreg.dll

2013-03-23 03:42:06 -------- d-sh--w- C:\$RECYCLE.BIN

2013-03-23 03:12:43 98816 ----a-w- C:\Windows\sed.exe

2013-03-23 03:12:43 256000 ----a-w- C:\Windows\PEV.exe

2013-03-23 03:12:43 208896 ----a-w- C:\Windows\MBR.exe

2013-03-23 03:12:32 -------- d-----w- C:\ComboFix

2013-03-22 19:49:17 -------- d-----w- C:\ProgramData\Browser Manager

2013-03-22 17:14:00 810496 ----a-w- C:\Windows\System32\xvidcore.dll

2013-03-22 17:14:00 80896 ----a-w- C:\Windows\System32\ff_vfw.dll

2013-03-22 17:14:00 183808 ----a-w- C:\Windows\System32\xvidvfw.dll

2013-03-22 17:13:25 -------- d-----w- C:\ProgramData\Wincert

2013-03-22 17:13:07 -------- d-----w- C:\Program Files (x86)\FGIcon

2013-03-22 17:13:02 -------- d-----w- C:\Program Files (x86)\Settings Alerter

2013-03-22 17:12:19 389120 ----a-w- C:\Windows\System32\actskn43.ocx

2013-03-22 17:12:18 389120 ----a-w- C:\Windows\SysWow64\actskn43.ocx

2013-03-22 17:11:38 -------- d-----w- C:\Program Files (x86)\SplitCam

2013-03-22 11:50:29 9311288 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{035C4108-4B9E-4AF4-A44F-B0B0EAFFB748}\mpengine.dll

2013-03-10 21:59:08 -------- d-----r- C:\Program Files (x86)\Skype

.

==================== Find3M ====================

.

2013-03-13 20:43:26 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-03-13 20:43:26 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-01-17 05:28:58 273840 ------w- C:\Windows\System32\MpSigStub.exe

2013-01-14 19:51:30 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-01-14 19:51:29 859552 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll

2013-01-14 19:51:29 780192 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-01-14 19:46:09 960416 ----a-w- C:\Windows\System32\deployJava1.dll

2013-01-14 19:46:09 1081760 ----a-w- C:\Windows\System32\npDeployJava1.dll

2012-04-11 16:35:32 473 ----a-w- C:\Program Files (x86)\layout.bin

2011-08-12 21:17:27 491520 ----a-w- C:\Program Files (x86)\KLeaner_1.0.69.0.exe

2007-04-05 19:39:32 455600 ----a-w- C:\Program Files (x86)\setup.exe

2007-04-05 19:36:12 492032 ----a-w- C:\Program Files (x86)\ISSetup.dll

2006-05-17 16:21:04 164784 ----a-w- C:\Program Files (x86)\_Setup.dll

.

============= FINISH: 15:55:39.23 ===============

Attach.txt:

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 8/14/2011 1:49:48 AM

System Uptime: 3/22/2013 11:51:12 PM (16 hours ago)

.

Motherboard: ASUSTeK Computer Inc. | | K53SV

Processor: Intel® Core™ i7-2630QM CPU @ 2.00GHz | CPU 1 | 1480/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 238 GiB total, 93.665 GiB free.

D: is FIXED (NTFS) - 333 GiB total, 135.676 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP219: 2/26/2013 7:48:50 AM - Windows Update

RP220: 3/5/2013 7:49:22 AM - Windows Update

RP221: 3/13/2013 6:58:07 PM - Windows Update

RP222: 3/19/2013 7:49:33 AM - Windows Update

RP223: 3/22/2013 11:12:53 PM - ComboFix created restore point

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

??????? Windows Live Mesh ActiveX ??(????)

??????? Windows Live Mesh ActiveX ???

Adobe AIR

Adobe Community Help

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Photoshop CS5

Adobe Shockwave Player 11.6

AIM 7

Apple Application Support

Apple Software Update

ASUS AI Recovery

ASUS FancyStart

ASUS K3 Series ScreenSaver

ASUS LifeFrame3

ASUS Live Update

ASUS Power4Gear Hybrid

ASUS SmartLogon

ASUS Splendid Video Enhancement Technology

ASUS Virtual Camera

ASUS WebStorage

AsusVibe2.0

ATK Package

Audacity 1.3.13 (Unicode)

Avidemux 2.5

Bigasoft MKV Converter 3.4.14.4261

Call of Duty: Modern Warfare 3

Call of Duty: Modern Warfare 3 - Multiplayer

CambridgeSoft Activation Client

CambridgeSoft BioAssay 12.0

CambridgeSoft ChemBioOffice Ultra 2010

CambridgeSoft ChemDraw ActiveX Enterprise Constant 12.0

CambridgeSoft ChemScript 12.0

CambridgeSoft Desktop Inventory 12.0

CambridgeSoft ENotebook 12.02

Contrôle ActiveX Windows Live Mesh pour connexions à distance

Control ActiveX de Windows Live Mesh para conexiones remotas

Controlo ActiveX do Windows Live Mesh para Ligações Remotas

CyberLink LabelPrint

CyberLink Power2Go

D3DX10

DirectX Happy Uninstall v5.8

Download Updater (AOL LLC)

Dropbox

Eclipse 4.2 IDE for Java

ETDWare PS/2-X64 8.0.5.0_WHQL

Exact Audio Copy 1.0beta3

Facebook Video Calling 1.2.0.287

Fast Boot

FLAC 1.2.1b (remove only)

foobar2000 v1.1.7

Google Chrome

Google Gmail Notifier

Google Talk Plugin

Google Toolbar for Internet Explorer

Google Update Helper

Gyazo 1.0

Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)

Immortal Defense 1.1

Intel® Control Center

Intel® Processor Graphics

Intel® Turbo Boost Technology Monitor

Java 7 Update 11

Java 7 Update 13 (64-bit)

Java Auto Updater

Java SE Development Kit 7 Update 10 (64-bit)

Java™ 6 Update 37

Kaspersky Anti-Virus 6.0 for Windows Workstations

Kaspersky Lab Network Agent

LAME v3.98.3 for Audacity

Logitech Webcam Software

Malwarebytes Anti-Malware version 1.70.0.1100

Mathematica Extras 8.0 (2615434)

MestReNova LITE 5.2.5-5780

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office 2010

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft SQL Server 2005

Microsoft SQL Server 2005 (CSSQL05)

Microsoft SQL Server 2005 Tools

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft_VC80_ATL_x86

Microsoft_VC80_ATL_x86_x64

Microsoft_VC80_CRT_x86

Microsoft_VC80_CRT_x86_x64

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFC_x86_x64

Microsoft_VC80_MFCLOC_x86

Microsoft_VC80_MFCLOC_x86_x64

Microsoft_VC90_ATL_x86

Microsoft_VC90_ATL_x86_x64

Microsoft_VC90_CRT_x86

Microsoft_VC90_CRT_x86_x64

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFC_x86_x64

MilkDrop for Winamp 2x (remove only)

mIRC

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB973685)

Mumble 1.2.3

NetBeans IDE 7.2.1

Notepad++

Nuance PDF Reader

NVIDIA Control Panel 267.21

NVIDIA Graphics Driver 267.21

NVIDIA Install Application

NVIDIA Optimus 1.0.21

NVIDIA Update Components

ooVoo

Opera 12.14

Oracle VM VirtualBox 4.1.22

Origin86

PDF Settings CS5

Portal

puush

Python 2.5

Python 2.7.2 (64-bit)

QuickTime

Real Lives 2010

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Realtek USB 2.0 Reader Driver

Revo Uninstaller 1.93

Samsung Kies

SAMSUNG USB Driver for Mobile Phones

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Settings Alerter

Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002)

Skype™ 6.1

Sonic Focus

Spectro

SpheresOfChaos2012

SplitCam

Spotify

STATISTICA 8.0.725.0 CS

STATISTICA CambridgeSoft Integration

STATNOVAPDF (novaPDF Professional Server 5.4 printer)

Steam

swMSM

syncables desktop SE

System Requirements Lab CYRI

Tango

Team Fortress 2

TrueCrypt

Unity Web Player

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Ventrilo Client for Windows x64

VLC media player 1.1.11

Winamp

Winamp Detector Plug-in

WinDirStat 1.1.2

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

WinFlash

WinPcap 4.1.2

WinRAR 4.01 (64-bit)

Wireless Console 3

Wolfram Mathematica 8 for Students (M-WIN-G 8.0.4 2615565)

WorthTrack

Yahoo! Detect

Yahoo! Messenger

.

==== Event Viewer Messages From Past Week ========

.

3/23/2013 3:32:29 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer OWNER-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 9:12:39 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer H165-82-109-240 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{74C3A4F2-C98B-437D-B872-68926D7DAA16}. The master browser is stopping or an election is being forced.

3/22/2013 8:07:04 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC00264A1C9016 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 8:06:11 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC001B63B9AFB7 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 8:02:43 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer ELIZABETH-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 7:59:01 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MARINA-HP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 7:45:12 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC00264A19790A that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 12:52:39 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC58B035A82C62 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 11:46:08 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: A device attached to the system is not functioning.

3/22/2013 11:36:09 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

3/22/2013 11:34:48 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

3/22/2013 11:24:21 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 165.82.109.114. The computer with the IP address 165.82.108.191 did not allow the name to be claimed by this computer.

3/22/2013 11:10:01 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer H165-82-84-202 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 11:06:32 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC00264A0780AC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 11:03:33 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer MAC00264A15203C that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 11:02:25 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer H165-82-108-191 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{74C3A4F2-C98B-437D-B872-68926D7DAA16}. The master browser is stopping or an election is being forced.

3/22/2013 10:39:23 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer CWS-MACBOOK that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/22/2013 1:43:25 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer EMILYS-MACBOOK that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/21/2013 9:11:46 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MICHELLEMAC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/21/2013 10:19:28 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer HP-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/19/2013 10:30:10 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MALISA-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/18/2013 7:28:44 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer H165-82-108-191 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

3/17/2013 12:39:43 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer SAMKANE-HP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E6252DD7-A5C5-40FC-8F50-E1BA64E8E6F1}. The master browser is stopping or an election is being forced.

.

==== End Of File ===========================

gringo_pr · March 23, 2013

Hello Newcourt

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

Newcourt · March 23, 2013

AdwCleaner deleted a folder called Software on my desktop. I backed up everything that was important to me -- that folder wasn't -- but at one point it did have important programs in it, and it might be nice to warn that this tool will delete things without asking.

Security Check

Results of screen317's Security Check version 0.99.61

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 8 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Kaspersky Anti-Virus

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.70.0.1100

Java 6 Update 37

Java 7 Update 11

Java version out of Date!

Adobe Flash Player 11.6.602.180

Mozilla Firefox (19.0.2)

Google Chrome 25.0.1364.152

Google Chrome 25.0.1364.172

````````Process Check: objlist.exe by Laurent````````

Kaspersky Lab Kaspersky Anti-Virus 6.0 for Windows Workstations MP4 avp.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

Kaspersky Lab NetworkAgent 8 klnagent.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

AdwCleaner

# AdwCleaner v2.115 - Logfile created 03/23/2013 at 17:00:23

# Updated 17/03/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : [my name] - [my name]-ASUS

# Boot Mode : Normal

# Running from : C:\Users\[my name]\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\Browser Manager

Deleted on reboot : C:\Users\[my name]\AppData\Roaming\Mozilla\Firefox\Profiles\p7pgtu0z.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}

File Deleted : C:\Users\[my name]\AppData\Roaming\Mozilla\Firefox\Profiles\p7pgtu0z.default\searchplugins\WebSearch.xml

Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\Users\[my name]\Desktop\Software

***** [Registry] *****

Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SETTIN~1\Datamngr\x64\datamngr.dll

Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SETTIN~1\Datamngr\x64\IEBHO.dll

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SETTIN~1\Datamngr\datamngr.dll

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SETTIN~1\Datamngr\IEBHO.dll

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\DataMngr_Toolbar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll

Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Key Deleted : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard

Key Deleted : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard.1

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F2D6C718-7E52-428E-8852-365C4B1A6E36}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2D6C718-7E52-428E-8852-365C4B1A6E36}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.fantastigames.com/440 --> hxxp://www.google.com

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Users\[my name]\AppData\Roaming\Mozilla\Firefox\Profiles\p7pgtu0z.default\prefs.js

Deleted : user_pref("browser.search.defaultenginename", "Web Search");

Deleted : user_pref("browser.search.order.1", "Web Search");

Deleted : user_pref("browser.search.selectedEngine", "Web Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://isearch.fantastigames.com/440");

Deleted : user_pref("keyword.URL", "hxxp://isearch.fantastigames.com/web?src=ffb&gct=ds&appid=100&systemid=440[...]

-\\ Google Chrome v25.0.1364.172

File : C:\Users\[my name]\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.1822] : homepage = "hxxp://isearch.fantastigames.com/440",

Deleted [l.2413] : urls_to_restore_on_startup = [ "hxxp://isearch.fantastigames.com/440" ]

-\\ Opera v12.14.1738.0

File : C:\Users\[my name]\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [5301 octets] - [23/03/2013 17:00:23]

########## EOF - C:\AdwCleaner[s1].txt - [5361 octets] ##########

Rogue Killer

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Michael [Admin rights]

Mode : Scan -- Date : 03/23/2013 17:16:11

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS547564A9E384 +++++

--- User ---

[MBR] 2cf149f208af19ddc3f55dac9a5cc5d1

[bSP] da43dd12b34c7cf79279aac935e3bad9 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 244189 Mo

2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 552531968 | Size: 340688 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_03232013_02d1716.txt >>

RKreport[1]_S_03232013_02d1716.txt

gringo_pr · March 23, 2013

Hello Newcourt

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

Newcourt · March 24, 2013

ComboFix 13-03-21.02 - [my name] 03/23/2013 17:30:50.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2278 [GMT -4:00]

Running from: c:\users\[my name]\Desktop\ComboFix.exe

AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}

FW: Kaspersky Anti-Virus *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}

SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Setup.exe

c:\windows\msvcr71.dll

c:\windows\SysWow64\muzapp.exe

.

((((((((((((((((((((((((( Files Created from 2013-02-23 to 2013-03-23 )))))))))))))))))))))))))))))))

.

2013-03-23 22:01 . 2013-03-23 22:01 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-03-23 22:01 . 2013-03-23 22:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-03-23 21:00 . 2013-03-23 21:01 238 ----a-w- c:\windows\DeleteOnReboot.bat

2013-03-23 14:44 . 2013-03-23 14:44 -------- d-----w- c:\users\[my name]\AppData\Roaming\Malwarebytes

2013-03-23 14:44 . 2013-03-23 14:44 -------- d-----w- c:\programdata\Malwarebytes

2013-03-23 14:44 . 2013-03-23 14:44 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-03-23 14:44 . 2012-12-14 20:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-23 14:44 . 2013-03-23 14:44 -------- d-----w- c:\users\[my name]\AppData\Local\Programs

2013-03-23 10:00 . 2013-03-23 21:23 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{035C4108-4B9E-4AF4-A44F-B0B0EAFFB748}\offreg.dll

2013-03-22 19:49 . 2013-03-22 19:49 -------- d-----w- c:\programdata\Browser Manager

2013-03-22 17:14 . 2012-01-03 07:03 810496 ----a-w- c:\windows\system32\xvidcore.dll

2013-03-22 17:14 . 2012-01-03 07:03 80896 ----a-w- c:\windows\system32\ff_vfw.dll

2013-03-22 17:14 . 2012-01-03 07:03 183808 ----a-w- c:\windows\system32\xvidvfw.dll

2013-03-22 17:13 . 2013-03-22 17:13 -------- d-----w- c:\programdata\Wincert

2013-03-22 17:13 . 2013-03-22 17:13 -------- d-----w- c:\program files (x86)\FGIcon

2013-03-22 17:13 . 2013-03-22 17:13 -------- d-----w- c:\program files (x86)\Settings Alerter

2013-03-22 17:12 . 2012-01-03 07:03 389120 ----a-w- c:\windows\system32\actskn43.ocx

2013-03-22 17:12 . 2012-01-03 07:03 389120 ----a-w- c:\windows\SysWow64\actskn43.ocx

2013-03-22 17:11 . 2013-03-22 17:14 -------- d-----w- c:\program files (x86)\SplitCam

2013-03-22 11:50 . 2013-03-15 06:28 9311288 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{035C4108-4B9E-4AF4-A44F-B0B0EAFFB748}\mpengine.dll

2013-03-10 21:59 . 2013-03-10 21:59 -------- d-----w- c:\program files (x86)\Common Files\Skype

2013-03-10 21:59 . 2013-03-10 21:59 -------- d-----r- c:\program files (x86)\Skype

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-23 21:04 . 2011-05-05 06:17 45056 ----a-w- c:\windows\system32\acovcnt.exe

2013-03-13 20:43 . 2012-06-24 05:48 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-03-13 20:43 . 2011-12-26 18:50 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-01-17 05:28 . 2011-08-14 10:33 273840 ------w- c:\windows\system32\MpSigStub.exe

2013-01-14 19:51 . 2013-01-14 19:51 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-01-14 19:51 . 2012-12-04 03:39 859552 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2013-01-14 19:51 . 2011-08-20 06:15 780192 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-01-14 19:46 . 2012-12-21 06:17 960416 ----a-w- c:\windows\system32\deployJava1.dll

2013-01-14 19:46 . 2012-12-21 06:17 1081760 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-04-11 16:35 . 2005-06-29 05:09 473 ----a-w- c:\program files (x86)\layout.bin

2011-08-12 21:17 . 2011-08-18 18:35 491520 ----a-w- c:\program files (x86)\KLeaner_1.0.69.0.exe

2007-04-05 19:36 . 2005-06-29 05:08 492032 ----a-w- c:\program files (x86)\ISSetup.dll

2006-05-17 16:21 . 2005-06-29 05:08 164784 ----a-w- c:\program files (x86)\_Setup.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\users\[my name]\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]

"puush"="c:\program files (x86)\puush\puush.exe" [2012-04-16 565480]

"Spotify Web Helper"="c:\users\[my name]\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-06-30 932528]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe" [2010-03-13 311680]

"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]

.

c:\users\[my name]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\[my name]\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-2-3 548528]

FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2011-5-5 12862]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux7"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-07-30 102240]

R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]

R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [2009-10-07 271640]

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]

R3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]

R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-13 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-02-21 25960]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-08-27 27736]

S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2012-09-07 224088]

S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2012-09-07 130904]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2011-03-03 379520]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 klnagent;Kaspersky Lab Network Agent;c:\program files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe [2010-10-20 141688]

S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 msftesql$CSSQL05;SQL Server FullText Search (CSSQL05);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe [2010-03-26 91992]

S2 MSSQL$CSSQL05;SQL Server (CSSQL05);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]

S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832]

S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-12-13 138024]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2009-09-03 30736]

S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2009-10-07 30232]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]

S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2012-09-07 147288]

S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2012-09-07 166232]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-13 20:08 1629648 ----a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-24 20:43]

.

2013-03-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3276296755-3651389003-277607100-1001Core.job

- c:\users\[my name]\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-20 03:18]

.

2013-03-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3276296755-3651389003-277607100-1001UA.job

- c:\users\[my name]\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-20 03:18]

.

2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 13:57]

.

2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 13:57]

.

2013-03-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3276296755-3651389003-277607100-1001Core.job

- c:\users\[my name]\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-25 18:55]

.

2013-03-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3276296755-3651389003-277607100-1001UA.job

- c:\users\[my name]\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-25 18:55]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\[my name]\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]

"ETDCtrl"="c:\program files (x86)\Elantech\ETDCtrl.exe" [bU]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"Setwallpaper"="c:\programdata\SetWallpaper.cmd" [bU]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"WorthTrack"="c:\program files (x86)\WorthAveGroup\WorthTrack\WorthTrack.exe" [2010-08-05 49152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll c:\windows\System32\nvinitx.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mStart Page = hxxp://asus.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 165.82.1.39 165.82.1.250

FF - ProfilePath - c:\users\[my name]\AppData\Roaming\Mozilla\Firefox\Profiles\p7pgtu0z.default\

FF - ExtSQL: !HIDDEN! 2013-03-22 13:13; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql$CSSQL05]

"ImagePath"="\"c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:CSSQL05"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-03-23 18:15:13

ComboFix-quarantined-files.txt 2013-03-23 22:15

ComboFix2.txt 2013-03-23 03:47

.

Pre-Run: 116,524,494,848 bytes free

Post-Run: 116,216,066,048 bytes free

.

- - End Of File - - DE93D7A6FF5074A169833E6BB7E044DB

The computer is performing fine, but it always was.

However, Firefox still tries to go to the same fantastigames page, and those "FGIcon" files are still in Program Files. I haven't tried to manually remove anything. The malware that I downloaded was Splitcam, which shows up with several other files like FGIcon in the Combofix log.

gringo_pr · March 24, 2013

Hello Newcourt

I want you to reset firefox back to defaults, this will remove everything from Firefox

I will let you keep your bookmarks so to do that you can go here - Export BookMarks

Now to reset firefox do the following.

At the top of the Firefox window, click the "Firefox" button,
go over to the "Help" sub-menu
- (on Windows XP, click the Help menu at the top of the Firefox window) and select "Troubleshooting Information".

[*]Click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.

[*]click "Reset Firefox" in the confirmation window that opens.

[*]Firefox will close and be reset. When it's done. Click "Finish" and Firefox will open.

restart the computer and check firefox for me now

Gringo

Newcourt · March 24, 2013

I've done that. Firefox is now fixed.

Should I manually remove Splitcam and all the files that the Combofix log said were associated with the Splitcam download?

Thank you very much for all your help, by the way!

gringo_pr · March 24, 2013

Hello Newcourt

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Folder::
c:\programdata\Browser Manager
c:\program files (x86)\Settings Alerter
c:\programdata\Wincert
c:\program files (x86)\SplitCam

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

Newcourt · March 24, 2013

ComboFix 13-03-23.01 - [my name] 03/24/2013 2:24.3.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2238 [GMT -4:00]

Running from: c:\users\[my name]\Desktop\ComboFix.exe

Command switches used :: c:\users\[my name]\Desktop\CFScript.txt

AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}

FW: Kaspersky Anti-Virus *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}

SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Settings Alerter

c:\program files (x86)\Settings Alerter\Datamngr\BrowserConnection.dll

c:\program files (x86)\Settings Alerter\Datamngr\datamngr.dll

c:\program files (x86)\Settings Alerter\Datamngr\datamngrUI.exe

c:\program files (x86)\Settings Alerter\Datamngr\DnsBHO.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\chrome.manifest

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\chrome.manifest.alt

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF10.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF11.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF12.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF13.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF14.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF15.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF16.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF17.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF18.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF19.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF4.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF5.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF6.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF7.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF8.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\components\DataMngrHlpFF9.dll

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\DataMngr.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\DnsBHO.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\Error404BHO.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\NewTabBHO.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\overlay.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\overlay.xul

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\RelatedSearch.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\RequestPreserver.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\SearchBHO.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\SettingManager.js

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\Settings.xml

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\content\Settings.xml.alt

c:\program files (x86)\Settings Alerter\Datamngr\FirefoxExtension\install.rdf

c:\program files (x86)\Settings Alerter\Datamngr\IEBHO.dll

c:\program files (x86)\Settings Alerter\Datamngr\installhelper.dll

c:\program files (x86)\Settings Alerter\Datamngr\x64\BrowserConnection.dll

c:\program files (x86)\Settings Alerter\Datamngr\x64\datamngr.dll

c:\program files (x86)\Settings Alerter\Datamngr\x64\DnsBHO.dll

c:\program files (x86)\Settings Alerter\Datamngr\x64\IEBHO.dll

c:\program files (x86)\Settings Alerter\sysid.ini

c:\program files (x86)\Settings Alerter\uninstall.exe

c:\program files (x86)\SplitCam

c:\program files (x86)\SplitCam\Adver.gif

c:\program files (x86)\SplitCam\cv110.dll

c:\program files (x86)\SplitCam\cxcore110.dll

c:\program files (x86)\SplitCam\data\haarcascades\haarcascade_frontalface_alt2.xml

c:\program files (x86)\SplitCam\data\haarcascades\LEye.xml

c:\program files (x86)\SplitCam\data\haarcascades\Mouth.xml

c:\program files (x86)\SplitCam\data\haarcascades\Nose.xml

c:\program files (x86)\SplitCam\data\haarcascades\REye.xml

c:\program files (x86)\SplitCam\drvPkg\SplitCamAudio.inf

c:\program files (x86)\SplitCam\drvPkg\SplitCamAudio_amd64.sys

c:\program files (x86)\SplitCam\drvPkg\SplitCamAudio_x86.sys

c:\program files (x86)\SplitCam\DSFilters\Decoding\avisplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_kernelDeint.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_liba52.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_libdts.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_libfaad2.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_libmad.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_samplerate.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_unrar.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ff_wmv9.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ffdshow.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\ffdshow.ax.manifest

c:\program files (x86)\SplitCam\DSFilters\Decoding\ffmpeg.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ffmpegmt.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\ffvdub.vdf

c:\program files (x86)\SplitCam\DSFilters\Decoding\FLT_ffdshow.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\FLVSplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\gnu.reg

c:\program files (x86)\SplitCam\DSFilters\Decoding\libmpeg2_ff.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\MatroskaSplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\mmaacd.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\mmamr.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\mmmpcdec.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\mmmpcdmx.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\MP4Splitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\MpegSplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\OggSplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\RealMediaSplitter.ax

c:\program files (x86)\SplitCam\DSFilters\Decoding\reg.bat

c:\program files (x86)\SplitCam\DSFilters\Decoding\TomsMoComp_ff.dll

c:\program files (x86)\SplitCam\DSFilters\Decoding\vp7dec.ax

c:\program files (x86)\SplitCam\DSFilters\Encoding\Driver32.reg

c:\program files (x86)\SplitCam\DSFilters\Encoding\drivers.desc.reg

c:\program files (x86)\SplitCam\DSFilters\Encoding\ff_vfw.dll

c:\program files (x86)\SplitCam\DSFilters\Encoding\ff_vfw.dll.manifest

c:\program files (x86)\SplitCam\DSFilters\Encoding\icm.reg

c:\program files (x86)\SplitCam\DSFilters\Encoding\reg.bat

c:\program files (x86)\SplitCam\DSFilters\Encoding\xvidcore.dll

c:\program files (x86)\SplitCam\DSFilters\Encoding\xvidhide.reg

c:\program files (x86)\SplitCam\DSFilters\Encoding\xvidvfw.dll

c:\program files (x86)\SplitCam\Filter.png

c:\program files (x86)\SplitCam\highgui110.dll

c:\program files (x86)\SplitCam\img\Avatars\avatar2.sc

c:\program files (x86)\SplitCam\img\Avatars\avatar2.scs

c:\program files (x86)\SplitCam\img\Avatars\kanny1.sc

c:\program files (x86)\SplitCam\img\Avatars\kanny1.scs

c:\program files (x86)\SplitCam\img\Avatars\obama1.sc

c:\program files (x86)\SplitCam\img\Avatars\obama1.scs

c:\program files (x86)\SplitCam\img\Avatars\obama2.sc

c:\program files (x86)\SplitCam\img\Avatars\obama2.scs

c:\program files (x86)\SplitCam\img\Avatars\southpark1.sc

c:\program files (x86)\SplitCam\img\Avatars\southpark1.scs

c:\program files (x86)\SplitCam\img\Avatars\southpark2.sc

c:\program files (x86)\SplitCam\img\Avatars\southpark2.scs

c:\program files (x86)\SplitCam\img\Avatars\southpark3.sc

c:\program files (x86)\SplitCam\img\Avatars\southpark3.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Home.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Home.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Hot girl.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Hot girl.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\[my name] Jackson.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\[my name] Jackson.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Rocks&river.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Dynamic\Rocks&river.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\BluePalms.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\BluePalms.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\City1.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\City1.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\City2.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\City2.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\Flowers1.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\Flowers1.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\GreenNature.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\GreenNature.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\Sunset1.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\Sunset1.scs

c:\program files (x86)\SplitCam\img\Backgrounds\Static\YellowDelphines.sc

c:\program files (x86)\SplitCam\img\Backgrounds\Static\YellowDelphines.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Angus.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Angus.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Angus\Angus.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Butt.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Butt.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Butt\Butt.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Butt\BUTTBODY.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Butt\BUTTFACE.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Butt\BUTTWIBA.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Butt\BUTTWIFR.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Clone Helmet.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Clone Helmet.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Clone Helmet\Clone Helmet.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Darth Vader.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Darth Vader.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Darth Vader\Darth Vader.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Dog.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Dog.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Dog\Dog.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Elephant.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Elephant.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Elephant\Elephant.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Elephant\ELETUSK.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Elephant\ELPHSKIN.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Flamingo.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Flamingo.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Flamingo\Flamingo.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Flamingo\FLAMNT.JPG

c:\program files (x86)\SplitCam\img\Faces\3d\Kenny.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Kenny.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Kenny\Kenny.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Scorpion.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Scorpion.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Scorpion\Scorpion.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Skull.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Skull.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Skull\Skull.3ds

c:\program files (x86)\SplitCam\img\Faces\3d\Space.sc

c:\program files (x86)\SplitCam\img\Faces\3d\Space.scs

c:\program files (x86)\SplitCam\img\Faces\3d\Space\Space.3ds

c:\program files (x86)\SplitCam\img\Faces\Ears\Ears1.sc

c:\program files (x86)\SplitCam\img\Faces\Ears\Ears1.scs

c:\program files (x86)\SplitCam\img\Faces\Ears\Ears2.sc

c:\program files (x86)\SplitCam\img\Faces\Ears\Ears2.scs

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows1.sc

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows1.scs

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows2.sc

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows2.scs

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows3.sc

c:\program files (x86)\SplitCam\img\Faces\Eyebrows\Eyebrows3.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Colored eyes.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Colored eyes.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Diver.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Diver.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses1.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses1.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses2.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses2.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses3.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses3.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses4.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeGlasses4.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeMask.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\EyeMask.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Eyes.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Eyes.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Lizard eyes.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Lizard eyes.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Monkey eyes.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Monkey eyes.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Sad eyes.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Sad eyes.scs

c:\program files (x86)\SplitCam\img\Faces\Eyes\Terminator.sc

c:\program files (x86)\SplitCam\img\Faces\Eyes\Terminator.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Cornerhat.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Cornerhat.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Horn.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Horn.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\miss Marple.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\miss Marple.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Napoleon.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Napoleon.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Nimbus.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Nimbus.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Pile of stuff.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Pile of stuff.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Sombrero.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Sombrero.scs

c:\program files (x86)\SplitCam\img\Faces\Hats\Witch.sc

c:\program files (x86)\SplitCam\img\Faces\Hats\Witch.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Ass face.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Ass face.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Dr. Haus.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Dr. Haus.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\GazMask.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\GazMask.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Light glasses.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Light glasses.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Monkey.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Monkey.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Mouth.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Mouth.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Pumpkin.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Pumpkin.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Rabbit.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Rabbit.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Saw.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Saw.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Scare smile.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Scare smile.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Scream.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Scream.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\SpiderMan.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\SpiderMan.scs

c:\program files (x86)\SplitCam\img\Faces\Masks\Tusks.sc

c:\program files (x86)\SplitCam\img\Faces\Masks\Tusks.scs

c:\program files (x86)\SplitCam\img\Faces\Noses\Nose 1.sc

c:\program files (x86)\SplitCam\img\Faces\Noses\Nose 1.scs

c:\program files (x86)\SplitCam\img\Faces\Noses\Nose with ring.sc

c:\program files (x86)\SplitCam\img\Faces\Noses\Nose with ring.scs

c:\program files (x86)\SplitCam\img\Faces\Noses\Snout.sc

c:\program files (x86)\SplitCam\img\Faces\Noses\Snout.scs

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig1.sc

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig1.scs

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig2.sc

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig2.scs

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig3.sc

c:\program files (x86)\SplitCam\img\Faces\Wigs\Wig3.scs

c:\program files (x86)\SplitCam\img\Filters\BlackAndWhite.sc

c:\program files (x86)\SplitCam\img\Filters\BlackAndWhite.scs

c:\program files (x86)\SplitCam\img\Filters\BlackContours.sc

c:\program files (x86)\SplitCam\img\Filters\BlackContours.scs

c:\program files (x86)\SplitCam\img\Filters\BlackGradient.sc

c:\program files (x86)\SplitCam\img\Filters\BlackGradient.scs

c:\program files (x86)\SplitCam\img\Filters\BlueContours.sc

c:\program files (x86)\SplitCam\img\Filters\BlueContours.scs

c:\program files (x86)\SplitCam\img\Filters\BlueGradient.sc

c:\program files (x86)\SplitCam\img\Filters\BlueGradient.scs

c:\program files (x86)\SplitCam\img\Filters\Bubbles.sc

c:\program files (x86)\SplitCam\img\Filters\Bubbles.scs

c:\program files (x86)\SplitCam\img\Filters\Deinterlace.sc

c:\program files (x86)\SplitCam\img\Filters\Deinterlace.scs

c:\program files (x86)\SplitCam\img\Filters\Diffuse.sc

c:\program files (x86)\SplitCam\img\Filters\Diffuse.scs

c:\program files (x86)\SplitCam\img\Filters\Fire.sc

c:\program files (x86)\SplitCam\img\Filters\Fire.scs

c:\program files (x86)\SplitCam\img\Filters\FlipHorizontal.sc

c:\program files (x86)\SplitCam\img\Filters\FlipHorizontal.scs

c:\program files (x86)\SplitCam\img\Filters\FlipVertical.sc

c:\program files (x86)\SplitCam\img\Filters\FlipVertical.scs

c:\program files (x86)\SplitCam\img\Filters\GoldStars.sc

c:\program files (x86)\SplitCam\img\Filters\GoldStars.scs

c:\program files (x86)\SplitCam\img\Filters\GreenContours.sc

c:\program files (x86)\SplitCam\img\Filters\GreenContours.scs

c:\program files (x86)\SplitCam\img\Filters\GreenGradient.sc

c:\program files (x86)\SplitCam\img\Filters\GreenGradient.scs

c:\program files (x86)\SplitCam\img\Filters\Negative.sc

c:\program files (x86)\SplitCam\img\Filters\Negative.scs

c:\program files (x86)\SplitCam\img\Filters\OldMovie.sc

c:\program files (x86)\SplitCam\img\Filters\OldMovie.scs

c:\program files (x86)\SplitCam\img\Filters\RedContours.sc

c:\program files (x86)\SplitCam\img\Filters\RedContours.scs

c:\program files (x86)\SplitCam\img\Filters\RedGradient.sc

c:\program files (x86)\SplitCam\img\Filters\RedGradient.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowBlack.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowBlack.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowBlue.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowBlue.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowGreen.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowGreen.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowImage.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowImage.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowRed.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowRed.scs

c:\program files (x86)\SplitCam\img\Filters\ShadowWhite.sc

c:\program files (x86)\SplitCam\img\Filters\ShadowWhite.scs

c:\program files (x86)\SplitCam\img\Filters\Snow.sc

c:\program files (x86)\SplitCam\img\Filters\Snow.scs

c:\program files (x86)\SplitCam\img\Filters\WhiteContours.sc

c:\program files (x86)\SplitCam\img\Filters\WhiteContours.scs

c:\program files (x86)\SplitCam\img\Filters\WhiteGradient.sc

c:\program files (x86)\SplitCam\img\Filters\WhiteGradient.scs

c:\program files (x86)\SplitCam\img\Frames\Frame1.sc

c:\program files (x86)\SplitCam\img\Frames\Frame1.scs

c:\program files (x86)\SplitCam\img\Frames\Frame2.sc

c:\program files (x86)\SplitCam\img\Frames\Frame2.scs

c:\program files (x86)\SplitCam\img\Frames\Frame3.sc

c:\program files (x86)\SplitCam\img\Frames\Frame3.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Argentina.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Argentina.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Australia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Australia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Austria.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Austria.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Belgium.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Belgium.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Bosnia-&-Herzegovina.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Bosnia-&-Herzegovina.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Brazil.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Brazil.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\France.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\France.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Germany.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Germany.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Italy.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Italy.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Russia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Russia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Turkey.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\Turkey.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\United-Kingdom.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\United-Kingdom.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\United-States.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Dynamic\United-States.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Australia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Australia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Australia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Australia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Austria - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Austria - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Austria.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Austria.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Brazil - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Brazil - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Brazil.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Brazil.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Canada - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Canada - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Canada.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Canada.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\China - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\China - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\China.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\China.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Czech Republic - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Czech Republic - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Czech Republic.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Czech Republic.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Denmark - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Denmark - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Denmark.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Denmark.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\England - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\England - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\England.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\England.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\European Union - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\European Union - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Finland - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Finland - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Finland.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Finland.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\France - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\France - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\France.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\France.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Germany - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Germany - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Germany.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Germany.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Greece - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Greece - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Greece.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Greece.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Hungary - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Hungary - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Hungary.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Hungary.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\India - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\India - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\India.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\India.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Israel - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Israel - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Israel.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Israel.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Italy - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Italy - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Italy.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Italy.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Japan - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Japan - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Japan.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Japan.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Macedonia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Macedonia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Macedonia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Macedonia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Mexico - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Mexico - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Mexico.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Mexico.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Netherlands - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Netherlands - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Netherlands.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Netherlands.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\North Korea - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\North Korea - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\North Korea.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\North Korea.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Norway - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Norway - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Norway.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Norway.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Poland - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Poland - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Poland.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Poland.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Portugal - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Portugal - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Portugal.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Portugal.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Romania - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Romania - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Romania.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Romania.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Russia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Russia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Russian Federation.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Russian Federation.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Scotland - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Scotland - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Serbia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Serbia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Serbia and Montenegro.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Serbia and Montenegro.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovakia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovakia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovakia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovakia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovenia - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovenia - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovenia.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Slovenia.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Africa - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Africa - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Africa.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Africa.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Korea - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Korea - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Korea.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\South Korea.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Spain - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Spain - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Spain.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Spain.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Sweden - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Sweden - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Sweden.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Sweden.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Switzerland - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Switzerland - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Switzerland.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Switzerland.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Turkey - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Turkey - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Turkey.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\Turkey.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Arab Emirates - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Arab Emirates - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Arab Emirates.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Arab Emirates.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Kingdom - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Kingdom - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Kingdom.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United Kingdom.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United States - Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United States - Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United States of America.sc

c:\program files (x86)\SplitCam\img\Objects\Flags\Static\United States of America.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Basketball.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Basketball.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Bone.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Bone.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Cat and mouse.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Cat and mouse.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Cup.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Cup.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Elephant.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Elephant.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Elk.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Elk.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Jumping-Cat.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Jumping-Cat.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Kiss me .sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Kiss me .scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\LOVE.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\LOVE.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Plain.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Plain.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Planet.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Planet.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Rose.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Rose.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Simpson.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\Simpson.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile_angel.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile_angel.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile_sad.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile_sad.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile2.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile2.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile3.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile3.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile4.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\smile4.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\World.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Dynamic\World.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 1.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 1.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 2.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 2.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 3.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\American_Football 3.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Cat smile.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Cat smile.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Cookies.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Cookies.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 1.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 1.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 2.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 2.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 3.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 3.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 4.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 4.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 5.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 5.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 6.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Earth 6.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 1.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 1.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 2.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 2.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 3.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 3.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 4.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Flower 4.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Gingerbread_Man.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Gingerbread_Man.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Grass.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Grass.scs

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Kiss.sc

c:\program files (x86)\SplitCam\img\Objects\Fun\Static\Kiss.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\April_fool 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Easter 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\July_4th 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\July_4th 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\July_4th 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\July_4th 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Dynamic\Valentines_day 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Angel.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Angel.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Ball 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Ball 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Ball 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Ball 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Bell 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Cake 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Cake 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candle 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candle 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candle 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candle 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Candy 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Cookie.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Cookie.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 7.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 7.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 8.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Decoration 8.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Deer 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Elf.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Elf.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_House 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 5.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 5.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 6.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 6.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 7.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Santa 7.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowglobe 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowglobe 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowglobe 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowglobe 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowman 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowman 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowman 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Snowman 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Sock 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 5.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 5.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 6.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 6.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 7.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 7.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 8.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Christmas_Tree 8.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Basket.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Basket.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Bunny 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Candy.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Candy.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Church.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Church.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Egg.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Easter_Egg.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Gift_Box 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Cat 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Cat 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Cat 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Cat 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Devil.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Devil.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 5.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Halloween_Pumpkin 5.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Gift 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Gift 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Gift 2 .sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Gift 2 .scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 1.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 1.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 2.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 2.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 3.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 3.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 4.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 4.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 5.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 5.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 6.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 6.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 7.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 7.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 8.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 8.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 9.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart 9.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart_Candy.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Heart_Candy.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Letter.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Letter.scs

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Ring.sc

c:\program files (x86)\SplitCam\img\Objects\Holyday\Static\Valentines_Ring.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\American Football.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\American Football.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Bowling.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Bowling.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Cricket.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Cricket.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Cup.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Cup.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Football.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Football.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Punchbag.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Punchbag.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Spinamfoot.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Spinamfoot.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Tennis.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Dynamic\Tennis.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\BasketBall Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\BasketBall Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Boxing_Gloves.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Boxing_Gloves.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Golf ball.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Golf ball.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Gymnastics.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Gymnastics.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Hockey.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Hockey.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Motorsport_Helmet.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Motorsport_Helmet.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Racing car.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Racing car.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Soccer_Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Soccer_Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Table_tennis.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Table_tennis.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Tennis_Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Tennis_Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Volleyball_Ball.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\Volleyball_Ball.scs

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\World Champion.sc

c:\program files (x86)\SplitCam\img\Objects\Sport\Static\World Champion.scs

c:\program files (x86)\SplitCam\license.txt

c:\program files (x86)\SplitCam\SetupProc_x64.exe

c:\program files (x86)\SplitCam\SetupProc_x86.exe

c:\program files (x86)\SplitCam\SplitCam.chm

c:\program files (x86)\SplitCam\SplitCam.exe

c:\program files (x86)\SplitCam\SplitCam.log

c:\program files (x86)\SplitCam\SplitCam.skn

c:\program files (x86)\SplitCam\SplitCamFilter.ax

c:\program files (x86)\SplitCam\startmenu.reg

c:\program files (x86)\SplitCam\Support.dll

c:\program files (x86)\SplitCam\uninstaller.exe

c:\program files (x86)\SplitCam\XmlReq.dat

c:\programdata\Browser Manager

c:\programdata\Wincert

c:\programdata\Wincert\win32cert.dll

c:\programdata\Wincert\win32prop.dll

c:\programdata\Wincert\win64cert.dll

c:\programdata\Wincert\win64prop.dll

.

((((((((((((((((((((((((( Files Created from 2013-02-24 to 2013-03-24 )))))))))))))))))))))))))))))))

.

2013-03-24 06:56 . 2013-03-24 06:56 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-03-24 06:56 . 2013-03-24 06:56 -------- d-----w- c:\users\Default\AppData\Local\temp