Spyware / Malware / Virus Removal

[Closed] Problem with stability of my computer

6 min read

Looking for the outcome? Ask AI

EFST031692 Topic Starter

Post #1December 16, 2009, 2:16 PM UTC

ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/16 22:15 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF56DC000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79D1000 Size: 8192 File Visible: No Signed: - Status: - Name: lortm.sys Image Path: C:\WINDOWS\system32\drivers\lortm.sys Address: 0xF7A35000 Size: 5024 File Visible: No Signed: - Status: - Name: pout.sys Image Path: pout.sys Address: 0xF74A3000 Size: 54016 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xEB6BF000 Size: 49152 File Visible: No Signed: - Status: - ==EOF== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 22:14:01.75 on Wed 12/16/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.475 [GMT 0:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\S3trayp.exe C:\WINDOWS\system32\A8587C\139AEC.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\TEMP\lgiwkl.exe C:\WINDOWS\TEMP\jrcf.exe C:\WINDOWS\explorer.exe D:\RFPoA\UpdateRFPoA.EXE C:\DOCUME~1\EFST03~1\LOCALS~1\Temp\ylhyc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\EFST031692\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uWindow Title = Service Pack 3 Internet Explorer uStart Page = hxxp://www.ask.com?o=15161&l=dis mWinlogon: SfcDisable=-99 (0xffffff9d) BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [Google Update] "c:\documents and settings\efst031692\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [VTTimer] VTTimer.exe mRun: [S3Trayp] S3trayp.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [ats] c:\windows\system32\asd\loadqm.exe noshow mRun: [139AEC] c:\windows\system32\a8587c\139AEC.EXE dRunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe StartupFolder: c:\docume~1\efst03~1\startm~1\programs\startup\139aec.lnk - c:\windows\system32\a8587c\139AEC.EXE StartupFolder: c:\docume~1\efst03~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\docume~1\efst03~1\startm~1\programs\startup\transbar.lnk - c:\windows\bricopacks\vista inspirat 2\transbar\TransBar.exe StartupFolder: c:\docume~1\efst03~1\startm~1\programs\startup\y'zsha~1.lnk - c:\windows\bricopacks\vista inspirat 2\yzshadow\YzShadow.exe uPolicies-explorer: DisallowRun = 1 (0x1) uPolicies-system: DisableRegistryTools = 1 (0x1) uPolicies-system: DisableTaskMgr = 1 (0x1) mPolicies-system: EnableLUA = 0 (0x0) dPolicies-system: DisableTaskMgr = 1 (0x1) dPolicies-system: DisableRegistryTools = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\efst03~1\applic~1\mozilla\firefox\profiles\lx64y3t8.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15161&l=dis FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - plugin: c:\documents and settings\efst031692\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\lortm.sys –> c:\windows\system32\drivers\lortm.sys [?] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2009-12-14 714240] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-12-14 1691480] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\efst03~1\locals~1\temp\cktc7.tmp –> c:\docume~1\efst03~1\locals~1\temp\CKTC7.tmp [?] =============== Created Last 30 ================ 2009-12-16 15:54 –d—– c:\docume~1\efst03~1\applic~1\Malwarebytes 2009-12-16 15:54 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-16 15:54 19,160 a——- c:\windows\system32\drivers\mbam.sys 2009-12-16 15:54 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-12-16 15:54 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-12-16 15:36 –d—– c:\program files\Ask.com 2009-12-16 11:58 –d-h— c:\windows\system32\A8587C 2009-12-16 11:58 –d-h— c:\windows\system32\8060D2 2009-12-16 11:58 –d-h— c:\windows\system32\76F607 2009-12-16 11:58 –d-h— c:\windows\system32\04E834 2009-12-16 08:11 7,552 a——- c:\windows\system32\drivers\MSKSSRV.sys 2009-12-16 08:11 7,552 a——- c:\windows\system32\dllcache\mskssrv.sys 2009-12-16 08:11 –d—– c:\docume~1\efst03~1\applic~1\mjusbsp 2009-12-16 08:11 60,032 a——- c:\windows\system32\drivers\USBAUDIO.sys 2009-12-16 08:11 60,032 a——- c:\windows\system32\dllcache\usbaudio.sys 2009-12-16 08:11 32,128 a——- c:\windows\system32\drivers\usbccgp.sys 2009-12-16 08:11 32,128 a——- c:\windows\system32\dllcache\usbccgp.sys 2009-12-15 23:13 –d—– c:\program files\Garena 2009-12-15 21:19 7,552 a——- c:\windows\system32\drivers\SONYPVU1.SYS 2009-12-15 21:19 7,552 a——- c:\windows\system32\dllcache\sonypvu1.sys 2009-12-15 21:19 26,368 a——- c:\windows\system32\dllcache\usbstor.sys 2009-12-15 18:06 54,156 a—h— c:\windows\QTFont.qfn 2009-12-15 18:06 1,409 a——- c:\windows\QTFont.for 2009-12-15 15:46 4 a——- c:\windows\system32\microday08.dll 2009-12-15 15:46 70 a——- c:\windows\system32\mypath0079.dll 2009-12-15 15:46 34 a——- c:\windows\system32\MTX0CI.dll 2009-12-15 15:45 –dsh— c:\windows\system32\asd 2009-12-15 15:45 –d—– c:\program files\Accurate Shutdown 2009-12-15 14:29 –d—– c:\windows\system32\xircom 2009-12-15 14:29 –d—– c:\windows\system32\wbem\snmp 2009-12-15 14:29 –d—– c:\program files\msn gaming zone 2009-12-15 14:29 –d—– c:\program files\common files\speechengines 2009-12-15 13:44 1,089,593 ——– c:\windows\system32\dllcache\ntprint.cat 2009-12-15 08:45 –d—– c:\program files\Messenger 2009-12-15 08:45 –d—– c:\windows\system32\scripting 2009-12-15 08:45 –d—– c:\windows\system32\en 2009-12-15 08:45 –d—– c:\windows\system32\bits 2009-12-15 08:45 –d—– c:\windows\l2schemas 2009-12-15 08:43 –d—– c:\windows\ServicePackFiles 2009-12-15 08:41 –d—– c:\windows\network diagnostic 2009-12-15 08:40 –d—– c:\windows\system32\ReinstallBackups 2009-12-15 08:25 53,248 ——– c:\windows\system32\tsgqec.dll 2009-12-15 08:24 46,592 ——– c:\windows\system32\drivers\irbus.sys 2009-12-15 02:47 –d—– c:\windows\system32\XPSViewer 2009-12-15 02:46 1,676,288 ——– c:\windows\system32\xpssvcs.dll 2009-12-15 02:46 1,676,288 ——– c:\windows\system32\dllcache\xpssvcs.dll 2009-12-15 02:46 597,504 ——– c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-12-15 02:46 575,488 ——– c:\windows\system32\xpsshhdr.dll 2009-12-15 02:46 575,488 ——– c:\windows\system32\dllcache\xpsshhdr.dll 2009-12-15 02:46 117,760 ——– c:\windows\system32\prntvpt.dll 2009-12-15 02:46 89,088 ——– c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-12-15 02:44 –d—– c:\program files\MSXML 6.0 2009-12-14 22:46 –dsh— c:\documents and settings\efst031692\PrivacIE 2009-12-14 21:24 –d—– c:\program files\Windows Media Connect 2 2009-12-14 21:21 –d—– c:\windows\system32\LogFiles 2009-12-14 21:09 –dsh— c:\documents and settings\efst031692\IETldCache 2009-12-14 21:02 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll 2009-12-14 21:02 594,432 ——– c:\windows\system32\dllcache\msfeeds.dll 2009-12-14 21:02 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll 2009-12-14 21:02 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll 2009-12-14 21:02 12,800 ——– c:\windows\system32\dllcache\xpshims.dll 2009-12-14 21:02 11,069,952 ——– c:\windows\system32\dllcache\ieframe.dll 2009-12-14 21:02 –d—– c:\windows\ie8updates 2009-12-14 21:02 92,160 ——– c:\windows\system32\dllcache\iecompat.dll 2009-12-14 21:01 -cd-h— c:\windows\ie8 2009-12-14 20:53 221,184 a——- c:\windows\system32\wmpns.dll 2009-12-14 20:53 26,144 a——- c:\windows\system32\spupdsvc.exe 2009-12-14 20:39 –d—– c:\program files\MSXML 4.0 2009-12-14 19:57 –dsh— c:\documents and settings\efst031692\UserData 2009-12-14 19:48 –d—– c:\program files\Spybot - Search & Destroy 2009-12-14 19:48 –d—– c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2009-12-14 19:43 –d—– c:\windows\system32\DllCache 2009-12-14 19:30 –d—– c:\windows\system32\NtmsData 2009-12-14 19:26 –d-h— c:\windows\system32\GroupPolicy 2009-12-14 19:18 52,420 a——- c:\windows\BricoPackUninst.cmd 2009-12-14 19:17 3,932,214 a——- c:\windows\BricoPack Wallpaper.bmp 2009-12-14 19:16 6,120 a——- c:\windows\BricoPackFoldersDelete.cmd 2009-12-14 19:16 –d—– c:\windows\BricoPacks 2009-12-14 19:15 –d—– c:\windows\pss 2009-12-14 19:07 272,128 ——– c:\windows\system32\drivers\bthport.sys 2009-12-14 19:07 272,128 ——– c:\windows\system32\dllcache\bthport.sys 2009-12-14 18:54 411,368 a——- c:\windows\system32\deploytk.dll 2009-12-14 18:54 73,728 a——- c:\windows\system32\javacpl.cpl 2009-12-14 18:51 –d—– c:\windows\system32\Adobe 2009-12-14 18:34 153,088 ——– c:\windows\system32\dllcache\triedit.dll 2009-12-14 18:23 –d—– c:\docume~1\efst03~1\applic~1\AVG8 2009-12-14 18:21 128,512 ——– c:\windows\system32\dllcache\dhtmled.ocx 2009-12-14 18:17 203,136 ——– c:\windows\system32\dllcache\rmcast.sys 2009-12-14 18:17 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys 2009-12-14 18:17 333,952 ——– c:\windows\system32\dllcache\srv.sys 2009-12-14 18:17 331,776 ——– c:\windows\system32\dllcache\msadce.dll 2009-12-14 18:10 337,408 ——– c:\windows\system32\dllcache\netapi32.dll 2009-12-14 18:09 –d—– c:\program files\Yahoo! 2009-12-14 18:07 1,172,480 ——– c:\windows\system32\dllcache\msxml3.dll 2009-12-14 18:07 106,496 a—-r– c:\windows\system32\VModes.exe 2009-12-14 18:06 –d—– c:\program files\S3 2009-12-14 17:59 2,944 a——- c:\windows\system32\drivers\drmkaud.sys 2009-12-14 17:59 172,416 a——- c:\windows\system32\drivers\kmixer.sys 2009-12-14 17:59 52,864 a——- c:\windows\system32\drivers\dmusic.sys 2009-12-14 17:59 56,576 a——- c:\windows\system32\drivers\swmidi.sys 2009-12-14 17:59 142,592 a——- c:\windows\system32\drivers\aec.sys 2009-12-14 17:59 6,272 a——- c:\windows\system32\drivers\splitter.sys 2009-12-14 17:59 83,072 a——- c:\windows\system32\drivers\wdmaud.sys 2009-12-14 17:59 60,800 a——- c:\windows\system32\drivers\sysaudio.sys 2009-12-14 17:59 146,650 a——- c:\windows\system32\BuzzingBee.wav 2009-12-14 17:59 664 a——- c:\windows\system32\d3d9caps.dat 2009-12-14 17:59 940,794 a——- c:\windows\system32\LoopyMusic.wav 2009-12-14 17:58 –d—– c:\windows\system32\Lang 2009-12-14 17:57 4,992 a——- c:\windows\system32\drivers\mspqm.sys 2009-12-14 17:57 5,376 a——- c:\windows\system32\drivers\mspclock.sys 2009-12-14 17:56 –d—– c:\program files\Realtek 2009-12-14 17:53 1,203,922 ——– c:\windows\system32\dllcache\sysmain.sdb 2009-12-14 17:53 215,552 ——– c:\windows\system32\dllcache\wordpad.exe 2009-12-14 17:53 2,560 ——– c:\windows\system32\xpsp4res.dll 2009-12-14 17:53 –d-h— c:\windows\$hf_mig$ 2009-12-14 17:41 73,728 a—-r– c:\windows\system32\cnm576.tmp 2009-12-14 17:41 6,184 a—-r– c:\windows\system32\cmglue.vxd 2009-12-14 17:41 107,008 a——- c:\windows\system32\CNMLM58.DLL 2009-12-14 17:41 6,656 a——- c:\windows\system32\CNMVS58.DLL 2009-12-14 17:41 73,728 a—-r– c:\windows\system32\CNMCP58.exe 2009-12-14 17:41 73,728 a—-r– c:\windows\system32\cnm54D.tmp 2009-12-14 17:41 –d-h— C:\BJPrinter 2009-12-14 17:41 –d—– c:\windows\I560 2009-12-14 17:41 –d—– c:\windows\StartHtmico 2009-12-14 17:40 25,856 a——- c:\windows\system32\drivers\usbprint.sys 2009-12-14 17:36 376 a——- c:\windows\ODBC.INI 2009-12-14 17:35 –d—– c:\program files\Microsoft ActiveSync 2009-12-14 17:35 –d—– c:\windows\SHELLNEW 2009-12-14 17:35 274,288 a——- c:\windows\system32\mucltui.dll 2009-12-14 17:35 16,736 a——- c:\windows\system32\mucltui.dll.mui 2009-12-14 17:35 21,728 a——- c:\windows\system32\wucltui.dll.mui 2009-12-14 17:35 17,632 a——- c:\windows\system32\wuaueng.dll.mui 2009-12-14 17:35 15,072 a——- c:\windows\system32\wuaucpl.cpl.mui 2009-12-14 17:35 15,064 a——- c:\windows\system32\wuapi.dll.mui 2009-12-14 17:35 –d—– c:\windows\system32\SoftwareDistribution 2009-12-14 17:34 –d—– c:\documents and settings\efst031692\ff_temp 2009-12-14 17:34 –d—– c:\documents and settings\efst031692\7zS182F.tmp 2009-12-14 17:34 –d—– c:\documents and settings\EFST031692 2009-12-14 17:33 –ds—- c:\windows\system32\Microsoft 2009-12-14 17:33 8,192 a——- c:\windows\REGLOCS.OLD 2009-12-14 17:31 65,536 a——- c:\windows\system32\QuickTimeVR.qtx 2009-12-14 17:31 49,152 a——- c:\windows\system32\QuickTime.qts 2009-12-14 17:31 –d—– c:\program files\QuickTime Alternative 2009-12-14 17:31 107,132 a——- c:\windows\UninstallFirefox.exe 2009-12-14 17:31 2,293 a——- c:\windows\mozver.dat 2009-12-14 17:31 2,297,552 a——- c:\windows\system32\d3dx9_26.dll 2009-12-14 17:30 2,577 a——- c:\windows\system32\CONFIG.NT 2009-12-14 17:30 0 a——- c:\windows\control.ini 2009-12-14 17:30 23,392 a——- c:\windows\system32\nscompat.tlb 2009-12-14 17:30 16,832 a——- c:\windows\system32\amcompat.tlb 2009-12-14 17:30 316,640 a——- c:\windows\WMSysPr9.prx 2009-12-14 17:29 –dsh— c:\documents and settings\all users\DRM 2009-12-14 17:29 –ds—- c:\windows\Downloaded Program Files 2009-12-14 17:29 –d–r– c:\windows\Offline Web Pages 2009-12-14 17:29 488 a—hr– c:\windows\system32\WindowsLogon.manifest 2009-12-14 17:29 488 a—hr– c:\windows\system32\logonui.exe.manifest 2009-12-14 17:28 749 a—hr– c:\windows\WindowsShell.Manifest 2009-12-14 17:28 749 a—hr– c:\windows\system32\wuaucpl.cpl.manifest 2009-12-14 17:28 749 a—hr– c:\windows\system32\sapi.cpl.manifest 2009-12-14 17:28 749 a—hr– c:\windows\system32\nwc.cpl.manifest 2009-12-14 17:28 749 a—hr– c:\windows\system32\ncpa.cpl.manifest 2009-12-14 17:28 749 a—hr– c:\windows\system32\cdplayer.exe.manifest 2009-12-14 17:28 –d-h— c:\program files\WindowsUpdate 2009-12-14 17:28 –d—– c:\program files\Online Services 2009-12-14 17:28 –d—– c:\windows\system32\DirectX 2009-12-14 17:28 11,264 a——- c:\windows\system32\atrace.dll 2009-12-14 17:28 2 a——- c:\windows\system32\desktop.ini 2009-12-14 17:28 48,680 —sh— c:\windows\winnt256.bmp 2009-12-14 17:28 48,680 —sh— c:\windows\winnt.bmp 2009-12-14 17:27 –d—– c:\program files\common files\MSSoap 2009-12-14 17:23 –d—– c:\program files\MSN Messenger 2009-12-14 17:22 –d—– c:\program files\Windows NT 2009-12-14 17:18 –d—– c:\program files\common files\ODBC 2009-12-14 17:18 –d–r– c:\documents and settings\all users\Documents ==================== Find3M ==================== 2009-12-16 19:32 2,254 a——- c:\windows\system32\tmp.reg 2009-12-15 08:47 86,327 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-12-14 17:26 21,640 a——- c:\windows\system32\emptyregdb.dat 2009-12-03 21:22 6,021,664 a——- c:\windows\system32\drivers\RtkHDAud.sys 2009-12-03 20:45 358,944 a——- c:\windows\vncutil.exe 2009-12-03 20:45 1,833,504 a——- c:\windows\SkyTel.exe 2009-12-03 20:45 84,512 a——- c:\windows\SOUNDMAN.EXE 2009-12-03 20:45 1,489,440 a——- c:\windows\RtlUpd.exe 2009-12-03 20:45 9,721,888 a——- c:\windows\RTLCPL.EXE 2009-12-03 20:45 129,568 a——- c:\windows\RtkAudioService.exe 2009-12-03 20:45 48,672 a——- c:\windows\system32\RtkCoInstXP.dll 2009-12-03 20:45 18,789,408 a——- c:\windows\RTHDCPL.EXE 2009-12-03 20:45 2,177,568 a——- c:\windows\MicCal.exe 2009-12-03 20:45 2,815,520 a——- c:\windows\ALCWZRD.EXE 2009-12-03 20:45 64,032 a——- c:\windows\ALCMTR.EXE 2009-11-24 17:40 838,176 a——- c:\windows\RtlExUpd.dll 2009-11-18 07:17 1,395,800 a——- c:\windows\system32\drivers\Monfilt.sys 2009-11-18 07:16 1,691,480 a——- c:\windows\system32\drivers\Ambfilt.sys 2009-10-29 07:45 916,480 a——- c:\windows\system32\wininet.dll 2009-10-29 07:45 916,480 ——– c:\windows\system32\dllcache\wininet.dll 2009-10-29 07:45 5,940,736 ——– c:\windows\system32\dllcache\mshtml.dll 2009-10-29 07:45 1,208,832 ——– c:\windows\system32\dllcache\urlmon.dll 2009-10-29 07:45 206,848 ——– c:\windows\system32\dllcache\occache.dll 2009-10-29 07:45 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll 2009-10-29 07:45 184,320 ——– c:\windows\system32\dllcache\iepeers.dll 2009-10-29 07:45 387,584 ——– c:\windows\system32\dllcache\iedkcs32.dll 2009-10-28 14:40 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe 2009-10-21 05:38 75,776 a——- c:\windows\system32\strmfilt.dll 2009-10-21 05:38 25,088 a——- c:\windows\system32\httpapi.dll 2009-10-21 05:38 75,776 ——– c:\windows\system32\dllcache\strmfilt.dll 2009-10-21 05:38 25,088 ——– c:\windows\system32\dllcache\httpapi.dll 2009-10-20 16:20 265,728 a——- c:\windows\system32\drivers\http.sys 2009-10-20 16:20 265,728 ——– c:\windows\system32\dllcache\http.sys 2009-10-13 10:30 270,336 a——- c:\windows\system32\oakley.dll 2009-10-13 10:30 270,336 ——– c:\windows\system32\dllcache\oakley.dll 2009-10-12 13:38 149,504 a——- c:\windows\system32\rastls.dll 2009-10-12 13:38 149,504 ——– c:\windows\system32\dllcache\rastls.dll 2009-10-12 13:38 79,872 a——- c:\windows\system32\raschap.dll 2009-10-12 13:38 79,872 ——– c:\windows\system32\dllcache\raschap.dll ============= FINISH: 22:14:36.17 =============== please evaluate these. xD thnx.

Attachments:

📎Attach.txt

CatByte

Post #2December 19, 2009, 1:47 PM UTC

Hi,

Please do the following:

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

EFST031692

Post #3December 20, 2009, 7:18 AM UTC

hmm, thnx for the help. but its weird, nothing showed up in the results after the said scan sir. T_T

CatByte

Post #4December 20, 2009, 1:00 PM UTC

Hi,

That is strange: Did you make certain you had the correct boxes checked as in the image?

Please try the scan again.

NEXT

Please do the following:

Download ComboFix from the following location:
Link 1

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

EFST031692

Post #5December 21, 2009, 1:05 AM UTC

done scanning for the 5th time but the app still failed to give me results. i'm trying to attach a screenshot of it but while uploading the file, my desktop freezes. tired of doing some reboot T_T but after the scan GMER says that "GMER hasn't found any system modification."

CatByte

Post #6December 21, 2009, 1:45 AM UTC

OK, Please move on to the ComboFix scan thanks ~CB

EFST031692

Post #7December 21, 2009, 2:47 AM UTC

ComboFix 09-12-20.03 - EFST031692 12/21/2009 10:38:09.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.465 [GMT 0:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\cnvpe.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\dp1.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\eAPI.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\HtmlView.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\internet.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\krnln.fnr
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\RegEx.fnr
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\shell.fne
c:\docume~1\EFST03~1\LOCALS~1\Temp\E_N4\spec.fne
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\microday08.dll
c:\windows\system32\MTX0CI.dll
c:\windows\system32\mypath0079.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR
——-\Service_asc3360pr

((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
.

2009-12-20 13:26 . 2009-12-20 13:26 ——– d—–w- c:\windows\Sun
2009-12-19 20:29 . 2009-12-19 20:29 ——– d—–w- c:\program files\iWin
2009-12-19 11:40 . 2004-12-29 00:43 4682 —-a-w- c:\windows\system32\npptNT2.sys
2009-12-19 11:39 . 2009-12-19 11:39 ——– d—–w- c:\program files\Common Files\INCA Shared
2009-12-18 22:52 . 2009-12-18 22:52 ——– d—–w- c:\program files\directx
2009-12-18 21:41 . 2009-12-19 14:17 ——– d—–w- c:\program files\PokerStars
2009-12-17 19:30 . 2009-12-17 19:30 ——– d—–w- c:\program files\trend micro
2009-12-17 19:30 . 2009-12-17 19:30 ——– d—–w- C:\rsit
2009-12-16 16:22 . 2009-12-20 22:05 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\AskToolbar
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\documents and settings\EFST031692\Application Data\Malwarebytes
2009-12-16 15:54 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-16 15:54 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-16 15:38 . 2009-12-16 15:38 ——– d—–w- c:\program files\ERUNT
2009-12-16 15:36 . 2009-12-16 15:36 ——– d—–w- c:\program files\Ask.com
2009-12-16 11:58 . 2009-12-19 16:41 ——– d–h–w- c:\windows\system32\76F607
2009-12-16 11:58 . 2009-12-17 21:21 ——– d–h–w- c:\windows\system32\04E834
2009-12-16 11:58 . 2009-12-16 12:20 ——– d–h–w- c:\windows\system32\A8587C
2009-12-16 11:58 . 2009-12-16 12:19 ——– d–h–w- c:\windows\system32\8060D2
2009-12-16 08:11 . 2008-04-13 18:39 7552 —-a-w- c:\windows\system32\drivers\MSKSSRV.sys
2009-12-16 08:11 . 2008-04-13 18:39 7552 —-a-w- c:\windows\system32\dllcache\mskssrv.sys
2009-12-16 08:11 . 2009-12-20 22:57 ——– d—–w- c:\documents and settings\EFST031692\Application Data\mjusbsp
2009-12-16 08:11 . 2008-04-13 18:45 60032 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-16 08:11 . 2008-04-13 18:45 60032 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-16 08:11 . 2008-04-13 18:45 32128 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2009-12-16 08:11 . 2008-04-13 18:45 32128 —-a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-12-15 23:13 . 2009-12-15 23:23 ——– d—–w- c:\program files\Garena
2009-12-15 21:19 . 2006-01-06 15:53 7552 —-a-w- c:\windows\system32\drivers\SONYPVU1.SYS
2009-12-15 21:19 . 2006-01-06 15:53 7552 —-a-w- c:\windows\system32\dllcache\sonypvu1.sys
2009-12-15 21:19 . 2008-04-13 18:45 26368 —-a-w- c:\windows\system32\dllcache\usbstor.sys
2009-12-15 19:53 . 2009-12-15 19:53 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Adobe
2009-12-15 18:06 . 2009-12-15 18:06 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Apple Computer
2009-12-15 15:45 . 2009-12-15 15:46 ——– d-sh–w- c:\windows\system32\asd
2009-12-15 15:45 . 2009-12-15 15:45 ——– d—–w- c:\program files\Accurate Shutdown
2009-12-15 14:33 . 2009-12-15 14:33 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\windows\system32\xircom
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\windows\system32\wbem\snmp
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\program files\microsoft frontpage
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\scripting
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\en
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\bits
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\l2schemas
2009-12-15 08:43 . 2009-12-15 08:45 ——– d—–w- c:\windows\ServicePackFiles
2009-12-15 08:25 . 2008-04-14 00:12 53248 ——w- c:\windows\system32\tsgqec.dll
2009-12-15 08:24 . 2008-04-13 18:45 46592 ——w- c:\windows\system32\drivers\irbus.sys
2009-12-15 07:39 . 2009-12-15 07:39 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\PCHealth
2009-12-15 02:47 . 2009-12-15 02:47 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-15 02:47 . 2009-12-15 02:47 ——– d—–w- c:\program files\MSBuild
2009-12-15 02:46 . 2009-12-15 02:46 ——– d—–w- c:\program files\Reference Assemblies
2009-12-15 02:46 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-15 02:46 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-15 02:46 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-15 02:46 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-15 02:46 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-15 02:46 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-15 02:46 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-15 02:46 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-15 02:46 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-15 02:44 . 2009-12-15 02:44 ——– d—–w- c:\program files\MSXML 6.0
2009-12-14 22:46 . 2009-12-14 22:46 ——– d-sh–w- c:\documents and settings\EFST031692\PrivacIE
2009-12-14 21:24 . 2009-12-14 21:24 ——– d—–w- c:\program files\Windows Media Connect 2
2009-12-14 21:21 . 2009-12-14 21:22 ——– d—–w- c:\windows\system32\drivers\UMDF
2009-12-14 21:21 . 2009-12-14 21:21 ——– d—–w- c:\windows\system32\LogFiles
2009-12-14 21:09 . 2009-12-14 21:09 ——– d-sh–w- c:\documents and settings\EFST031692\IETldCache
2009-12-14 21:02 . 2009-10-29 07:45 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2009-12-14 21:02 . 2009-10-29 07:45 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-12-14 21:02 . 2009-10-29 07:45 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-12-14 21:02 . 2009-10-29 07:45 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-14 21:02 . 2009-10-29 07:45 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-12-14 21:02 . 2009-10-29 07:45 11069952 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-12-14 21:02 . 2009-12-14 21:02 ——– d—–w- c:\windows\ie8updates
2009-12-14 21:02 . 2009-10-02 04:44 92160 ——w- c:\windows\system32\dllcache\iecompat.dll
2009-12-14 21:01 . 2009-12-14 21:01 ——– dc-h–w- c:\windows\ie8
2009-12-14 20:53 . 2006-01-13 01:24 221184 —-a-w- c:\windows\system32\wmpns.dll
2009-12-14 20:53 . 2009-01-07 18:21 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2009-12-14 20:43 . 2009-12-16 17:59 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Temp
2009-12-14 20:43 . 2009-12-14 20:46 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Google
2009-12-14 20:39 . 2009-12-14 20:39 ——– d—–w- c:\program files\MSXML 4.0
2009-12-14 19:57 . 2009-12-14 19:57 ——– d-sh–w- c:\documents and settings\EFST031692\UserData
2009-12-14 19:48 . 2009-12-14 20:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-14 19:48 . 2009-12-14 19:48 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-14 19:43 . 2009-12-16 21:32 ——– d—–w- c:\windows\system32\DllCache
2009-12-14 19:30 . 2009-12-14 19:34 ——– d—–w- c:\windows\system32\NtmsData
2009-12-14 19:26 . 2009-12-14 19:26 ——– d–h–w- c:\windows\system32\GroupPolicy
2009-12-14 19:18 . 2009-12-14 19:18 52420 —-a-w- c:\windows\BricoPackUninst.cmd
2009-12-14 19:16 . 2009-12-14 19:18 6120 —-a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-12-14 19:16 . 2009-12-14 19:16 ——– d—–w- c:\windows\BricoPacks
2009-12-14 19:10 . 2009-12-14 19:10 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Yahoo
2009-12-14 19:09 . 2009-12-14 19:09 ——– d—–w- c:\documents and settings\EFST031692\Application Data\Yahoo!
2009-12-14 19:07 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2009-12-14 19:07 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2009-12-14 18:55 . 2009-12-14 18:55 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-14 18:54 . 2009-12-14 18:54 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-14 18:54 . 2009-12-14 18:53 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-14 18:53 . 2009-12-14 18:53 ——– d—–w- c:\program files\Java
2009-12-14 18:51 . 2009-12-14 18:51 ——– d—–w- c:\windows\system32\Adobe
2009-12-14 18:50 . 2009-12-14 18:50 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-14 18:34 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2009-12-14 18:23 . 2009-12-14 18:23 ——– d—–w- c:\documents and settings\EFST031692\Application Data\AVG8
2009-12-14 18:17 . 2008-05-08 14:02 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2009-12-14 18:17 . 2008-10-24 11:21 455296 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-14 18:17 . 2008-12-11 10:57 333952 ——w- c:\windows\system32\dllcache\srv.sys
2009-12-14 18:17 . 2008-05-01 14:33 331776 ——w- c:\windows\system32\dllcache\msadce.dll
2009-12-14 18:14 . 2009-12-19 11:32 16320 —-a-w- c:\documents and settings\EFST031692\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-14 18:13 . 2009-12-14 18:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-14 18:10 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2009-12-14 18:09 . 2009-12-14 18:13 ——– d—–w- c:\program files\Yahoo!
2009-12-14 18:07 . 2009-07-31 04:35 1172480 ——w- c:\windows\system32\dllcache\msxml3.dll
2009-12-14 18:07 . 2005-11-01 10:35 106496 —-a-r- c:\windows\system32\VModes.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-20 14:37 . 2009-12-20 14:37 2029800 —-a-w- c:\documents and settings\EFST031692\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-18 22:45 . 2009-12-14 17:56 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-15 08:47 . 2009-12-14 17:29 86327 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-14 18:54 . 2009-12-14 18:54 38784 —-a-w- c:\documents and settings\EFST031692\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-14 18:54 . 2009-12-14 18:54 38784 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-14 18:53 . 2009-12-14 18:53 152576 —-a-w- c:\documents and settings\EFST031692\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-14 18:50 . 2009-12-14 18:50 79488 —-a-w- c:\documents and settings\EFST031692\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-14 18:06 . 2009-12-14 18:06 ——– d—–w- c:\program files\S3
2009-12-14 17:59 . 2009-12-14 17:59 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-11-10 14:39 . 2009-12-14 18:13 685296 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-10-29 07:45 . 2006-01-13 01:26 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2006-01-13 01:31 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2006-01-13 01:16 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2006-01-13 01:31 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2006-01-13 01:54 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2006-01-13 01:23 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2006-01-13 01:48 79872 —-a-w- c:\windows\system32\raschap.dll
.

——- Sigcheck ——-

[-] 2009-08-06 . 17B886DFA31A1587F390460A60664A9D . 138464 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[7] 2008-04-14 . ED7262E52C31CF1625B65039102BC16C . 111104 . . [5.4.3790.5512] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[7] 2008-04-14 . ED7262E52C31CF1625B65039102BC16C . 111104 . . [5.4.3790.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 14:56 1175944 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5322040]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Google Update"="c:\documents and settings\EFST031692\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-14 205296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-03 18789408]
"VTTimer"="VTTimer.exe" [2006-09-21 122880]
"S3Trayp"="S3trayp.exe" [2007-06-11 253952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-14 218912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 183152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 1017208]
"ats"="c:\windows\system32\asd\loadqm.exe" [2005-08-26 737280]
"139AEC"="c:\windows\system32\A8587C\139AEC.EXE" [2009-12-16 1499933]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-01-13 44544]

c:\documents and settings\EFST031692\Start Menu\Programs\Startup\
139AEC.lnk - c:\windows\system32\A8587C\139AEC.EXE [2009-12-16 1499933]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-6-1 135168]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 229376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2005-12-14 12:13 7246896 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\PROGRA~1\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe"=
"c:\\WINDOWS\\BricoPacks\\Vista Inspirat 2\\RocketDock\\RocketDock.exe"=
"d:\\FreeStyle\\FreeStyle.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"d:\\FreeStyle\\FSLauncher.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\WINDOWS\\BricoPacks\\Vista Inspirat 2\\YzShadow\\YzShadow.exe"=
"c:\\Documents and Settings\\EFST031692\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\VTTimer.exe"=
"c:\\WINDOWS\\system32\\S3trayp.exe"=
"c:\\Program Files\\Mozilla Firefox\\crashreporter.exe"=
"c:\\WINDOWS\\system32\\76F607\\ZK-B502A.EXE"=
"c:\\DOCUME~1\\EFST03~1\\LOCALS~1\\Temp\\winiege.exe"=

R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [12/14/2009 6:06 PM 714240]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/14/2009 5:56 PM 1691480]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp –> c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ask.com?o=15161&l;=dis
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\EFST031692\Application Data\Mozilla\Firefox\Profiles\lx64y3t8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&q;=
FF - plugin: c:\documents and settings\EFST031692\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-VIA Chrome9 HC IGP Family Display - c:\progra~1\S3\UChromeP\s3minset.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-21 10:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ats = c:\windows\system32\asd\loadqm.exe noshow???e?s?s?.?????????????????,?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\WININET.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\VTTimer.exe
c:\windows\system32\S3trayp.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
c:\docume~1\EFST03~1\LOCALS~1\Temp\winiege.exe
.
**************************************************************************
.
Completion time: 2009-12-21 10:47:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-21 10:47

Pre-Run: 6,371,205,120 bytes free
Post-Run: 6,807,695,360 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - DC2AFCAEE46E56BE6557FE6718852163

HERE IT IS SIR.

CatByte

Post #8December 21, 2009, 4:00 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Problem_stability_my_computer_t108918.html&view=findpost&p=618907#entry618907

Collect::
c:\windows\system32\A8587C\139AEC.EXE
c:\docume~1\EFST03~1\LOCALS~1\Temp\winiege.exe

Folder::
c:\program files\iWin
c:\windows\system32\76F607
c:\windows\system32\04E834
c:\windows\system32\A8587C
c:\windows\system32\8060D2

FCopy::
c:\windows\ServicePackFiles\i386\wuauclt.exe | c:\windows\system32\wuauclt.exe

Driver::
139AEC
ASC3360PR

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"139AEC"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
"DisableRegistryTools"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\76F607\\ZK-B502A.EXE"=-
"c:\\DOCUME~1\\EFST03~1\\LOCALS~1\\Temp\\winiege.exe"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

EFST031692

Post #9December 21, 2009, 4:22 AM UTC

ComboFix 09-12-20.03 - EFST031692 12/21/2009 12:10:35.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.123 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\EFST031692\Desktop\CFScript.txt

file zipped: c:\docume~1\EFST03~1\LOCALS~1\Temp\winiege.exe
file zipped: c:\windows\system32\A8587C\139AEC.EXE
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\iWin
c:\program files\iWin\FamilyFeudOnlineParty\audio\answeraha1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answeraha2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answeraha3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answeraha4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answeraha5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerawww1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerawww2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerawww3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerawww4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerinputappears.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerinputdisappears.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerkeyclick.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answerrevealding.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\answersrerevealed.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applause1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applause2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applause3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applause4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applause5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applauselong.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\applausewithmusic.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\btnappears.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\buttondisappears.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\buzzer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\buzzer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\countdownappears.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\countdownfinalticks.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\countdownmove.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\countdownticks.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoney5x1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoney5x2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoney5x3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyanswerbox.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneybump.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneygot200.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneygotpoints.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyintromusic.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneylogo.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneylogotwinkle.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneynopoints.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneypanel1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneypanel3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneypanelflyaway.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneypanelflyback.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneypanelmoveleft.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyplayer1done.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyplayerdone.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyprereveal.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyquestionflyaway.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneyscorebox.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummaryequals.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummaryplus1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummaryplus2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarypoints1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarypoints2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarypoints3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarysnowball.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarytotal1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarytotal2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarytotal3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneysummarytotal4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytheme.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytopansweranim.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytopanswerbox.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytotalflyaway.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytotalflyin.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytotalmoveleft.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\fastmoneytotalmoveright.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\finalscore1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\finalscoreexit.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\gameover.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\gameoverlost.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\gotthatanswer.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\iwin.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\M_MenuSelections.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\M_Select.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\match2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\menumusic.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\menumusicintro.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\menumusicloop.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\menumusicoutro.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\missedrevealed1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\missedrevealed2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\missedrevealed3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\missedrevealed4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\nameflyin.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\nameflyinstop.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\openingtheme.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\pass.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\questionscorechanged.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\questionwordtick.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\right.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\roundflyin.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\roundflyinstop.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\roundnum.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\roundoverlosing.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\scoresmultiplied.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\scoresmultipliedschw.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\scoresmultipliedtwinkle.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\scoresmultipliedwordflip.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\strike.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\submitanswer.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\submitanswerincorrect.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\think20.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\think25.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\topanswerboxappear.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\winmusic1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\winmusic2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\winmusic3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\winmusicbig.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audio\wrong.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_audiencenoises1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_audiencenoises2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_audiencenoises3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_audiencenoises4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot7_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot7_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot8_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot8_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot9_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegot9_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegotall1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegotall2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegotnone1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_bluegotnone2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_blueleading1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_blueleading2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_blueleading3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_blueleading4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_byebye1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_byebye2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_byebye3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_byebye4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_clockrunout8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_entireblueteamgotit1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_entireblueteamgotit2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_entireredteamgotit1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_entireredteamgotit2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluelost1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluelost2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluelost3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluewins1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluewins2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluewins3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneybluewins4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyfivesolo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyfivesolo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyforfun1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyforfun2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyforfun3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyfoursolo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyfoursolo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyonesolo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyonesolo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredlost1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredlost2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredlost3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredwins1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredwins2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredwins3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyredwins4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneysolofun1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneysolofun2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneysolofun3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneyteamstie1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythesewin1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythesewin2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythesewin3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythiswins1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythiswins2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythiswins3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythreesolo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneythreesolo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneytwosolo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneytwosolo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneywinplays1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneywinplays2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fastmoneywinplays3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_finalwrapupdisplay1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1recap1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1recap2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1recap3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1recap4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1score1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1score2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1score3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1score4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1start1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1start2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1start3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm1start4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200bonus1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200bonus2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200continue1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200continue2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200continue3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200points.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200points1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200points2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200points3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm200points4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2recap1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2recap2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2recap3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2recap4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2start1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2start2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2start3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm2start4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm45clock1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm45clock2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm45clock3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm50clock1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm50clock2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm50clock3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm50clock4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm55clock4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xpoints1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xpoints2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xpoints3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xpoints4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xtotal1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xtotal2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xtotal3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fm5xtotal4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmannouncewinner1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmannouncewinner2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmannouncewinner3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmcanpass1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmcheckfinalscores1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmcheckfinalscores2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmcheckfinalscores3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmcheckfinalscores4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmdidntanswerall1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmdidntanswerall2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmgottopanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmgottopanswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmgottopanswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmgottopanswer4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmintro1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmjoinnopoints1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmjoinnopoints2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmjoinnopoints3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpbonus1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpbonus2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpbonus3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpbonus4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpwrapup1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpwrapup2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpwrapup3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmmpwrapup4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmnoanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmnoanswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmnoanswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmnoanswer4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmplay1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmplay2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmplay3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmplay4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmplayer2dupanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmrevealnopoints1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmrevealnopoints2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmrevealnopoints3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmreviewtopanswers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmreviewtopanswers2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmreviewtopanswers3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmsetup1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmsetup2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmsetup3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmsetup4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmtopanswer.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmtopanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmtopanswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmtopanswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmtopanswer4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmwin1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmwin2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmwin3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_fmwin4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamebeginaftersurvey1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamebeginaftersurvey2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamebeginaftersurvey3 .ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamebeginaftersurvey4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamebeginaftersurvey5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gameinprogress1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gameinprogress2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gameinprogress3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamewrapup1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamewrapup2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gamewrapup3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gotall1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gotall2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gotall3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gotall4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_gotthatanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_introblue1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_introred1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_letspickaroom1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_letspickaroom2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_letspickaroom3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_letspickaroom4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_letspickaroomintro.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment10.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment11.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_misccomment9.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative10.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative11.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscnegative9.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscother1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscother2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscother3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive10.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive11.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive12.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscpositive9.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_miscroomchoice8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_mm_intro1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_mm_intro2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_mm_intro3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_newquestion1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_nextround1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_nextround2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_nextround3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_nextround4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_okayyourein1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_okayyourein2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_okayyourein3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_okayyourein4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerhitplay6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerquits1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerquits2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerquits3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerquits4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitround1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitround2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitround3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitroundmore1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitroundmore2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playerwaitroundmore3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playfmforfun1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_playfmforfun2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psanother1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psanother2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psanother3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psanother4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_psthanks6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_questionintro1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_questionintro2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_questionintro3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_questionintro4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot7_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot7_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot8_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot8_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot9_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgot9_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgotall1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgotall2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgotnone1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redgotnone2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redleading1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redleading2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redleading3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redleading4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redoanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_redvsblue1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal1_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal2_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal3_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal4_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal5_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal6_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal7_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal7_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_reveal7_3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_revealmissedanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_revealmissedanswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_revealmissedanswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review7_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_review7_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_rightanswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_rightanswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_rightanswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_rightanswer4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round_four1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round_four2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round_four3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round_four4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3doubled1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3doubled2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3doubled3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3doubled4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3intro1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3intro2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3intro3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round3intro4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4ahead1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4ahead2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4ahead3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4ahead4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4behind1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4behind2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4behind3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4behind4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4blueahead1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4blueahead2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4blueahead3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4blueahead4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4bluebehind1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4bluebehind2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4bluebehind3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4bluebehind4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redahead1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redahead2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redahead3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redahead4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redbehind1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redbehind2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redbehind3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4redbehind4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4tripled1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4tripled2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4tripled3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_round4tripled4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorecheck1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorecheck2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorecheck3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorecheck4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorewrapup1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorewrapup2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorewrapup3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_scorewrapup4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_soloallright1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_soloallright2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_soloallright3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_soloallright4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot7_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot7_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot8_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot8_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot9_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_sologot9_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solononerght1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solononerght2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solononerght3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solononerght4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solotheseswept1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solotheseswept2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solotheseswept3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solothisswept1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solothisswept2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solothisswept3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solowhosleading1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solowhosleading2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solowhosleading3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solowhosleading4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_solowhosleading5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_startsoloplay1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_startsoloplay2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikeone1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikeone2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikeone3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikeone4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikethree1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikethree2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikethree3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_strikethree4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_striketwo1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_striketwo2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_striketwo3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_striketwo4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveychildren1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveyisanswered1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveyisanswered2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveyisanswered3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveyisanswered4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveymen1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveypeople1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveysays1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveysays2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveysays3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveysays4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveysays5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveytop3answers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveytop4answers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveytop5answers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveytop6answers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveytop7answers1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_surveywomen1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_teamchatopen1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_teamcheckscore1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_teamcheckscore2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_teamcheckscore3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timetotakethesurvey7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timeup1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timeup2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timeup3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_timeup4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagain1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagain2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagain3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagain4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainlast1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainlast2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainlast3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_tryagainstrike7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame_first1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame6.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame7.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame8.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_waitingtojoingame9.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wearein1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wearein2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wearein3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wearein4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wearein5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward0_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward0_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward1_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward1_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward2_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward2_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward3_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward3_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward4_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward4_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward5_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward5_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward6_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward6_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward8_1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wonaward8_2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wronganswer1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wronganswer2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wronganswer3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wronganswer4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_wronganswer5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youlost1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youlost2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youlost3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youlost4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youretheonlyone1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youretheonlyone2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youretheonlyone3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youretheonlyone4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youretheonlyone5.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youwin1.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youwin2.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youwin3.ogg
c:\program files\iWin\FamilyFeudOnlineParty\audiovo\vo_youwin4.ogg
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\answerinput.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\blastanim.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\countdowntimer.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerbox1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerbox2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerbox3.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerbox4.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerbox5.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerhide.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneyanswerreveal.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneylogo.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneypanel1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneypanel3.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneytopansweranim.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneytopanswerpoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneytopanswertext.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneytopanswertotalpoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneytotal.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneywrapavg.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneywrapdivide.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fastmoneywraptotal.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle1mainmenu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle2mainmenu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle3.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle3mainmenu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fftitle4mainmenu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapupbigname.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapupname.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuppanel.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuppanel1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuppanel2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapupstats.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuptitle1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuptitle2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuptitle3.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\fmwrapuptitle4.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\gamescoreaverage.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\gamescoreaverageshadow.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\gamescoreplayer.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\gamescoreplayershadow.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\noanswerbutton.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\playernameback.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\playernameflyin.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\practicetext.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\questionword.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\roundflyin.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\roundnum.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\roundscore.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorelistclose.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorelistcloseblue.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorelistopen.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorelistopenblue.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresdoubled.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresdoubledschw.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorestripled.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scorestripledschw.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummarybonuspoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummaryequals.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummaryfastmoneypoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummarygamepoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummaryplus1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummaryplus2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummarysnowball.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummarytotalpoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\scoresummaryx5.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparkleblueteam.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparkledoubletriple.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparkleintro.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparklename.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparklerandom.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\sparkleredteam.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\startbutton.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\strike.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\submitbutton.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\summaryaverage.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\summarydivide.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\summarytotal.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\surveyanswerinput.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\surveyauthor.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\surveyback.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\surveycountdowntext.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\surveytime.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox1.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox3.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox4.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox5.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox6.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerbox7.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerboxblank.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerboxoutline.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswerpoints.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\topanswertext.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\waitteam.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\waittext.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\waittext2.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\animations\winnernameflyin.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dbootlock.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\defaultfont.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dhighdetail.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dialogs.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dlogin.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\doptions.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dplayas.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\drules.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\dtellfriend.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\feudmp.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\fonts.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\images.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\menu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\menudialog.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\mp.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\skin.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\splash.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\splashanim.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\usermenu.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\vendor.cfge
c:\program files\iWin\FamilyFeudOnlineParty\cfg\vendordetails.cfge
c:\program files\iWin\FamilyFeudOnlineParty\FamilyFeudOP.exe
c:\program files\iWin\FamilyFeudOnlineParty\fonts\tt0807m_.ttf
c:\program files\iWin\FamilyFeudOnlineParty\fonts\Vera.ttf
c:\program files\iWin\FamilyFeudOnlineParty\framework.dll
c:\program files\iWin\FamilyFeudOnlineParty\gamecomm.dll
c:\program files\iWin\FamilyFeudOnlineParty\htmlwindow.dll
c:\program files\iWin\FamilyFeudOnlineParty\images\ArrowCursor.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\dskin.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerinput.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerscoreback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerscorenums.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerscorenums1.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\answerscorenums2.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\bluebar.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\btn_noanswer.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\btn_start.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\btn_submit.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\countdownnums.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\countdowntimer.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\ddonesmall.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoney.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneyanswerbox.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneyanswerreveal.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneyback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneyback2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneycover.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneypanel1.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneypanel1anim.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneypanel2.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneypanel2anim.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneyscorebox.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneytopansweranim.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneytopanswerbox.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fastmoneytotal.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fftitle.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fftitle1.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fftitle2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fftitle3.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fftitle4.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fmwrapupbignameback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\fmwrapuppanel.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\gamescoreback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\gamescorenums.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\player1name.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\player2name.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\player2nameback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\playernameback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\redbar.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\roundflyin.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\roundnums.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scoresdoubled.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scoresdoubledoutro.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scoresdoubledschw.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scorestripled.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scorestripledoutro.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scorestripledschw.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\scoresummarysnowball.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\sparklelg.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\sparklesm.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\strike.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summaryblueaverage.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summarybluedivide.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summarybluetotal.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summaryredaverage.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summaryreddivide.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\summaryredtotal.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\surveyanswerinput.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\surveyback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\surveytime.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox0.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox1.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox2.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox3.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox4.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox5.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox6.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\ff\topanswerbox7.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\fficon.gif
c:\program files\iWin\FamilyFeudOnlineParty\images\hostbtn.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\logo.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\account.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\avatar.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\blastanim.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\changeBtn.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\chat.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_highscores.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_mainmenu.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_newgame.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_options.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_quit.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_rules.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_solo_lobby.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_team_lobby.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dbtn_unpause.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dcancel.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dcancel2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dcheck.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dcheck.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\ddelete.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\ddone.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\ddown.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dforgotpass.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dforgotuser.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dicon.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dicon.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dknob.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dknob2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dleft.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dlogin.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dlogin2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dnext.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dno.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dno_small.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dok.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dok_small.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dprev.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dradio.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dradio.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dregister.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dregister2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dright.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\drulesgeneral.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dsliderl-s2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dsliderr-s2.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dtellafriend.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dup.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dyes.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\dyes_small.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\first_time.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\friends.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\help.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\howtoplay.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\menu.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\moreinfo.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\newquestions.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\options.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\profile.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\quit.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\rulesbtn.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\solo.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\startbtn.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\submitquestion.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\team.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mainmenu\updatebtn.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\avatar.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\awards.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\awards_icons.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\bluenameback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\bluescoreoval.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\bluetitle.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\bootwindow.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\btn_back.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\btn_chatsort.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\btn_start.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\chat_icon.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\chatcover.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_boot.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_dont_boot.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_dont_lock.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_dont_unlock.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_lock.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\dbtn_unlock.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\gamebackground.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\inactive_answer.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\inactive_chat.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\lobbybackground.jpge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\lock.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\mainmenu.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\messagewindow.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\messagewindowsmall.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\page_awards.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\page_profile.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\page_stats.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\play.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\playerssort.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\playerstitle.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\playnow.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\playred.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-back.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-boot.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-friend.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-ignore.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-profile.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-remove-friend.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-tile.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\popup-unignore.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\prof_bg.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\prof_close.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\profile_bevel.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\rankicons.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\rednameback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\redscoreoval.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\redtitle.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\roomcell.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\roomlist.GIFe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\roomsort.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scoreback.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scorebox.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollbackchat.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollbackroom.gife
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollbottom.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrolldown.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrolldownbig.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollthumb.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollup.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\scrollupbig.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallchatcell.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallchatinput.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallpoints.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallrank.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallrating.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallsubmit.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\smallwhosthere.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\solobackname.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\tab_awards.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\tab_profile.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\tab_stats.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\thumbbig.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\unlock.pnge
c:\program files\iWin\FamilyFeudOnlineParty\images\mp\wronganswer.PNGe
c:\program files\iWin\FamilyFeudOnlineParty\images\textcursor.pnge
c:\program files\iWin\FamilyFeudOnlineParty\iWin Games.url
c:\program files\iWin\FamilyFeudOnlineParty\iwin.ico
c:\program files\iWin\FamilyFeudOnlineParty\jpeg.dll
c:\program files\iWin\FamilyFeudOnlineParty\libpng13.dll
c:\program files\iWin\FamilyFeudOnlineParty\msvcp60.dll
c:\program files\iWin\FamilyFeudOnlineParty\MSVCP60D.DLL
c:\program files\iWin\FamilyFeudOnlineParty\MSVCRTD.DLL
c:\program files\iWin\FamilyFeudOnlineParty\readme.rtf
c:\program files\iWin\FamilyFeudOnlineParty\SDL.dll
c:\program files\iWin\FamilyFeudOnlineParty\SDL_gfx.dll
c:\program files\iWin\FamilyFeudOnlineParty\SDL_image.dll
c:\program files\iWin\FamilyFeudOnlineParty\SDL_mixer.dll
c:\program files\iWin\FamilyFeudOnlineParty\SDL_net.dll
c:\program files\iWin\FamilyFeudOnlineParty\sdl_sound.dll
c:\program files\iWin\FamilyFeudOnlineParty\SDL_ttf.dll
c:\program files\iWin\FamilyFeudOnlineParty\splash\splashscreen.jpge
c:\program files\iWin\FamilyFeudOnlineParty\Uninstall.exe
c:\program files\iWin\FamilyFeudOnlineParty\vorbis.dll
c:\program files\iWin\FamilyFeudOnlineParty\vorbisfile.dll
c:\program files\iWin\FamilyFeudOnlineParty\WebUpdateSvc.bmp
c:\program files\iWin\FamilyFeudOnlineParty\WebUpdateSvc.exe
c:\program files\iWin\FamilyFeudOnlineParty\WebUpdateSvc.LIC
c:\program files\iWin\FamilyFeudOnlineParty\zlib1.dll
c:\windows\system32\04E834
c:\windows\system32\04E834\14161408.txt
c:\windows\system32\04E834\ac1e12ee.txt
c:\windows\system32\76F607
c:\windows\system32\76F607\123.EXE
c:\windows\system32\76F607\a7.ini
c:\windows\system32\76F607\cnvpe.fne
c:\windows\system32\76F607\dp1.fne
c:\windows\system32\76F607\eAPI.fne
c:\windows\system32\76F607\HtmlView.fne
c:\windows\system32\76F607\internet.fne
c:\windows\system32\76F607\krnln.fnr
c:\windows\system32\76F607\RegEx.fnr
c:\windows\system32\76F607\shell.fne
c:\windows\system32\76F607\spec.fne
c:\windows\system32\76F607\Y-98U7.EXE
c:\windows\system32\76F607\ZC-B86BE.EXE
c:\windows\system32\76F607\ZK-B502A.EXE
c:\windows\system32\8060D2
c:\windows\system32\8060D2\66b9ff.txt
c:\windows\system32\8060D2\d5065a.txt
c:\windows\system32\A8587C
c:\windows\system32\A8587C\139AEC.EXE

.
————— FCopy —————

c:\windows\ServicePackFiles\i386\wuauclt.exe –> c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR

((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
.

2009-12-20 22:57 . 2009-08-01 16:16 6326232 —ha-w- c:\documents and settings\EFST031692\Application Data\mjusbsp\in00000\setup.exe
2009-12-20 22:57 . 2009-08-01 16:12 802328 —ha-w- c:\documents and settings\EFST031692\Application Data\mjusbsp\ar00000\install.exe
2009-12-20 14:37 . 2009-12-20 14:37 2029800 —-a-w- c:\documents and settings\EFST031692\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-20 13:26 . 2009-12-20 13:26 ——– d—–w- c:\windows\Sun
2009-12-19 11:40 . 2004-12-29 00:43 4682 —-a-w- c:\windows\system32\npptNT2.sys
2009-12-19 11:39 . 2009-12-19 11:39 ——– d—–w- c:\program files\Common Files\INCA Shared
2009-12-18 22:52 . 2009-12-18 22:52 ——– d—–w- c:\program files\directx
2009-12-18 21:41 . 2009-12-19 14:17 ——– d—–w- c:\program files\PokerStars
2009-12-17 19:30 . 2009-12-17 19:30 ——– d—–w- c:\program files\trend micro
2009-12-17 19:30 . 2009-12-17 19:30 ——– d—–w- C:\rsit
2009-12-16 16:22 . 2009-12-21 11:25 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\AskToolbar
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\documents and settings\EFST031692\Application Data\Malwarebytes
2009-12-16 15:54 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-16 15:54 . 2009-12-16 15:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-16 15:54 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-16 15:38 . 2009-12-16 15:38 ——– d—–w- c:\program files\ERUNT
2009-12-16 15:36 . 2009-12-16 15:36 ——– d—–w- c:\program files\Ask.com
2009-12-16 08:12 . 2009-08-01 16:16 6326232 —ha-w- c:\documents and settings\EFST031692\Application Data\mjusbsp\Upgrade\setup1.exe
2009-12-16 08:12 . 2009-08-01 16:12 798232 —ha-w- c:\documents and settings\EFST031692\Application Data\mjusbsp\Upgrade\install1.exe
2009-12-16 08:11 . 2008-04-13 18:39 7552 —-a-w- c:\windows\system32\drivers\MSKSSRV.sys
2009-12-16 08:11 . 2008-04-13 18:39 7552 —-a-w- c:\windows\system32\dllcache\mskssrv.sys
2009-12-16 08:11 . 2009-12-20 22:57 ——– d—–w- c:\documents and settings\EFST031692\Application Data\mjusbsp
2009-12-16 08:11 . 2008-04-13 18:45 60032 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-16 08:11 . 2008-04-13 18:45 60032 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-16 08:11 . 2008-04-13 18:45 32128 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2009-12-16 08:11 . 2008-04-13 18:45 32128 —-a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-12-15 23:13 . 2009-12-15 23:23 ——– d—–w- c:\program files\Garena
2009-12-15 21:19 . 2006-01-06 15:53 7552 —-a-w- c:\windows\system32\drivers\SONYPVU1.SYS
2009-12-15 21:19 . 2006-01-06 15:53 7552 —-a-w- c:\windows\system32\dllcache\sonypvu1.sys
2009-12-15 21:19 . 2008-04-13 18:45 26368 —-a-w- c:\windows\system32\dllcache\usbstor.sys
2009-12-15 19:53 . 2009-12-15 19:53 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Adobe
2009-12-15 18:06 . 2009-12-15 18:06 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Apple Computer
2009-12-15 15:45 . 2009-12-15 15:46 ——– d-sh–w- c:\windows\system32\asd
2009-12-15 15:45 . 2009-12-15 15:45 ——– d—–w- c:\program files\Accurate Shutdown
2009-12-15 14:33 . 2009-12-15 14:33 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\windows\system32\xircom
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\windows\system32\wbem\snmp
2009-12-15 14:29 . 2009-12-15 14:29 ——– d—–w- c:\program files\microsoft frontpage
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\scripting
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\en
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\system32\bits
2009-12-15 08:45 . 2009-12-15 08:45 ——– d—–w- c:\windows\l2schemas
2009-12-15 08:43 . 2009-12-15 08:45 ——– d—–w- c:\windows\ServicePackFiles
2009-12-15 08:25 . 2008-04-14 00:12 53248 ——w- c:\windows\system32\tsgqec.dll
2009-12-15 08:24 . 2008-04-13 18:45 46592 ——w- c:\windows\system32\drivers\irbus.sys
2009-12-15 07:39 . 2009-12-15 07:39 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\PCHealth
2009-12-15 02:47 . 2009-12-15 02:47 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-15 02:47 . 2009-12-15 02:47 ——– d—–w- c:\program files\MSBuild
2009-12-15 02:46 . 2009-12-15 02:46 ——– d—–w- c:\program files\Reference Assemblies
2009-12-15 02:46 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-15 02:46 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-15 02:46 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-15 02:46 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-15 02:46 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-15 02:46 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-15 02:46 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-15 02:46 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-15 02:46 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-15 02:44 . 2009-12-15 02:44 ——– d—–w- c:\program files\MSXML 6.0
2009-12-14 22:46 . 2009-12-14 22:46 ——– d-sh–w- c:\documents and settings\EFST031692\PrivacIE
2009-12-14 21:26 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-12-14 21:24 . 2009-12-14 21:24 ——– d—–w- c:\program files\Windows Media Connect 2
2009-12-14 21:21 . 2009-12-14 21:22 ——– d—–w- c:\windows\system32\drivers\UMDF
2009-12-14 21:21 . 2009-12-14 21:21 ——– d—–w- c:\windows\system32\LogFiles
2009-12-14 21:09 . 2009-12-14 21:09 ——– d-sh–w- c:\documents and settings\EFST031692\IETldCache
2009-12-14 21:02 . 2009-10-29 07:45 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2009-12-14 21:02 . 2009-10-29 07:45 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-12-14 21:02 . 2009-10-29 07:45 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-12-14 21:02 . 2009-10-29 07:45 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-14 21:02 . 2009-10-29 07:45 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-12-14 21:02 . 2009-10-29 07:45 11069952 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-12-14 21:02 . 2009-12-14 21:02 ——– d—–w- c:\windows\ie8updates
2009-12-14 21:02 . 2009-10-02 04:44 92160 ——w- c:\windows\system32\dllcache\iecompat.dll
2009-12-14 21:01 . 2009-12-14 21:01 ——– dc-h–w- c:\windows\ie8
2009-12-14 20:53 . 2006-01-13 01:24 221184 —-a-w- c:\windows\system32\wmpns.dll
2009-12-14 20:53 . 2009-01-07 18:21 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2009-12-14 20:43 . 2009-12-16 17:59 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Temp
2009-12-14 20:43 . 2009-12-14 20:46 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Google
2009-12-14 20:39 . 2009-12-14 20:39 ——– d—–w- c:\program files\MSXML 4.0
2009-12-14 19:57 . 2009-12-14 19:57 ——– d-sh–w- c:\documents and settings\EFST031692\UserData
2009-12-14 19:48 . 2009-12-14 20:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-14 19:48 . 2009-12-14 19:48 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-14 19:43 . 2009-12-21 12:11 ——– d—–w- c:\windows\system32\DllCache
2009-12-14 19:30 . 2009-12-14 19:34 ——– d—–w- c:\windows\system32\NtmsData
2009-12-14 19:26 . 2009-12-14 19:26 ——– d–h–w- c:\windows\system32\GroupPolicy
2009-12-14 19:18 . 2009-12-14 19:18 52420 —-a-w- c:\windows\BricoPackUninst.cmd
2009-12-14 19:16 . 2009-12-14 19:18 6120 —-a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-12-14 19:16 . 2009-12-14 19:16 ——– d—–w- c:\windows\BricoPacks
2009-12-14 19:10 . 2009-12-14 19:10 ——– d—–w- c:\documents and settings\EFST031692\Local Settings\Application Data\Yahoo
2009-12-14 19:09 . 2009-12-14 19:09 ——– d—–w- c:\documents and settings\EFST031692\Application Data\Yahoo!
2009-12-14 19:07 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2009-12-14 19:07 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2009-12-14 18:55 . 2009-12-14 18:55 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-14 18:54 . 2009-12-14 18:54 38784 —-a-w- c:\documents and settings\EFST031692\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-14 18:54 . 2009-12-14 18:54 38784 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-14 18:54 . 2009-12-14 18:54 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-14 18:54 . 2009-12-14 18:53 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-14 18:53 . 2009-12-14 18:53 ——– d—–w- c:\program files\Java
2009-12-14 18:53 . 2009-12-14 18:53 152576 —-a-w- c:\documents and settings\EFST031692\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-14 18:51 . 2009-12-21 11:40 ——– d—–w- c:\windows\system32\Adobe
2009-12-14 18:50 . 2009-12-14 18:50 79488 —-a-w- c:\documents and settings\EFST031692\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-14 18:50 . 2009-12-14 18:50 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-14 18:34 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2009-12-14 18:23 . 2009-12-14 18:23 ——– d—–w- c:\documents and settings\EFST031692\Application Data\AVG8
2009-12-14 18:17 . 2008-05-08 14:02 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2009-12-14 18:17 . 2008-10-24 11:21 455296 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-14 18:17 . 2008-12-11 10:57 333952 ——w- c:\windows\system32\dllcache\srv.sys
2009-12-14 18:17 . 2008-05-01 14:33 331776 ——w- c:\windows\system32\dllcache\msadce.dll
2009-12-14 18:14 . 2009-12-19 11:32 16320 —-a-w- c:\documents and settings\EFST031692\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-14 18:13 . 2009-12-14 18:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-14 18:13 . 2009-11-10 14:39 685296 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-12-14 18:10 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2009-12-14 18:09 . 2009-12-14 18:13 ——– d—–w- c:\program files\Yahoo!
2009-12-14 18:07 . 2009-07-31 04:35 1172480 ——w- c:\windows\system32\dllcache\msxml3.dll
2009-12-14 18:07 . 2005-11-01 10:35 106496 —-a-r- c:\windows\system32\VModes.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-21 12:18 . 2009-12-21 12:18 4 —-a-w- c:\windows\system32\microday08.dll
2009-12-18 22:45 . 2009-12-14 17:56 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-15 08:47 . 2009-12-14 17:29 86327 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-14 18:06 . 2009-12-14 18:06 ——– d—–w- c:\program files\S3
2009-12-14 17:59 . 2009-12-14 17:59 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-10-29 07:45 . 2006-01-13 01:26 916480 ——w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2006-01-13 01:31 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2006-01-13 01:16 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2006-01-13 01:31 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2006-01-13 01:54 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2006-01-13 01:23 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2006-01-13 01:48 79872 —-a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 14:56 1175944 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5322040]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Google Update"="c:\documents and settings\EFST031692\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-14 205296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-03 18789408]
"VTTimer"="VTTimer.exe" [2006-09-21 122880]
"S3Trayp"="S3trayp.exe" [2007-06-11 253952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-14 218912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 183152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 1017208]
"ats"="c:\windows\system32\asd\loadqm.exe" [2005-08-26 737280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-01-13 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2005-12-14 12:13 7246896 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\PROGRA~1\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe"=
"c:\\WINDOWS\\BricoPacks\\Vista Inspirat 2\\RocketDock\\RocketDock.exe"=
"d:\\FreeStyle\\FreeStyle.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"d:\\FreeStyle\\FSLauncher.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\WINDOWS\\BricoPacks\\Vista Inspirat 2\\YzShadow\\YzShadow.exe"=
"c:\\Documents and Settings\\EFST031692\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\VTTimer.exe"=
"c:\\WINDOWS\\system32\\S3trayp.exe"=
"c:\\Program Files\\Mozilla Firefox\\crashreporter.exe"=

R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\lortm.sys –> c:\windows\system32\drivers\lortm.sys [?]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [12/14/2009 6:06 PM 714240]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/14/2009 5:56 PM 1691480]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp –> c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\EFST031692\Application Data\Mozilla\Firefox\Profiles\lx64y3t8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\EFST031692\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-FamilyFeudOnlineParty - c:\program files\iWin\FamilyFeudOnlineParty\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-21 12:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ats = c:\windows\system32\asd\loadqm.exe noshow???e?s?s?.?????????????????,?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\EFST03~1\LOCALS~1\Temp\CKTC7.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1068)
c:\windows\system32\WININET.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\VTTimer.exe
c:\windows\system32\S3trayp.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
c:\docume~1\EFST03~1\LOCALS~1\Temp\winswlpmc.exe
.
**************************************************************************
.
Completion time: 2009-12-21 12:22:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-21 12:22
ComboFix2.txt 2009-12-21 10:47

Pre-Run: 6,157,180,928 bytes free
Post-Run: 6,450,073,600 bytes free

- - End Of File - - A16161FC7E74E530C3F301F093960A54

DONE.

CatByte

Post #10December 21, 2009, 4:54 AM UTC

Hi,

You may be infected with sality, we need to do an online scan to verify,

Please do the following:

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

EFST031692

Post #11December 21, 2009, 5:02 AM UTC

my browser (IE, Mozilla) can't open the said page. even kaspersky.com ("Server not found.") T_T

CatByte

Post #12December 21, 2009, 5:06 AM UTC

http://www.kaspersky.com/kos/eng/partner/d…n=1261371927695

paste that URL into the address bar of your browser and see if you can reach it

EFST031692

Post #13December 21, 2009, 5:29 AM UTC

i still can't. T_T i really can't access any AV websites. but there are some w/c i can access, still, i can't execute any AV. it terminates itself immediately.

EFST031692

Post #14December 21, 2009, 5:29 AM UTC

i still can't. T_T i really can't access any AV websites. but there are some w/c i can access, still, i can't execute any AV. it terminates itself immediately.

CatByte

Post #15December 21, 2009, 5:59 AM UTC last edited December 21, 2009, 6:01 AM UTC

Hi,

Please run the following scan:

This tool tends to be quite aggressive, so please be sure to configure it exactly as listed below. I only want to see a Report of what it finds.
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and click 'Start' to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, we need to change the default settings.
In the Menu Bar at the top, click 'Setting'>Change Settings.
Click on the Actions tab
Using the drop down menus, change each item under Objects and Malware to Report
Next, 'tick' Complete Scan.
Click the green arrow at the right, and the scan will start.
Click 'No to All' if it asks if you want to cure/move the file.
After the scan has completed, in the Dr.Web CureIt menu on top, click File and choose Save Report List
Save the report to your desktop. The report will be called DrWeb.csv (you may need to rename it to DrWeb.txt in order to post it)
Close Dr.Web Cureit.
Post the contents of the log from Dr.Web you saved previously in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Problem with stability of my computer

✨ Ask AI

Ask AI