Searchqu Hijack

ComboFix 11-05-06.03 - cj_007 05/07/2011 13:28:52.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.1109 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\cj_007\Desktop\cfscript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
————— FCopy —————
.
c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll –> c:\windows\System32\user32.dll
.
((((((((((((((((((((((((( Files Created from 2011-04-07 to 2011-05-07 )))))))))))))))))))))))))))))))
.
.
2011-07-09 17:26 . 2011-07-09 17:26 102400 —-a-w- c:\windows\RegBootClean.exe
2011-07-03 22:23 . 2011-07-03 22:23 ——– d—–w- c:\users\cj_007\AppData\Local\7Wonders2
2011-07-03 16:59 . 2011-07-03 16:59 ——– d—–w- c:\programdata\Sandlot Games
2011-07-03 13:20 . 2011-07-03 19:18 ——– d—–w- c:\users\cj_007\AppData\Roaming\Gaijin Ent
2011-07-02 11:18 . 2011-07-02 11:48 ——– d—–w- c:\users\cj_007\AppData\Roaming\PlayFirst
2011-07-02 11:18 . 2011-07-02 11:48 ——– d—–w- c:\programdata\PlayFirst
2011-07-02 08:33 . 2011-07-02 08:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\EnchantedCavern
2011-07-02 07:53 . 2011-07-02 07:58 ——– d—–w- c:\users\cj_007\AppData\Roaming\Virtual City
2011-07-02 04:24 . 2011-07-02 04:25 ——– d—–w- c:\users\cj_007\AppData\Roaming\Farm Mania 2
2011-07-02 02:48 . 2011-07-03 16:46 ——– d—–w- c:\users\cj_007\AppData\Roaming\iWin
2011-07-02 02:34 . 2011-07-02 02:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\PoBros
2011-07-02 02:34 . 2011-07-02 02:34 ——– d—–w- c:\programdata\PoBros
2011-06-30 08:57 . 2011-06-30 08:57 ——– d—–w- c:\users\cj_007\AppData\Roaming\Exent Technologies
2011-06-30 07:33 . 2011-06-30 07:33 ——– d—–w- c:\program files\ConduitEngine
2011-06-30 07:33 . 2011-06-30 07:33 ——– d—–w- c:\program files\Free_Ride_Games
2011-06-30 07:31 . 2011-07-04 18:23 ——– d—–w- C:\Remote Programs
2011-06-30 07:31 . 2011-06-30 07:31 ——– d—–w- c:\programdata\Free Ride Games
2011-06-30 07:31 . 2011-03-15 03:18 57536 ——w- c:\windows\ExentInfo.exe
2011-06-30 07:31 . 2011-06-30 07:32 ——– d—–w- c:\program files\Free Ride Games
2011-06-30 07:30 . 2001-09-04 18:18 77824 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-06-30 07:30 . 2001-09-04 18:18 225280 —-a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2011-06-30 07:30 . 2001-09-04 18:14 176128 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-06-30 07:30 . 2001-09-04 18:13 32768 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-06-30 07:30 . 2003-02-06 14:07 614532 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2011-06-29 10:35 . 2011-06-29 10:35 ——– d—–w- c:\users\cj_007\AppData\Local\PackageAware
2011-06-29 08:47 . 2011-06-29 08:47 ——– d—–w- c:\users\cj_007\AppData\Roaming\SpinTop
2011-06-08 09:31 . 2010-02-09 14:50 377 —-a-w- c:\users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\homepg.cmd
2011-06-07 10:59 . 2011-06-07 10:59 ——– d—–w- c:\program files\iPod
2011-06-07 10:59 . 2011-06-07 10:59 ——– d—–w- c:\program files\iTunes
2011-05-22 06:53 . 2011-05-22 06:53 ——– d—–w- c:\users\cj_007\AppData\Roaming\Big Fish Games
2011-05-20 15:47 . 2011-05-20 15:47 258352 —-a-w- c:\windows\system32\unicows.dll
2011-05-19 08:59 . 2011-05-19 08:59 ——– d—–w- c:\users\cj_007\AppData\Roaming\DivoGames
2011-05-11 13:31 . 2010-09-09 08:43 819200 —-a-w- c:\windows\system32\xvidcore.dll
2011-05-11 13:31 . 2010-09-09 08:43 77824 —-a-w- c:\windows\system32\xvid.ax
2011-05-11 13:31 . 2010-09-09 08:43 180224 —-a-w- c:\windows\system32\xvidvfw.dll
2011-05-11 13:31 . 2011-05-11 13:31 ——– d—–w- c:\users\cj_007\AppData\Local\Mail.Ru
2011-05-11 12:28 . 2011-05-11 12:28 ——– d—–w- c:\program files\Plants vs Zombies
2011-05-11 11:09 . 2011-05-11 11:09 ——– d—–w- c:\programdata\Driver Boost
2011-05-11 09:34 . 2011-05-11 09:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\Unity
2011-05-11 09:27 . 2011-05-12 07:28 ——– d—–w- c:\users\cj_007\AppData\Local\Unity
2011-05-07 03:34 . 2011-05-07 03:34 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-05-06 19:39 . 2011-05-06 19:39 ——– d—–w- C:\_OTL
2011-05-06 18:52 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F57E5FA2-C82B-4FB1-996B-59FCDB838C49}\mpengine.dll
2011-05-03 21:17 . 2010-09-14 06:07 276992 —-a-w- c:\windows\system32\wcncsvc.dll
2011-04-26 22:24 . 2011-01-07 07:31 442880 —-a-w- c:\windows\system32\XpsPrint.dll
2011-04-26 22:24 . 2011-01-07 07:31 288256 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-23 16:31 . 2011-04-24 00:27 ——– d—–w- c:\users\cj_007\AppData\Local\Apple Computer
2011-04-23 16:31 . 2011-04-23 17:01 ——– d—–w- c:\users\cj_007\AppData\Roaming\Apple Computer
2011-04-23 16:31 . 2009-05-18 03:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-04-23 16:31 . 2008-04-17 02:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-04-23 16:31 . 2011-04-23 16:31 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-04-23 16:27 . 2011-06-07 10:59 ——– d—–w- c:\programdata\Apple Computer
2011-04-23 16:27 . 2011-04-23 16:28 ——– d—–w- c:\program files\QuickTime
2011-04-23 16:27 . 2011-04-23 16:27 ——– d—–w- c:\users\cj_007\AppData\Local\Apple
2011-04-23 16:27 . 2011-04-23 16:27 ——– d—–w- c:\program files\Apple Software Update
2011-04-23 16:26 . 2011-04-23 16:26 ——– d—–w- c:\program files\Bonjour
2011-04-23 16:26 . 2011-06-07 10:59 ——– d—–w- c:\program files\Common Files\Apple
2011-04-23 16:26 . 2011-04-23 16:26 ——– d—–w- c:\programdata\Apple
2011-04-21 10:32 . 2011-04-21 10:32 ——– d—–w- c:\program files\Protector Suite
2011-04-21 05:17 . 2011-05-20 19:26 ——– d—–w- C:\Perfect World Entertainment
2011-04-20 13:14 . 2011-05-20 22:02 ——– d—–w- c:\users\cj_007\AppData\Roaming\GetRightToGo
2011-04-20 12:52 . 2011-04-20 12:52 ——– d—–w- c:\program files\Aveyond - The Darkthrop Prophecy
2011-04-20 04:19 . 2011-04-20 04:19 ——– d—–w- c:\users\cj_007\AppData\Roaming\Silverback Productions
2011-04-20 03:17 . 2011-04-20 03:49 ——– d—–w- c:\users\cj_007\AppData\Roaming\Whisper of a Rose Saves
2011-04-19 09:40 . 2011-04-19 09:41 ——– d—–w- c:\program files\Whisper of a Rose
2011-04-19 09:37 . 2011-04-19 09:38 ——– d—–w- c:\program files\Secrets of the Dragon Wheel
2011-04-19 07:58 . 2011-04-19 07:59 ——– d—–w- c:\program files\The Dragon Dance
2011-04-19 07:45 . 2011-04-19 07:45 ——– d—–w- c:\users\cj_007\AppData\Roaming\ERS Game Studios
2011-04-19 07:42 . 2011-04-19 07:42 ——– d—–w- c:\program files\Diner Dash
2011-04-19 07:27 . 2011-04-19 07:27 ——– d—–w- c:\users\cj_007\AppData\Roaming\3Stars
2011-04-18 11:46 . 2011-04-18 11:46 ——– d—–w- c:\users\cj_007\AppData\Roaming\Aveyond 3
2011-04-18 10:26 . 2011-04-18 10:26 ——– d—–w- c:\program files\Adventures of Robinson Crusoe
2011-04-18 10:22 . 2011-04-18 10:24 ——– d—–w- c:\program files\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
2011-04-18 09:54 . 2011-04-18 09:56 ——– d—–w- c:\program files\Mystery Case Files - 13th Skull
2011-04-18 09:52 . 2011-04-18 09:53 ——– d—–w- c:\program files\Alexandra Fortune - Mystery of the Lunar Archipelago
2011-04-18 09:35 . 2011-04-18 09:51 ——– d—–w- c:\program files\Chronicles of Mystery - Tree of Life
2011-04-18 08:57 . 2011-04-18 08:58 ——– d—–w- c:\program files\iCarly - iDream in Toons
2011-04-18 08:54 . 2011-04-18 08:55 ——– d—–w- c:\program files\Jack of All Tribes
2011-04-18 08:47 . 2011-04-18 08:47 ——– d—–w- c:\program files\Virtual Villagers
2011-04-17 03:38 . 2011-04-17 03:38 ——– d—–w- c:\program files\Microsoft.NET
2011-04-14 09:31 . 2011-05-13 11:10 ——– d—–w- c:\programdata\Big Fish Games
2011-04-14 09:31 . 2011-05-11 12:21 ——– d—–w- c:\program files\bfgclient
2011-04-14 09:27 . 2011-04-14 09:27 ——– d—–w- c:\program files\Common Files\Akamai
2011-04-12 23:33 . 2011-01-05 03:37 2329088 —-a-w- c:\windows\system32\win32k.sys
2011-04-12 07:10 . 2011-06-30 07:33 ——– d—–w- c:\users\cj_007\AppData\Local\Conduit
2011-04-11 10:35 . 2011-06-30 07:31 ——– d—–w- C:\BigFishGamesCache
2011-04-11 07:15 . 2011-04-11 07:15 ——– d—–w- c:\users\cj_007\AppData\Roaming\Vivox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-06 19:42 . 2010-06-24 00:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-22 03:59 . 2009-07-13 23:40 409088 —-a-w- c:\windows\system32\systemcpl.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f92a9fe4-2850-4198-b9d5-279880e49b16}"= "c:\program files\Free_Ride_Games\prxtbFree.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
2011-03-28 16:22 176936 —-a-w- c:\program files\Free_Ride_Games\prxtbFree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f92a9fe4-2850-4198-b9d5-279880e49b16}"= "c:\program files\Free_Ride_Games\prxtbFree.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-03-15 4804792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-03-15 4804792]
.
c:\users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
homepg.cmd [2010-2-10 377]
IMVU.lnk - c:\users\cj_007\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 136176]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-22 1343400]
R3 XDva375;XDva375;c:\windows\system32\XDva375.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S2 X4HSEx;X4HSEx;c:\program files\Free Ride Games\X4HSEx.Sys [2010-03-10 56352]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-02 9344]
S3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\DRIVERS\SonyPI.sys [2007-08-02 14720]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 07:49]
.
2011-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 07:49]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://myfastwebsearch.com/
FF - ProfilePath - c:\users\cj_007\AppData\Roaming\Mozilla\Firefox\Profiles\kcgk5qax.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-201990366-3703982365-30403771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-201990366-3703982365-30403771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-05-07 13:35:58
ComboFix-quarantined-files.txt 2011-05-07 03:35
ComboFix2.txt 2011-05-06 19:53
.
Pre-Run: 305,366,581,248 bytes free
Post-Run: 305,318,658,048 bytes free
.
- - End Of File - - 0D6FCE580AB239F27FA6A30279071B98

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 6526

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5/7/2011 1:58:38 PM
mbam-log-2011-05-07 (13-58-38).txt

Scan type: Quick scan
Objects scanned: 146628
Time elapsed: 2 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\[removed] (Adware.HotBar) -> Value: [removed] -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

C:\Qoobox\Quarantine\C\Program Files\HBLite\bin\11.0.363.0\HBLiteSAAX.dll.vir probably a variant of Win32/Adware.HotBar.E application
C:\Qoobox\Quarantine\C\Program Files\HBLite\bin\11.0.363.0\HBLiteUninstaller.exe.vir probably a variant of Win32/Adware.HotBar.E application
C:\Qoobox\Quarantine\C\Program Files\HBLite\bin\11.0.363.0\firefox\extensions\plugins\npclntax_HBLiteSA.dll.vir Win32/Adware.HotBar.J application
C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\plugins\npclntax_HBLiteSA.dll.vir Win32/Adware.HotBar.J application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\22MZDQU5\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[1].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[2].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[3].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[4].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[2].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CNLGJLCK\upgrade[1].cab a variant of Win32/Adware.OneStep.Z application
C:\Windows.old\Documents and Settings\CeeJay\AppData\Local\Application Data\Temp\SweetIMReinstall\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Documents and Settings\CeeJay\AppData\Local\Temp\SweetIMReinstall\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup(3).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup.exe a variant of Win32/SweetIM.B application
C:\Windows.old\Documents and Settings\CeeJay\Local Settings\Temp\SweetIMReinstall\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Users\CeeJay\AppData\Local\Temp\SweetIMReinstall\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Users\CeeJay\Downloads\SweetImSetup(2).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Users\CeeJay\Downloads\SweetImSetup(3).exe a variant of Win32/SweetIM.B application
C:\Windows.old\Users\CeeJay\Downloads\SweetImSetup.exe a variant of Win32/SweetIM.B application
C:\Windows.old\Users\CeeJay\Local Settings\Temp\SweetIMReinstall\SweetImSetup(2).exe a variant of Win32/SweetIM.B application

ComboFix 11-05-06.03 - cj_007 05/08/2011 0:02.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.994 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\cj_007\Desktop\cfscript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows.old\Documents and Settings\CeeJay\AppData\Local\Application Data\Temp\SweetIMReinstall\SweetImSetup(2).exe"
"c:\windows.old\Documents and Settings\CeeJay\AppData\Local\Temp\SweetIMReinstall\SweetImSetup(2).exe"
"c:\windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup(2).exe"
"c:\windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup(3).exe"
"c:\windows.old\Documents and Settings\CeeJay\Downloads\SweetImSetup.exe"
"c:\windows.old\Documents and Settings\CeeJay\Local Settings\Temp\SweetIMReinstall\SweetImSetup(2).exe"
"c:\windows.old\Users\CeeJay\AppData\Local\Temp\SweetIMReinstall\SweetImSetup(2).exe"
"c:\windows.old\Users\CeeJay\Downloads\SweetImSetup(2).exe"
"c:\windows.old\Users\CeeJay\Downloads\SweetImSetup(3).exe"
"c:\windows.old\Users\CeeJay\Downloads\SweetImSetup.exe"
"c:\windows.old\Users\CeeJay\Local Settings\Temp\SweetIMReinstall\SweetImSetup(2).exe"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\22MZDQU5\upgrade[1].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[1].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[2].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[3].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[4].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[1].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[2].cab"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CNLGJLCK\upgrade[1].cab"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows.old\Users\CeeJay\AppData\Local\Temp\SweetIMReinstall\SweetImSetup(2).exe
c:\windows.old\Users\CeeJay\Downloads\SweetImSetup(2).exe
c:\windows.old\Users\CeeJay\Downloads\SweetImSetup(3).exe
c:\windows.old\Users\CeeJay\Downloads\SweetImSetup.exe
c:\windows.old\Users\CeeJay\Local Settings\Temp\SweetIMReinstall\SweetImSetup(2).exe
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\22MZDQU5\upgrade[1].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[1].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[2].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[3].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADEVOW6P\upgrade[4].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[1].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWM0OZ2J\upgrade[2].cab
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CNLGJLCK\upgrade[1].cab
.
.
((((((((((((((((((((((((( Files Created from 2011-04-07 to 2011-05-07 )))))))))))))))))))))))))))))))
.
.
2011-07-09 17:26 . 2011-07-09 17:26 102400 —-a-w- c:\windows\RegBootClean.exe
2011-07-03 22:23 . 2011-07-03 22:23 ——– d—–w- c:\users\cj_007\AppData\Local\7Wonders2
2011-07-03 16:59 . 2011-07-03 16:59 ——– d—–w- c:\programdata\Sandlot Games
2011-07-03 13:20 . 2011-07-03 19:18 ——– d—–w- c:\users\cj_007\AppData\Roaming\Gaijin Ent
2011-07-02 11:18 . 2011-07-02 11:48 ——– d—–w- c:\users\cj_007\AppData\Roaming\PlayFirst
2011-07-02 11:18 . 2011-07-02 11:48 ——– d—–w- c:\programdata\PlayFirst
2011-07-02 08:33 . 2011-07-02 08:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\EnchantedCavern
2011-07-02 07:53 . 2011-07-02 07:58 ——– d—–w- c:\users\cj_007\AppData\Roaming\Virtual City
2011-07-02 04:24 . 2011-07-02 04:25 ——– d—–w- c:\users\cj_007\AppData\Roaming\Farm Mania 2
2011-07-02 02:48 . 2011-07-03 16:46 ——– d—–w- c:\users\cj_007\AppData\Roaming\iWin
2011-07-02 02:34 . 2011-07-02 02:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\PoBros
2011-07-02 02:34 . 2011-07-02 02:34 ——– d—–w- c:\programdata\PoBros
2011-06-30 08:57 . 2011-06-30 08:57 ——– d—–w- c:\users\cj_007\AppData\Roaming\Exent Technologies
2011-06-30 07:33 . 2011-06-30 07:33 ——– d—–w- c:\program files\ConduitEngine
2011-06-30 07:33 . 2011-06-30 07:33 ——– d—–w- c:\program files\Free_Ride_Games
2011-06-30 07:31 . 2011-07-04 18:23 ——– d—–w- C:\Remote Programs
2011-06-30 07:31 . 2011-06-30 07:31 ——– d—–w- c:\programdata\Free Ride Games
2011-06-30 07:31 . 2011-03-15 03:18 57536 ——w- c:\windows\ExentInfo.exe
2011-06-30 07:31 . 2011-06-30 07:32 ——– d—–w- c:\program files\Free Ride Games
2011-06-30 07:30 . 2001-09-04 18:18 77824 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-06-30 07:30 . 2001-09-04 18:18 225280 —-a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2011-06-30 07:30 . 2001-09-04 18:14 176128 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-06-30 07:30 . 2001-09-04 18:13 32768 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-06-30 07:30 . 2003-02-06 14:07 614532 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2011-06-29 10:35 . 2011-06-29 10:35 ——– d—–w- c:\users\cj_007\AppData\Local\PackageAware
2011-06-29 08:47 . 2011-06-29 08:47 ——– d—–w- c:\users\cj_007\AppData\Roaming\SpinTop
2011-06-08 09:31 . 2010-02-09 14:50 377 —-a-w- c:\users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\homepg.cmd
2011-06-07 10:59 . 2011-06-07 10:59 ——– d—–w- c:\program files\iPod
2011-06-07 10:59 . 2011-06-07 10:59 ——– d—–w- c:\program files\iTunes
2011-05-22 06:53 . 2011-05-22 06:53 ——– d—–w- c:\users\cj_007\AppData\Roaming\Big Fish Games
2011-05-20 15:47 . 2011-05-20 15:47 258352 —-a-w- c:\windows\system32\unicows.dll
2011-05-19 08:59 . 2011-05-19 08:59 ——– d—–w- c:\users\cj_007\AppData\Roaming\DivoGames
2011-05-11 13:31 . 2010-09-09 08:43 819200 —-a-w- c:\windows\system32\xvidcore.dll
2011-05-11 13:31 . 2010-09-09 08:43 77824 —-a-w- c:\windows\system32\xvid.ax
2011-05-11 13:31 . 2010-09-09 08:43 180224 —-a-w- c:\windows\system32\xvidvfw.dll
2011-05-11 13:31 . 2011-05-11 13:31 ——– d—–w- c:\users\cj_007\AppData\Local\Mail.Ru
2011-05-11 12:28 . 2011-05-11 12:28 ——– d—–w- c:\program files\Plants vs Zombies
2011-05-11 11:09 . 2011-05-11 11:09 ——– d—–w- c:\programdata\Driver Boost
2011-05-11 09:34 . 2011-05-11 09:34 ——– d—–w- c:\users\cj_007\AppData\Roaming\Unity
2011-05-11 09:27 . 2011-05-12 07:28 ——– d—–w- c:\users\cj_007\AppData\Local\Unity
2011-05-07 14:07 . 2011-05-07 14:07 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-05-07 04:09 . 2011-05-07 04:09 ——– d—–w- c:\program files\ESET
2011-05-07 03:53 . 2011-05-07 03:53 ——– d—–w- c:\users\cj_007\AppData\Roaming\Malwarebytes
2011-05-07 03:53 . 2011-05-07 03:53 ——– d—–w- c:\programdata\Malwarebytes
2011-05-07 03:53 . 2010-11-29 07:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-07 03:53 . 2011-05-07 03:53 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-07 03:53 . 2010-11-29 07:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-06 19:39 . 2011-05-06 19:39 ——– d—–w- C:\_OTL
2011-05-06 18:52 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F57E5FA2-C82B-4FB1-996B-59FCDB838C49}\mpengine.dll
2011-05-03 21:17 . 2010-09-14 06:07 276992 —-a-w- c:\windows\system32\wcncsvc.dll
2011-04-26 22:24 . 2011-01-07 07:31 442880 —-a-w- c:\windows\system32\XpsPrint.dll
2011-04-26 22:24 . 2011-01-07 07:31 288256 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-23 16:31 . 2011-04-24 00:27 ——– d—–w- c:\users\cj_007\AppData\Local\Apple Computer
2011-04-23 16:31 . 2011-04-23 17:01 ——– d—–w- c:\users\cj_007\AppData\Roaming\Apple Computer
2011-04-23 16:31 . 2009-05-18 03:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-04-23 16:31 . 2008-04-17 02:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-04-23 16:31 . 2011-04-23 16:31 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-04-23 16:27 . 2011-06-07 10:59 ——– d—–w- c:\programdata\Apple Computer
2011-04-23 16:27 . 2011-04-23 16:28 ——– d—–w- c:\program files\QuickTime
2011-04-23 16:27 . 2011-04-23 16:27 ——– d—–w- c:\users\cj_007\AppData\Local\Apple
2011-04-23 16:27 . 2011-04-23 16:27 ——– d—–w- c:\program files\Apple Software Update
2011-04-23 16:26 . 2011-04-23 16:26 ——– d—–w- c:\program files\Bonjour
2011-04-23 16:26 . 2011-06-07 10:59 ——– d—–w- c:\program files\Common Files\Apple
2011-04-23 16:26 . 2011-04-23 16:26 ——– d—–w- c:\programdata\Apple
2011-04-21 10:32 . 2011-04-21 10:32 ——– d—–w- c:\program files\Protector Suite
2011-04-21 05:17 . 2011-05-20 19:26 ——– d—–w- C:\Perfect World Entertainment
2011-04-20 13:14 . 2011-05-20 22:02 ——– d—–w- c:\users\cj_007\AppData\Roaming\GetRightToGo
2011-04-20 12:52 . 2011-04-20 12:52 ——– d—–w- c:\program files\Aveyond - The Darkthrop Prophecy
2011-04-20 04:19 . 2011-04-20 04:19 ——– d—–w- c:\users\cj_007\AppData\Roaming\Silverback Productions
2011-04-20 03:17 . 2011-04-20 03:49 ——– d—–w- c:\users\cj_007\AppData\Roaming\Whisper of a Rose Saves
2011-04-19 09:40 . 2011-04-19 09:41 ——– d—–w- c:\program files\Whisper of a Rose
2011-04-19 09:37 . 2011-04-19 09:38 ——– d—–w- c:\program files\Secrets of the Dragon Wheel
2011-04-19 07:58 . 2011-04-19 07:59 ——– d—–w- c:\program files\The Dragon Dance
2011-04-19 07:45 . 2011-04-19 07:45 ——– d—–w- c:\users\cj_007\AppData\Roaming\ERS Game Studios
2011-04-19 07:42 . 2011-04-19 07:42 ——– d—–w- c:\program files\Diner Dash
2011-04-19 07:27 . 2011-04-19 07:27 ——– d—–w- c:\users\cj_007\AppData\Roaming\3Stars
2011-04-18 11:46 . 2011-04-18 11:46 ——– d—–w- c:\users\cj_007\AppData\Roaming\Aveyond 3
2011-04-18 10:26 . 2011-04-18 10:26 ——– d—–w- c:\program files\Adventures of Robinson Crusoe
2011-04-18 10:22 . 2011-04-18 10:24 ——– d—–w- c:\program files\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
2011-04-18 09:54 . 2011-04-18 09:56 ——– d—–w- c:\program files\Mystery Case Files - 13th Skull
2011-04-18 09:52 . 2011-04-18 09:53 ——– d—–w- c:\program files\Alexandra Fortune - Mystery of the Lunar Archipelago
2011-04-18 09:35 . 2011-04-18 09:51 ——– d—–w- c:\program files\Chronicles of Mystery - Tree of Life
2011-04-18 08:57 . 2011-04-18 08:58 ——– d—–w- c:\program files\iCarly - iDream in Toons
2011-04-18 08:54 . 2011-04-18 08:55 ——– d—–w- c:\program files\Jack of All Tribes
2011-04-18 08:47 . 2011-04-18 08:47 ——– d—–w- c:\program files\Virtual Villagers
2011-04-17 03:38 . 2011-04-17 03:38 ——– d—–w- c:\program files\Microsoft.NET
2011-04-14 09:31 . 2011-05-13 11:10 ——– d—–w- c:\programdata\Big Fish Games
2011-04-14 09:31 . 2011-05-11 12:21 ——– d—–w- c:\program files\bfgclient
2011-04-14 09:27 . 2011-04-14 09:27 ——– d—–w- c:\program files\Common Files\Akamai
2011-04-12 23:33 . 2011-01-05 03:37 2329088 —-a-w- c:\windows\system32\win32k.sys
2011-04-12 07:10 . 2011-06-30 07:33 ——– d—–w- c:\users\cj_007\AppData\Local\Conduit
2011-04-11 10:35 . 2011-06-30 07:31 ——– d—–w- C:\BigFishGamesCache
2011-04-11 07:15 . 2011-04-11 07:15 ——– d—–w- c:\users\cj_007\AppData\Roaming\Vivox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-06 19:42 . 2010-06-24 00:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-22 03:59 . 2009-07-13 23:40 409088 —-a-w- c:\windows\system32\systemcpl.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f92a9fe4-2850-4198-b9d5-279880e49b16}"= "c:\program files\Free_Ride_Games\prxtbFree.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
2011-03-28 16:22 176936 —-a-w- c:\program files\Free_Ride_Games\prxtbFree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f92a9fe4-2850-4198-b9d5-279880e49b16}"= "c:\program files\Free_Ride_Games\prxtbFree.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f92a9fe4-2850-4198-b9d5-279880e49b16}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-03-15 4804792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-03-15 4804792]
.
c:\users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
homepg.cmd [2010-2-10 377]
IMVU.lnk - c:\users\cj_007\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 136176]
R3 CFcatchme;CFcatchme;c:\users\cj_007\AppData\Local\Temp\CFcatchme.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 136176]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-22 1343400]
R3 XDva375;XDva375;c:\windows\system32\XDva375.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S2 X4HSEx;X4HSEx;c:\program files\Free Ride Games\X4HSEx.Sys [2010-03-10 56352]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-02 9344]
S3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\DRIVERS\SonyPI.sys [2007-08-02 14720]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 07:49]
.
2011-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-30 07:49]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://myfastwebsearch.com/
FF - ProfilePath - c:\users\cj_007\AppData\Roaming\Mozilla\Firefox\Profiles\kcgk5qax.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-201990366-3703982365-30403771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-201990366-3703982365-30403771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2011-05-08 00:12:39 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-07 14:12
ComboFix2.txt 2011-05-07 03:35
ComboFix3.txt 2011-05-06 19:53
.
Pre-Run: 304,713,465,856 bytes free
Post-Run: 304,651,952,128 bytes free
.
- - End Of File - - 6F8FFD0517800782FFB6E58A6543D509

OTL logfile created on: 5/8/2011 12:24:58 AM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\cj_007\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 283.80 Gb Free Space | 60.93% Space Free | Partition Type: NTFS

Computer Name: CJ_007-PC | User Name: cj_007 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\cj_007\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\cj_007\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (X4HSEx) – C:\Program Files\Free Ride Games\X4HSEx.sys (Exent Technologies Ltd.)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (TPM) – C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (SPI) – C:\Windows\System32\drivers\SonyPI.sys (Sony Corporation)
DRV - (SFEP) – C:\Windows\System32\drivers\SFEP.sys (Sony Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\prxtbFree.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://myfastwebsearch.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 DD 48 99 5E 3E CC 01 [binary data]
IE - HKCU\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\prxtbFree.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/02 11:59:52 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/07 05:51:36 | 000,000,000 | —D | M]

[2011/05/07 05:37:44 | 000,000,000 | —D | M] (No name found) – C:\Users\cj_007\AppData\Roaming\Mozilla\Extensions
[2011/04/06 18:41:29 | 000,000,000 | —D | M] (No name found) – C:\Users\cj_007\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/07/10 03:18:31 | 000,000,000 | —D | M] (No name found) – C:\Users\cj_007\AppData\Roaming\Mozilla\Firefox\Profiles\kcgk5qax.default\extensions
[2011/05/07 08:49:35 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2011/05/08 00:09:04 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Free Ride Games Toolbar) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Free Ride Games Toolbar) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\prxtbFree.dll (Conduit Ltd.)
O4 - HKCU..\Run: [Exetender] C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
O4 - Startup: C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\homepg.cmd ()
O4 - Startup: C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Virtual%20Villagers%205%20-%20New%20Believers/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Virtual%20Villagers%205%20-%20New%20Believers/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()


========== Files/Folders - Created Within 30 Days ==========

[2011/07/07 05:56:01 | 000,000,000 | —D | C] – C:\Users\cj_007\Desktop\Games
[2011/07/04 08:23:04 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\7Wonders2
[2011/07/04 02:59:11 | 000,000,000 | —D | C] – C:\ProgramData\Sandlot Games
[2011/07/04 02:48:39 | 000,000,000 | —D | C] – C:\Users\cj_007\Saved Games
[2011/07/03 23:20:10 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Gaijin Ent
[2011/07/02 21:18:23 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\PlayFirst
[2011/07/02 21:18:23 | 000,000,000 | —D | C] – C:\ProgramData\PlayFirst
[2011/07/02 18:33:47 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\EnchantedCavern
[2011/07/02 17:53:56 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Virtual City
[2011/07/02 14:24:46 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Farm Mania 2
[2011/07/02 12:48:18 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\iWin
[2011/07/02 12:34:00 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\PoBros
[2011/07/02 12:34:00 | 000,000,000 | —D | C] – C:\ProgramData\PoBros
[2011/06/30 18:57:54 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Exent Technologies
[2011/06/30 17:35:33 | 000,000,000 | —D | C] – C:\Users\cj_007\Desktop\MOVIES
[2011/06/30 17:33:21 | 000,000,000 | —D | C] – C:\Program Files\ConduitEngine
[2011/06/30 17:33:19 | 000,000,000 | —D | C] – C:\Program Files\Free_Ride_Games
[2011/06/30 17:31:35 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Ride Games
[2011/06/30 17:31:20 | 000,000,000 | —D | C] – C:\Remote Programs
[2011/06/30 17:31:19 | 000,000,000 | —D | C] – C:\ProgramData\Free Ride Games
[2011/06/30 17:31:05 | 000,057,536 | —- | C] (Exent Technologies Ltd.) – C:\Windows\ExentInfo.exe
[2011/06/30 17:31:04 | 000,000,000 | —D | C] – C:\Program Files\Free Ride Games
[2011/06/29 20:35:06 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\PackageAware
[2011/06/29 18:47:44 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\SpinTop
[2011/06/08 18:31:53 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\blinkx beat
[2011/06/07 20:59:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/06/07 20:59:09 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/07 20:59:08 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/05/22 16:53:43 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Big Fish Games
[2011/05/21 05:32:02 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Perfect World Entertainment
[2011/05/21 01:47:39 | 000,258,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unicows.dll
[2011/05/20 20:34:28 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/05/20 07:00:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Perfect World Entertainment
[2011/05/19 18:59:14 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\DivoGames
[2011/05/11 23:33:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Juggernaut EN
[2011/05/11 23:31:55 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\Mail.Ru
[2011/05/11 22:28:35 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Plants vs Zombies
[2011/05/11 22:28:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Plants vs Zombies
[2011/05/11 22:28:35 | 000,000,000 | —D | C] – C:\Program Files\Plants vs Zombies
[2011/05/11 21:09:38 | 000,000,000 | —D | C] – C:\ProgramData\Driver Boost
[2011/05/11 19:34:21 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Unity
[2011/05/11 19:27:47 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\Unity
[2011/05/08 00:19:24 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/05/08 00:09:06 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2011/05/08 00:00:32 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/05/07 14:09:28 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/05/07 13:53:32 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Malwarebytes
[2011/05/07 13:53:26 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/07 13:53:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/07 13:53:26 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/05/07 13:53:23 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/07 13:53:23 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/07 13:52:46 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\WinRAR
[2011/05/07 13:52:46 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/07 13:52:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/07 13:52:40 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2011/05/07 05:43:56 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/05/07 05:43:56 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/05/07 05:43:56 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/05/07 05:43:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/05/07 05:43:40 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/07 05:39:06 | 000,000,000 | —D | C] – C:\_OTL
[2011/05/07 04:42:25 | 000,589,632 | —- | C] (AVAST Software) – C:\Users\cj_007\Desktop\aswMBR.exe
[2011/05/07 03:51:24 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\cj_007\Desktop\OTL.exe
[2011/05/05 14:27:10 | 000,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2011/04/27 08:24:55 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/04/27 08:24:54 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/04/24 02:31:56 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Apple Computer
[2011/04/24 02:31:56 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\Apple Computer
[2011/04/24 02:31:41 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2011/04/24 02:31:12 | 000,000,000 | —D | C] – C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/04/24 02:28:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/04/24 02:27:53 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/04/24 02:27:53 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2011/04/24 02:27:42 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\Apple
[2011/04/24 02:27:35 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2011/04/24 02:26:56 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/24 02:26:31 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2011/04/24 02:26:31 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2011/04/23 19:29:59 | 000,000,000 | —D | C] – C:\Users\cj_007\Documents\IMVU Projects
[2011/04/21 20:32:08 | 000,000,000 | —D | C] – C:\Program Files\Protector Suite
[2011/04/21 15:17:31 | 000,000,000 | —D | C] – C:\Perfect World Entertainment
[2011/04/20 23:14:17 | 000,000,000 | —D | C] – C:\Users\cj_007\Documents\Downloads
[2011/04/20 23:14:15 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\GetRightToGo
[2011/04/20 22:52:35 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aveyond - The Darkthrop Prophecy
[2011/04/20 22:52:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aveyond - The Darkthrop Prophecy
[2011/04/20 22:52:35 | 000,000,000 | —D | C] – C:\Program Files\Aveyond - The Darkthrop Prophecy
[2011/04/20 14:19:57 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Silverback Productions
[2011/04/20 13:17:40 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Whisper of a Rose Saves
[2011/04/19 19:40:52 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Whisper of a Rose
[2011/04/19 19:40:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Whisper of a Rose
[2011/04/19 19:40:52 | 000,000,000 | —D | C] – C:\Program Files\Whisper of a Rose
[2011/04/19 19:37:49 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Secrets of the Dragon Wheel
[2011/04/19 19:37:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secrets of the Dragon Wheel
[2011/04/19 19:37:49 | 000,000,000 | —D | C] – C:\Program Files\Secrets of the Dragon Wheel
[2011/04/19 17:58:51 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Dragon Dance
[2011/04/19 17:58:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Dragon Dance
[2011/04/19 17:58:50 | 000,000,000 | —D | C] – C:\Program Files\The Dragon Dance
[2011/04/19 17:45:39 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\ERS Game Studios
[2011/04/19 17:42:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diner Dash
[2011/04/19 17:42:52 | 000,000,000 | —D | C] – C:\Program Files\Diner Dash
[2011/04/19 17:27:21 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\3Stars
[2011/04/18 21:46:10 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Aveyond 3
[2011/04/18 21:45:19 | 000,000,000 | —D | C] – C:\Users\Public\Documents\BlitPop
[2011/04/18 20:26:33 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adventures of Robinson Crusoe
[2011/04/18 20:26:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adventures of Robinson Crusoe
[2011/04/18 20:26:33 | 000,000,000 | —D | C] – C:\Program Files\Adventures of Robinson Crusoe
[2011/04/18 20:22:28 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
[2011/04/18 20:22:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
[2011/04/18 20:22:28 | 000,000,000 | —D | C] – C:\Program Files\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
[2011/04/18 19:54:26 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - 13th Skull
[2011/04/18 19:54:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - 13th Skull
[2011/04/18 19:54:26 | 000,000,000 | —D | C] – C:\Program Files\Mystery Case Files - 13th Skull
[2011/04/18 19:52:31 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alexandra Fortune - Mystery of the Lunar Archipelago
[2011/04/18 19:52:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alexandra Fortune - Mystery of the Lunar Archipelago
[2011/04/18 19:52:31 | 000,000,000 | —D | C] – C:\Program Files\Alexandra Fortune - Mystery of the Lunar Archipelago
[2011/04/18 19:50:26 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_7.dll
[2011/04/18 19:50:26 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_5.dll
[2011/04/18 19:50:25 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_43.dll
[2011/04/18 19:50:25 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_43.dll
[2011/04/18 19:50:25 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dcsx_43.dll
[2011/04/18 19:50:25 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_43.dll
[2011/04/18 19:50:25 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx11_43.dll
[2011/04/18 19:50:25 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_7.dll
[2011/04/18 19:50:24 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_42.dll
[2011/04/18 19:50:24 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_6.dll
[2011/04/18 19:50:24 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_6.dll
[2011/04/18 19:50:24 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_5.dll
[2011/04/18 19:50:24 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_4.dll
[2011/04/18 19:50:24 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_7.dll
[2011/04/18 19:50:23 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dcsx_42.dll
[2011/04/18 19:50:23 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_41.dll
[2011/04/18 19:50:23 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_42.dll
[2011/04/18 19:50:23 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx11_42.dll
[2011/04/18 19:50:22 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_40.dll
[2011/04/18 19:50:22 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_4.dll
[2011/04/18 19:50:22 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_40.dll
[2011/04/18 19:50:22 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_4.dll
[2011/04/18 19:50:22 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_6.dll
[2011/04/18 19:50:21 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_40.dll
[2011/04/18 19:50:21 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_3.dll
[2011/04/18 19:50:21 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_2.dll
[2011/04/18 19:50:21 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_3.dll
[2011/04/18 19:50:21 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_2.dll
[2011/04/18 19:50:21 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_1.dll
[2011/04/18 19:50:21 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_5.dll
[2011/04/18 19:50:20 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_39.dll
[2011/04/18 19:50:20 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_39.dll
[2011/04/18 19:50:20 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_39.dll
[2011/04/18 19:50:20 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_2.dll
[2011/04/18 19:50:18 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_38.dll
[2011/04/18 19:50:18 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_1.dll
[2011/04/18 19:50:18 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_38.dll
[2011/04/18 19:50:18 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_1.dll
[2011/04/18 19:50:18 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_0.dll
[2011/04/18 19:50:18 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_4.dll
[2011/04/18 19:50:17 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_38.dll
[2011/04/18 19:50:17 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_0.dll
[2011/04/18 19:50:16 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_37.dll
[2011/04/18 19:50:16 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_37.dll
[2011/04/18 19:50:16 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_0.dll
[2011/04/18 19:50:16 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_3.dll
[2011/04/18 19:50:15 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_37.dll
[2011/04/18 19:50:15 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_10.dll
[2011/04/18 19:50:14 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_36.dll
[2011/04/18 19:50:14 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_36.dll
[2011/04/18 19:50:14 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_36.dll
[2011/04/18 19:50:13 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_35.dll
[2011/04/18 19:50:13 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_35.dll
[2011/04/18 19:50:13 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_35.dll
[2011/04/18 19:50:13 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_9.dll
[2011/04/18 19:50:12 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_34.dll
[2011/04/18 19:50:12 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_34.dll
[2011/04/18 19:50:12 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_34.dll
[2011/04/18 19:50:12 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_8.dll
[2011/04/18 19:50:12 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_3.dll
[2011/04/18 19:50:12 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_2.dll
[2011/04/18 19:50:11 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_33.dll
[2011/04/18 19:50:11 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_33.dll
[2011/04/18 19:50:11 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_33.dll
[2011/04/18 19:50:11 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_7.dll
[2011/04/18 19:50:10 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_31.dll
[2011/04/18 19:50:10 | 000,440,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10.dll
[2011/04/18 19:50:10 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_6.dll
[2011/04/18 19:50:10 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_5.dll
[2011/04/18 19:50:10 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_4.dll
[2011/04/18 19:50:10 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_1.dll
[2011/04/18 19:50:09 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_3.dll
[2011/04/18 19:50:09 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_2.dll
[2011/04/18 19:50:08 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_2.dll
[2011/04/18 19:50:08 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_1.dll
[2011/04/18 19:50:08 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_1.dll
[2011/04/18 19:50:05 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_30.dll
[2011/04/18 19:50:02 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_25.dll
[2011/04/18 19:50:02 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_29.dll
[2011/04/18 19:50:02 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_28.dll
[2011/04/18 19:50:02 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_26.dll
[2011/04/18 19:50:02 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_0.dll
[2011/04/18 19:50:02 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_0.dll
[2011/04/18 19:50:01 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_24.dll
[2011/04/18 19:37:47 | 000,000,000 | —D | C] – C:\Windows\System32\directx
[2011/04/18 19:35:49 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chronicles of Mystery - Tree of Life
[2011/04/18 19:35:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chronicles of Mystery - Tree of Life
[2011/04/18 19:35:49 | 000,000,000 | —D | C] – C:\Program Files\Chronicles of Mystery - Tree of Life
[2011/04/18 18:58:00 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iCarly - iDream in Toons
[2011/04/18 18:58:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCarly - iDream in Toons
[2011/04/18 18:57:59 | 000,000,000 | —D | C] – C:\Program Files\iCarly - iDream in Toons
[2011/04/18 18:54:48 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jack of All Tribes
[2011/04/18 18:54:48 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jack of All Tribes
[2011/04/18 18:54:47 | 000,000,000 | —D | C] – C:\Program Files\Jack of All Tribes
[2011/04/18 18:47:02 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virtual Villagers
[2011/04/18 18:47:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Villagers
[2011/04/18 18:47:02 | 000,000,000 | —D | C] – C:\Program Files\Virtual Villagers
[2011/04/17 13:38:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/04/16 20:38:34 | 000,000,000 | —D | C] – C:\Users\cj_007\Documents\LDW
[2011/04/14 19:39:02 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2011/04/14 19:31:23 | 000,000,000 | —D | C] – C:\ProgramData\Big Fish Games
[2011/04/14 19:31:21 | 000,000,000 | —D | C] – C:\Program Files\bfgclient
[2011/04/14 19:27:54 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Akamai
[2011/04/13 09:33:00 | 002,329,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/13 09:32:56 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/13 09:32:56 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/13 09:32:50 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/04/13 09:32:50 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/04/13 09:32:50 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/04/13 09:32:49 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/13 09:32:49 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/04/13 09:32:49 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/04/13 09:32:49 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/04/13 09:32:49 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/04/13 09:32:49 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/04/13 09:32:44 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/13 09:32:44 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/13 09:32:42 | 003,957,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/04/13 09:32:42 | 003,901,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/04/13 09:32:40 | 001,170,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/04/13 09:32:40 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/04/13 09:32:40 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/04/13 09:32:39 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ExplorerFrame.dll
[2011/04/13 09:32:39 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/04/13 09:32:38 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/04/13 09:32:38 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/04/13 09:32:37 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\upnp.dll
[2011/04/13 09:32:35 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\davclnt.dll
[2011/04/13 09:32:35 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscapi.dll
[2011/04/13 09:32:35 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slwga.dll
[2011/04/13 09:32:34 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgmms1.sys
[2011/04/13 09:32:34 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/04/12 17:10:57 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Local\Conduit
[2011/04/11 20:35:09 | 000,000,000 | —D | C] – C:\BigFishGamesCache
[2011/04/11 17:15:56 | 000,000,000 | —D | C] – C:\Users\cj_007\AppData\Roaming\Vivox

========== Files - Modified Within 30 Days ==========

[2011/07/10 03:32:16 | 000,001,294 | —- | M] () – C:\Windows\RegBootClean.CFG
[2011/07/10 03:26:32 | 000,102,400 | —- | M] () – C:\Windows\RegBootClean.exe
[2011/07/10 03:19:30 | 000,018,509 | —- | M] () – C:\Users\cj_007\Documents\prefs.js.backup
[2011/07/10 03:05:18 | 000,000,036 | —- | M] () – C:\Users\cj_007\AppData\Local\housecall.guid.cache
[2011/07/10 02:52:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/09 06:50:17 | 000,000,811 | —- | M] () – C:\Users\cj_007\Desktop\Play Wizard101.lnk
[2011/06/30 17:31:26 | 000,000,064 | —- | M] () – C:\Windows\GPlrLanc.dat
[2011/06/29 13:18:03 | 000,624,178 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/29 13:18:03 | 000,106,522 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/05/21 01:47:33 | 000,258,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\unicows.dll
[2011/05/11 23:33:32 | 000,001,254 | —- | M] () – C:\Users\cj_007\Application Data\Microsoft\Internet Explorer\Quick Launch\Juggernaut.lnk
[2011/05/11 22:21:07 | 000,001,662 | —- | M] () – C:\Users\cj_007\Application Data\Microsoft\Internet Explorer\Quick Launch\Game Manager.lnk
[2011/05/08 00:09:04 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/05/08 00:08:59 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/08 00:08:19 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/05/08 00:08:06 | 1603,084,288 | -HS- | M] () – C:\hiberfil.sys
[2011/05/07 13:53:27 | 000,001,100 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/07 04:54:39 | 000,016,944 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/07 04:54:39 | 000,016,944 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/07 04:47:43 | 000,000,512 | —- | M] () – C:\Users\cj_007\Desktop\MBR.dat
[2011/05/07 04:46:06 | 273,206,782 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/05/07 04:44:32 | 000,589,632 | —- | M] (AVAST Software) – C:\Users\cj_007\Desktop\aswMBR.exe
[2011/05/07 03:51:35 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\cj_007\Desktop\OTL.exe
[2011/05/07 03:46:54 | 004,342,980 | R— | M] () – C:\Users\cj_007\Desktop\ComboFix.exe
[2011/05/05 13:43:03 | 000,000,880 | —- | M] () – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
[2011/04/21 20:32:17 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_tcwbf_01_09_00.Wdf
[2011/04/21 20:32:17 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2011/04/14 20:10:31 | 000,310,032 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/07/10 03:26:32 | 000,102,400 | —- | C] () – C:\Windows\RegBootClean.exe
[2011/07/10 03:26:32 | 000,001,294 | —- | C] () – C:\Windows\RegBootClean.CFG
[2011/07/10 03:25:33 | 000,018,509 | —- | C] () – C:\Users\cj_007\Documents\prefs.js.backup
[2011/07/10 03:05:18 | 000,000,036 | —- | C] () – C:\Users\cj_007\AppData\Local\housecall.guid.cache
[2011/07/09 06:50:17 | 000,000,811 | —- | C] () – C:\Users\cj_007\Desktop\Play Wizard101.lnk
[2011/06/30 17:31:26 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2011/06/08 19:31:12 | 000,000,377 | —- | C] () – C:\Users\cj_007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\homepg.cmd
[2011/05/20 20:34:19 | 273,206,782 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/05/11 23:33:32 | 000,001,254 | —- | C] () – C:\Users\cj_007\Application Data\Microsoft\Internet Explorer\Quick Launch\Juggernaut.lnk
[2011/05/11 23:31:57 | 000,819,200 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/05/11 23:31:57 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/05/11 23:31:57 | 000,077,824 | —- | C] () – C:\Windows\System32\xvid.ax
[2011/05/07 13:53:27 | 000,001,100 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/07 05:43:56 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/05/07 05:43:56 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/05/07 05:43:56 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/05/07 05:43:56 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/05/07 05:43:56 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/05/07 04:47:43 | 000,000,512 | —- | C] () – C:\Users\cj_007\Desktop\MBR.dat
[2011/05/07 03:44:51 | 004,342,980 | R— | C] () – C:\Users\cj_007\Desktop\ComboFix.exe
[2011/04/24 02:27:36 | 000,002,519 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011/04/21 20:32:17 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_tcwbf_01_09_00.Wdf
[2011/04/21 20:32:17 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2011/04/14 19:37:20 | 000,001,662 | —- | C] () – C:\Users\cj_007\Application Data\Microsoft\Internet Explorer\Quick Launch\Game Manager.lnk
[2011/04/14 19:31:25 | 000,001,869 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
[2011/04/14 19:31:25 | 000,001,224 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\More Great Games.lnk
[2011/04/05 22:54:39 | 000,000,020 | —- | C] () – C:\Windows\mafosav.INI
[2011/03/31 14:47:19 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/30 11:03:41 | 000,056,832 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2011/03/23 02:25:42 | 000,230,752 | —- | C] () – C:\Windows\patchw32.dll
[2011/03/23 02:25:28 | 000,118,176 | —- | C] () – C:\Windows\patchw.dll
[2009/07/14 14:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 14:33:53 | 000,310,032 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 12:05:48 | 000,624,178 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 12:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 12:05:48 | 000,106,522 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 12:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 12:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 12:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 10:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/14 09:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 09:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 09:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/14 08:09:19 | 001,498,564 | —- | C] () – C:\Windows\System32\igkrng400.bin
[2009/06/11 07:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/04/19 17:27:21 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\3Stars
[2011/04/18 21:46:10 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Aveyond 3
[2011/05/22 16:53:43 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Big Fish Games
[2011/05/19 18:59:14 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\DivoGames
[2011/07/02 18:34:57 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\EnchantedCavern
[2011/04/19 17:45:39 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\ERS Game Studios
[2011/06/30 18:57:54 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Exent Technologies
[2011/07/02 14:25:03 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Farm Mania 2
[2011/03/29 21:11:28 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\FOG Downloader
[2011/07/04 05:18:22 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Gaijin Ent
[2011/05/21 08:02:49 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\GetRightToGo
[2011/07/04 02:46:26 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\iWin
[2011/07/02 21:48:32 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\PlayFirst
[2011/07/02 12:34:00 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\PoBros
[2011/04/20 14:19:57 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Silverback Productions
[2011/06/29 18:47:44 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\SpinTop
[2011/05/11 19:34:21 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Unity
[2011/07/02 17:58:57 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Virtual City
[2011/04/11 17:15:56 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Vivox
[2011/04/20 13:49:50 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Whisper of a Rose Saves
[2011/03/28 23:30:12 | 000,000,000 | —D | M] – C:\Users\cj_007\AppData\Roaming\Windows Live Writer
[2011/06/22 13:23:37 | 000,032,576 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/11 07:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/14 11:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2011/03/23 08:35:46 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/05/08 00:12:40 | 000,020,666 | —- | M] () – C:\ComboFix.txt
[2009/06/11 07:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/03/22 13:54:23 | 000,206,312 | RHS- | M] () – C:\GGBWV
[2011/05/08 00:08:06 | 1603,084,288 | -HS- | M] () – C:\hiberfil.sys
[2011/02/22 16:27:55 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/22 16:27:55 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/05/08 00:08:12 | 2137,448,448 | -HS- | M] () – C:\pagefile.sys
[2011/03/22 13:54:23 | 000,000,009 | RHS- | M] () – C:\wedaolu

< %systemroot%\Fonts\*.com >
[2009/07/14 14:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 14:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 14:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 14:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 07:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 11:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/14 11:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 01:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 14:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/03/22 14:24:55 | 000,000,221 | -HS- | M] () – C:\Users\cj_007\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/05/07 04:44:32 | 000,589,632 | —- | M] (AVAST Software) – C:\Users\cj_007\Desktop\aswMBR.exe
[2011/05/07 03:46:54 | 004,342,980 | R— | M] () – C:\Users\cj_007\Desktop\ComboFix.exe
[2011/05/07 03:51:35 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\cj_007\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-06 18:53:10

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:19F08842
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:84BD8B63
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:A4E7D25F
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:53DF59D1
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:D3A8AA31
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:F663BB74
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:88FD3ED6
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:65AB2A58
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:3C9B05C4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:3D186293
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:9BAC4211
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5E80DCAA
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E2854662
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:91486201
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:4D08B9E0
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:241FA548
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:0919E696
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:63C29481
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:B1FBBD09

< End of report >

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 22:44:32.59 on Sun 08/05/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_25
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.1329 [GMT 10:00]
.
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Free Ride Games\GPlayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\cj_007\Downloads\dds.com
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://myfastwebsearch.com/
uURLSearchHooks: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\prxtbFree.dll
mURLSearchHooks: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\prxtbFree.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\prxtbFree.dll
TB: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\prxtbFree.dll
uRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
dRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup
StartupFolder: c:\users\cj_007\appdata\roaming\microsoft\windows\start menu\programs\startup\homepg.cmd
StartupFolder: c:\users\cj_007\appdata\roaming\micros~1\windows\startm~1\programs\startup\imvu.lnk - c:\users\cj_007\appdata\roaming\imvuclient\IMVUQualityAgent.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Virtual%20Villagers%205%20-%20New%20Believers/Images/stg_drm.ocx
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Virtual%20Villagers%205%20-%20New%20Believers/Images/armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\cj_007\appdata\roaming\mozilla\firefox\profiles\kcgk5qax.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\free ride games\npExentCtl.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\cj_007\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
.
============= SERVICES / DRIVERS ===============
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 X4HSEx;X4HSEx;c:\program files\free ride games\X4HSEx.sys [2011-6-30 56352]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168]
R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2007-8-3 9344]
R3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\drivers\SonyPI.sys [2007-8-3 14720]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-14 311296]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-3-30 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-23 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-22 1493352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-3-30 136176]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-3-22 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-07-09 17:26:32 102400 —-a-w- c:\windows\RegBootClean.exe
2011-07-03 22:23:04 ——– d—–w- c:\users\cj_007\appdata\local\7Wonders2
2011-07-03 16:59:11 ——– d—–w- c:\progra~2\Sandlot Games
2011-07-03 13:20:10 ——– d—–w- c:\users\cj_007\appdata\roaming\Gaijin Ent
2011-07-02 08:33:47 ——– d—–w- c:\users\cj_007\appdata\roaming\EnchantedCavern
2011-07-02 07:53:56 ——– d—–w- c:\users\cj_007\appdata\roaming\Virtual City
2011-07-02 04:24:46 ——– d—–w- c:\users\cj_007\appdata\roaming\Farm Mania 2
2011-07-02 02:48:18 ——– d—–w- c:\users\cj_007\appdata\roaming\iWin
2011-07-02 02:34:00 ——– d—–w- c:\users\cj_007\appdata\roaming\PoBros
2011-07-02 02:34:00 ——– d—–w- c:\progra~2\PoBros
2011-06-30 08:57:54 ——– d—–w- c:\users\cj_007\appdata\roaming\Exent Technologies
2011-06-30 07:33:21 ——– d—–w- c:\program files\ConduitEngine
2011-06-30 07:33:19 ——– d—–w- c:\program files\Free_Ride_Games
2011-06-30 07:31:20 ——– d—–w- C:\Remote Programs
2011-06-30 07:31:19 ——– d—–w- c:\progra~2\Free Ride Games
2011-06-30 07:31:05 57536 ——w- c:\windows\ExentInfo.exe
2011-06-30 07:31:04 ——– d—–w- c:\program files\Free Ride Games
2011-06-30 07:30:03 77824 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-06-30 07:30:03 32768 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-06-30 07:30:03 225280 —-a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-06-30 07:30:03 176128 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-06-30 07:30:02 614532 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2011-06-29 10:35:06 ——– d—–w- c:\users\cj_007\appdata\local\PackageAware
2011-06-29 08:47:44 ——– d—–w- c:\users\cj_007\appdata\roaming\SpinTop
2011-06-08 09:31:12 377 —-a-w- c:\users\cj_007\appdata\roaming\microsoft\windows\start menu\programs\startup\homepg.cmd
2011-06-07 10:59:09 ——– d—–w- c:\program files\iPod
2011-06-07 10:59:08 ——– d—–w- c:\program files\iTunes
2011-05-22 06:53:43 ——– d—–w- c:\users\cj_007\appdata\roaming\Big Fish Games
2011-05-20 15:47:39 258352 —-a-w- c:\windows\system32\unicows.dll
2011-05-19 08:59:14 ——– d—–w- c:\users\cj_007\appdata\roaming\DivoGames
2011-05-11 13:31:57 819200 —-a-w- c:\windows\system32\xvidcore.dll
2011-05-11 13:31:57 77824 —-a-w- c:\windows\system32\xvid.ax
2011-05-11 13:31:57 180224 —-a-w- c:\windows\system32\xvidvfw.dll
2011-05-11 13:31:55 ——– d—–w- c:\users\cj_007\appdata\local\Mail.Ru
2011-05-11 12:28:35 ——– d—–w- c:\program files\Plants vs Zombies
2011-05-11 11:09:38 ——– d—–w- c:\progra~2\Driver Boost
2011-05-11 09:34:21 ——– d—–w- c:\users\cj_007\appdata\roaming\Unity
2011-05-11 09:27:47 ——– d—–w- c:\users\cj_007\appdata\local\Unity
2011-05-08 12:13:54 398336 —-a-w- c:\windows\system32\TVWizudlg.exe
2011-05-08 12:13:54 140288 —-a-w- c:\windows\system32\igfxtvcx.dll
2011-05-08 12:13:54 ——– d—–w- c:\windows\system32\Lang
2011-05-08 05:08:01 ——– d—–w- C:\b9088f3db94256bf75fe
2011-05-08 05:06:34 ——– d—–w- c:\windows\system32\x64
2011-05-08 05:06:33 1002008 —-a-w- c:\windows\system32\igxpun.exe
2011-05-07 16:21:07 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-07 16:21:07 781272 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-07 16:21:07 465880 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-07 16:21:07 1974616 —-a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-07 16:21:07 1892184 —-a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-07 16:21:07 1874904 —-a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-07 16:21:07 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-07 16:21:07 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-07 15:42:21 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-05-07 15:42:21 472808 —-a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-05-07 14:09:06 ——– d—–w- C:\$RECYCLE.BIN
2011-05-07 04:09:28 ——– d—–w- c:\program files\ESET
2011-05-07 03:53:32 ——– d—–w- c:\users\cj_007\appdata\roaming\Malwarebytes
2011-05-07 03:53:26 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-07 03:53:26 ——– d—–w- c:\progra~2\Malwarebytes
2011-05-07 03:53:23 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-07 03:53:23 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-06 19:43:56 98816 —-a-w- c:\windows\sed.exe
2011-05-06 19:43:56 89088 —-a-w- c:\windows\MBR.exe
2011-05-06 19:43:56 256512 —-a-w- c:\windows\PEV.exe
2011-05-06 19:43:56 161792 —-a-w- c:\windows\SWREG.exe
2011-05-06 19:39:06 ——– d—–w- C:\_OTL
2011-05-06 18:57:51 2331136 —-a-w- c:\windows\system32\win32k.sys
2011-05-06 18:57:47 191488 —-a-w- c:\windows\system32\FXSCOVER.exe
2011-05-06 18:57:14 850432 —-a-w- c:\windows\system32\sbe.dll
2011-05-06 18:57:14 642048 —-a-w- c:\windows\system32\CPFilters.dll
2011-05-06 18:57:14 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-05-06 18:57:14 199680 —-a-w- c:\windows\system32\mpg2splt.ax
2011-05-06 18:57:09 2690560 —-a-w- c:\windows\system32\mstscax.dll
2011-05-06 18:57:09 1034240 —-a-w- c:\windows\system32\mstsc.exe
2011-05-06 18:56:27 740864 —-a-w- c:\windows\system32\inetcomm.dll
2011-05-06 18:56:24 1164288 —-a-w- c:\windows\system32\mfc42u.dll
2011-05-06 18:56:24 1137664 —-a-w- c:\windows\system32\mfc42.dll
2011-05-06 18:56:11 95744 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-05-06 18:56:11 69632 —-a-w- c:\windows\system32\drivers\bowser.sys
2011-05-06 18:56:11 221696 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-05-06 18:56:11 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-05-06 18:52:58 7071056 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{f57e5fa2-c82b-4fb1-996b-59fcdb838c49}\mpengine.dll
2011-05-05 04:27:10 ——– d—–w- c:\windows\system32\appmgmt
2011-05-03 21:17:47 276992 —-a-w- c:\windows\system32\wcncsvc.dll
2011-04-26 22:24:55 442880 —-a-w- c:\windows\system32\XpsPrint.dll
2011-04-26 22:24:54 288256 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-23 16:31:56 ——– d—–w- c:\users\cj_007\appdata\local\Apple Computer
2011-04-23 16:31:41 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-04-23 16:31:41 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-04-23 16:31:12 ——– d—–w- c:\progra~2\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-04-23 16:27:42 ——– d—–w- c:\users\cj_007\appdata\local\Apple
2011-04-23 16:26:56 ——– d—–w- c:\program files\Bonjour
2011-04-21 10:32:08 ——– d—–w- c:\program files\Protector Suite
2011-04-21 05:17:31 ——– d—–w- C:\Perfect World Entertainment
2011-04-20 13:14:15 ——– d—–w- c:\users\cj_007\appdata\roaming\GetRightToGo
2011-04-20 12:52:35 ——– d—–w- c:\program files\Aveyond - The Darkthrop Prophecy
2011-04-20 04:19:57 ——– d—–w- c:\users\cj_007\appdata\roaming\Silverback Productions
2011-04-20 03:17:40 ——– d—–w- c:\users\cj_007\appdata\roaming\Whisper of a Rose Saves
2011-04-19 09:40:52 ——– d—–w- c:\program files\Whisper of a Rose
2011-04-19 09:37:49 ——– d—–w- c:\program files\Secrets of the Dragon Wheel
2011-04-19 07:58:50 ——– d—–w- c:\program files\The Dragon Dance
2011-04-19 07:45:39 ——– d—–w- c:\users\cj_007\appdata\roaming\ERS Game Studios
2011-04-19 07:42:52 ——– d—–w- c:\program files\Diner Dash
2011-04-19 07:27:21 ——– d—–w- c:\users\cj_007\appdata\roaming\3Stars
2011-04-18 11:46:10 ——– d—–w- c:\users\cj_007\appdata\roaming\Aveyond 3
2011-04-18 10:26:33 ——– d—–w- c:\program files\Adventures of Robinson Crusoe
2011-04-18 10:22:28 ——– d—–w- c:\program files\Shadow Wolf Mysteries - Curse of the Full Moon Collector's Edition
2011-04-18 09:54:26 ——– d—–w- c:\program files\Mystery Case Files - 13th Skull
2011-04-18 09:52:31 ——– d—–w- c:\program files\Alexandra Fortune - Mystery of the Lunar Archipelago
2011-04-18 09:37:47 ——– d—–w- c:\windows\system32\directx
2011-04-18 09:35:49 ——– d—–w- c:\program files\Chronicles of Mystery - Tree of Life
2011-04-18 08:57:59 ——– d—–w- c:\program files\iCarly - iDream in Toons
2011-04-18 08:54:47 ——– d—–w- c:\program files\Jack of All Tribes
2011-04-18 08:47:02 ——– d—–w- c:\program files\Virtual Villagers
2011-04-14 09:31:23 ——– d—–w- c:\progra~2\Big Fish Games
2011-04-14 09:27:54 ——– d—–w- c:\program files\common files\Akamai
2011-04-12 07:10:57 ——– d—–w- c:\users\cj_007\appdata\local\Conduit
2011-04-11 10:35:09 ——– d—–w- C:\BigFishGamesCache
2011-04-11 07:15:56 ——– d—–w- c:\users\cj_007\appdata\roaming\Vivox
.
==================== Find3M ====================
.
2011-03-22 03:59:57 409088 —-a-w- c:\windows\system32\systemcpl.dll
2011-03-03 05:29:23 132608 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-03-03 05:27:30 28672 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-02-24 05:32:44 981504 —-a-w- c:\windows\system32\wininet.dll
2011-02-24 05:30:16 44544 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-24 04:23:48 386048 —-a-w- c:\windows\system32\html.iec
2011-02-24 03:50:26 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-02-19 05:32:08 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-02-19 03:37:02 294912 —-a-w- c:\windows\system32\atmfd.dll
2011-02-18 05:36:26 428032 —-a-w- c:\windows\system32\vbscript.dll
.
============= FINISH: 22:45:07.90 ===============