[Resolved] adserving.cpxinteractive.com

here you have combofix:

ComboFix 09-04-04.01 - babs 2009-04-06 12:17:14.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1013.337 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\babs\Desktop\CFScript.txt
FW: ZoneAlarm Pro Firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 00:09 . 2009-04-06 00:09 d——– c:\program files\Java
2009-04-05 04:47 . 2009-04-05 04:57 d——– c:\program files\EsetOnlineScanner
2009-04-04 02:47 . 2009-04-04 02:47 d——– c:\users\babs\AppData\Roaming\WinPatrol
2009-04-04 02:47 . 2009-04-04 02:47 d——– c:\program files\BillP Studios
2009-04-03 23:28 . 2009-04-03 23:28 d——– c:\users\All Users\SUPERAntiSpyware.com
2009-04-03 23:28 . 2009-04-03 23:28 d——– c:\programdata\SUPERAntiSpyware.com
2009-04-03 23:27 . 2009-04-03 23:27 d——– c:\users\babs\AppData\Roaming\SUPERAntiSpyware.com
2009-04-03 23:27 . 2009-04-03 23:27 d——– c:\program files\SUPERAntiSpyware
2009-04-03 23:26 . 2009-04-03 23:26 d——– c:\program files\Common Files\Wise Installation Wizard
2009-04-02 21:40 . 2009-04-02 21:40 d——– c:\users\babs\AppData\Roaming\Malwarebytes
2009-04-02 21:40 . 2009-04-02 21:40 d——– c:\users\All Users\Malwarebytes
2009-04-02 21:40 . 2009-04-02 21:40 d——– c:\programdata\Malwarebytes
2009-04-02 21:40 . 2009-04-02 21:40 d——– c:\program files\Malwarebytes' Anti-Malware
2009-04-02 21:40 . 2009-03-26 16:49 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2009-04-02 21:40 . 2009-03-26 16:49 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2009-03-30 20:39 . 2009-03-30 20:41 d——– c:\users\All Users\DVD Shrink
2009-03-30 20:39 . 2009-03-30 20:41 d——– c:\programdata\DVD Shrink
2009-03-30 20:33 . 2009-03-30 20:33 d——– c:\program files\DVD Shrink
2009-03-29 19:59 . 2009-03-29 19:59 d——– c:\program files\Trend Micro
2009-03-29 15:09 . 2009-03-30 18:54 d——– c:\users\All Users\Comodo
2009-03-29 15:09 . 2009-03-30 18:54 d——– c:\programdata\Comodo
2009-03-29 15:09 . 2009-03-30 19:19 d——– c:\program files\COMODO
2009-03-29 14:57 . 2009-03-30 19:12 d——– c:\program files\SpywareGuard
2009-03-23 22:25 . 2009-03-23 22:25 d——– c:\users\All Users\Vodafone
2009-03-23 22:25 . 2009-03-23 22:25 d——– c:\programdata\Vodafone
2009-03-19 19:11 . 2009-03-19 19:11 d——– c:\program files\Vodafone
2009-03-11 07:35 . 2009-03-29 17:01 d-a—— c:\users\All Users\TEMP
2009-03-11 07:35 . 2009-03-29 17:01 d-a—— c:\programdata\TEMP
2009-03-11 07:21 . 2008-12-16 04:29 8,147,456 –a—— c:\windows\System32\wmploc.DLL
2009-03-11 07:21 . 2008-12-16 06:31 7,680 –a—— c:\windows\System32\spwmp.dll
2009-03-11 07:21 . 2008-12-16 06:31 4,096 –a—— c:\windows\System32\msdxm.ocx
2009-03-11 07:21 . 2008-12-16 06:31 4,096 –a—— c:\windows\System32\dxmasf.dll
2009-03-11 07:19 . 2009-02-09 04:10 2,033,152 –a—— c:\windows\System32\win32k.sys
2009-03-11 07:19 . 2008-11-27 05:43 268,288 –a—— c:\windows\System32\schannel.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 11:22 351,782 —ha-w c:\windows\system32\drivers\vsconfig.xml
2009-04-05 23:09 410,984 —-a-w c:\windows\System32\deploytk.dll
2009-04-01 20:38 ——— d—–w c:\users\babs\AppData\Roaming\dvdcss
2009-03-28 13:34 ——— d—–w c:\program files\ZTE Mobile Connection
2009-03-28 12:03 ——— d—–w c:\program files\Last.fm
2009-03-23 12:01 89,188 —-a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_23_08_16_46_small.dmp.zip
2009-03-23 11:55 4,108,671 —-a-w c:\windows\Internet Logs\tvDebug.zip
2009-03-21 13:31 ——— d—–w c:\users\babs\AppData\Roaming\Any Video Converter
2009-03-11 17:59 ——— d—–w c:\program files\Windows Mail
2009-03-11 07:02 ——— d—–w c:\programdata\Microsoft Help
2009-03-01 15:43 ——— d—–w c:\users\babs\AppData\Roaming\Vodafone
2009-02-28 21:03 3,382,272 —-a-w c:\windows\Internet Logs\xDB7119.tmp
2009-02-27 21:25 ——— d—–w c:\program files\Digsby
2009-02-26 16:18 ——— d—–w c:\program files\Microsoft Silverlight
2009-02-14 20:52 ——— d—–w c:\program files\Inbox
2009-02-13 22:13 ——— d—–w c:\program files\Microsoft
2009-02-11 11:50 ——— d—–w c:\users\babs\AppData\Roaming\Winamp
2009-02-09 18:29 ——— d—–w c:\program files\Google
2009-02-09 18:27 ——— d—–w c:\program files\Common Files\Ahead
2009-02-03 21:41 1,824 —-a-w c:\users\babs\AppData\Roaming\wklnhst.dat
2009-01-19 17:48 3,117,056 —-a-w c:\windows\Internet Logs\xDB6FC2.tmp
2009-01-15 06:11 827,392 —-a-w c:\windows\System32\wininet.dll
2009-01-10 16:50 3,123,712 —-a-w c:\windows\Internet Logs\xDB6DA0.tmp
2009-01-09 17:20 3,123,200 —-a-w c:\windows\Internet Logs\xDB6FE1.tmp
2009-01-09 16:33 3,914,240 —-a-w c:\windows\Internet Logs\xDB7222.tmp
2008-11-05 20:14 245,760 —-a-w c:\program files\Uninstall Ask Toolbar.dll
2008-06-10 12:12 174 –sha-w c:\program files\desktop.ini
2008-05-29 13:37 56 —ha-w c:\users\All Users\ezsidmv.dat
2008-05-29 13:37 56 —ha-w c:\programdata\ezsidmv.dat
2008-06-19 05:45 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008061920080620\index.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-04-06_ 3.09.03.41 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-05 23:47:13 2,048 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-04-06 11:22:13 2,048 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-04-05 23:47:13 2,048 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-04-06 11:22:13 2,048 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-04-05 23:48:32 262,144 –sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat
+ 2009-04-06 11:28:35 262,144 –sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat
+ 2009-04-06 11:28:35 262,144 —ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2009-04-06 02:08:19 262,144 –sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2009-04-06 11:27:43 262,144 –sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2009-04-06 11:27:43 262,144 —ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2009-04-05 23:47:20 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-04-06 11:22:20 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-04-05 23:47:20 49,152 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-06 11:22:20 49,152 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-05 23:47:20 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-04-06 11:22:20 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-04-05 23:52:09 106,696 —-a-w c:\windows\System32\perfc009.dat
+ 2009-04-06 11:26:43 106,696 —-a-w c:\windows\System32\perfc009.dat
- 2009-04-05 23:52:09 603,282 —-a-w c:\windows\System32\perfh009.dat
+ 2009-04-06 11:26:43 603,282 —-a-w c:\windows\System32\perfh009.dat
- 2009-04-05 23:49:18 12,404 —-a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2331292882-29723273-2085719593-1000_UserData.bin
+ 2009-04-06 11:29:18 12,428 —-a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2331292882-29723273-2085719593-1000_UserData.bin
- 2009-04-05 23:49:18 84,466 —-a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-04-06 11:29:17 84,648 —-a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-04-05 23:49:16 47,156 —-a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-04-06 11:29:17 47,474 —-a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-08-08 266497]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-16 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-16 133656]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-03-13 2060288]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-03-18 337216]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-06 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
–a—— 2008-08-13 18:32 206064 c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
–a—— 2008-01-18 23:33 125952 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect]
–a—— 2008-03-13 20:09 2060288 c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
–a—— 2007-04-10 22:46 709992 c:\windows\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{86EA7EF4-6DE4-48C7-A3D0-220B70B2AB15}"= c:\program files\Dell\MediaDirect\PowerCinema.exe:CyberLink PowerCinema
"{D2A05B32-918E-4A1F-A548-BFE4957868B6}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{039F7BBB-344F-407A-B10C-57E841B66D07}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{5015D432-5607-4013-942D-AE72F1BA3D39}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{98C8A91C-9660-48C4-930E-E86FE2D4686B}"= UDP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler
"{32D795E9-A717-4DE4-9D0E-184D8D4D990B}"= TCP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler
"{6741B48C-E1A1-43BE-91BC-D7967A5CC72E}"= UDP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services
"{C6350CA8-24B9-4726-BC8E-6B7E2E9B7B18}"= TCP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services
"{F76ADC74-E9B2-429B-B76D-4E4B3DEFEB6A}"= UDP:c:\program files\AOL 9.0 VR\waol.exe:AOL
"{AAB3D17F-19C5-4A3F-8605-80B9156E912F}"= TCP:c:\program files\AOL 9.0 VR\waol.exe:AOL
"{2FABB047-6634-49E2-A48E-CD100DBB3991}"= UDP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{B94BB458-7234-4888-A5C6-8E4D1A3A208B}"= TCP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{6175BB94-7DBD-455D-98B8-7E2D55117363}"= UDP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{4E3EF9D4-1403-4313-9A48-67FA25045E07}"= TCP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{6D892192-D2A3-482B-B211-1BDAE29ADAB3}"= UDP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{DA6A779C-1C2B-45C2-8CC6-6BD834411BD5}"= TCP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{AE7F84D6-535C-40FA-9943-867CCB04FDF8}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{B76EF3D1-E3DB-4AB8-9C86-E015D9C04E5B}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{090C1BB9-4C33-40EA-A935-3D5732208F2C}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"{6213EB4C-A13B-4BD3-8AD2-A3C270C0D010}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{5BE4C4D6-EBC0-4977-9142-62684F0A707C}c:\\users\\babs\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= UDP:c:\users\babs\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"UDP Query User{56DFBDEC-B25E-453A-93B5-6C33FB43FC61}c:\\users\\babs\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= TCP:c:\users\babs\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"TCP Query User{C281D31E-C412-4C40-A2F6-137AF180EEAE}c:\\program files\\gigatribe\\gigatribe.exe"= UDP:c:\program files\gigatribe\gigatribe.exe:gigatribe
"UDP Query User{089C28EA-DF96-42E9-BFCB-7A7F13C1AB22}c:\\program files\\gigatribe\\gigatribe.exe"= TCP:c:\program files\gigatribe\gigatribe.exe:gigatribe
"{02A4B457-429E-4C37-B2B4-2F1F79D71A38}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{6E8059A3-86DB-4C14-AF5D-EFE6260CD392}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{21845EAC-41D9-4927-AAC2-F64729F62429}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{DA3A7697-94E2-412D-AAD7-13E1F0E8EEA8}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7F2B8FFA-71E9-486B-A9C3-EE670EEBF708}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{8627DF2E-8E51-47C8-A9FD-65497BF0E872}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{27F7BEBB-9C23-4F2A-BF64-AB016A4C5CC2}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{665F16A4-61DE-4AD8-9FC7-9A5D10DE35CD}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{A60C0B14-45E2-43DF-B37A-E6491C5FCACA}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [2008-10-17 73728]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://my3.three.co.uk/myaccount/index.do
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\babs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\users\babs\AppData\Roaming\Mozilla\Firefox\Profiles\spillmzc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 12:31:25
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\windows\System32\ZoneLabs\vsmon.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\BCMWLTRY.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\System32\stacsv.exe
c:\windows\System32\drivers\XAudio.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\igfxsrvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2009-04-06 12:35:10 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-06 11:35:03
ComboFix2.txt 2009-04-06 02:11:35

Pre-Run: 26,548,383,744 bytes free
Post-Run: 26,408,488,960 bytes free

235 — E O F — 2009-04-04 02:05:52


Then mbam:


Malwarebytes' Anti-Malware 1.35
Database version: 1944
Windows 6.0.6001 Service Pack 1

06/04/2009 12:49:48
mbam-log-2009-04-06 (12-49-48).txt

Scan type: Quick Scan
Objects scanned: 72110
Time elapsed: 5 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


and finally HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:23, on 06/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my3.three.co.uk/myaccount/index.do
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\babs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCC953FE-A4EF-4160-BBD3-7B6D753E2F17}: NameServer = 10.206.65.68 10.206.65.68
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7203 bytes


The computer seems to be flowing a bit faster, well, it's not hugely noticeable, but I feel a bit like it is slightly better/faster, still no popup at this point…

By the way, I just noticed the question about this occuring in both firefox and i.e. (that's starting to be a lot of threads, sorry ), but yea, I actually don't use i.e., I try not to use anything branded windows for that matter, save for the platform, for which I don't really have a choice due to some linux-incompatible router hah !

ok, this is getting tricky, not to mention annoying, so, few issues, when I try to download disinfector, I get a warning from my antivir that WORM/Generic.4084 is trying to gain access, I know some programs have codes that look weird to antiviruses and they'll stop it, but since you didn't mention anything about this and seeing the name of this weird file, I thought it better to skip this one before you confirm it is a normal behavior


here are the logs:

Search Navipromo version 3.7.6 began on 2009-04-07 at 17:36:43.83

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Program Files\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel® Celeron® CPU 540 @ 1.86GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A03
USER : babs ( Not Administrator ! )
BOOT : Normal boot


Firewall : ZoneAlarm Pro Firewall 7.1.248.000 (Activated)

C:\ (Local Disk) - NTFS - Total:99 Go (Free:22 Go)
D:\ (Local Disk) - NTFS - Total:9 Go (Free:5 Go)
E:\ (CD or DVD)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (USB)
H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
I:\ (USB) - FAT32 - Total:3827 Mo (Free:1 Go)


Search done in normal mode


*** Search folders in "C:\Windows" ***


*** Search folders in "C:\Program Files" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***


*** Search folders in "C:\ProgramData" ***


*** Search folders in "c:\users\babs\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Search folders in "C:\Users\babs\AppData\Local\virtualstore\Program Files" ***



*** Search folders in "C:\Users\babs\AppData\Local" ***



*** Search folders in "C:\Users\Guest\AppData\Local" ***




*** Search folders in "C:\Users\babs\AppData\Roaming" ***


*** Search folders in "C:\Users\Guest\appdata\roaming" ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\Windows\system32" *

* Scan in "C:\Users\babs\AppData\Local\Microsoft" *

* Scan in "C:\Users\babs\AppData\Local\virtualstore\windows\system32" *

* Scan in "C:\Users\babs\AppData\Local" *

* Scan in "C:\Users\Guest\AppData\Local" *



*** Search files ***



*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\Windows\system32" :


* In "C:\Users\babs\AppData\Local\Microsoft" :


* In "C:\Users\babs\AppData\Local\virtualstore\windows\system32" :


* In "C:\Users\babs\AppData\Local" :


* In "C:\Users\Guest\AppData\Local" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
Montorgueil certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :



*** Search completed on 2009-04-07 at 18:10:42.57 ***


Now, for rooter (it actually worked this time yay):

Microsoft Windows XP Home Edition (5.1.2600) Service Pack 2

C:\ [Fixed] - NTFS - (Total:101474 Mo/Free:2555 Mo)
D:\ [Fixed] - NTFS - (Total:10239 Mo/Free:1387 Mo)
E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
F:\ [CD-Rom] (Total:58 Mo/Free:0 Mo)
G:\ [Removable] (Total:0 Mo/Free:0 Mo)
H:\ [CD-Rom] (Total:6 Mo/Free:0 Mo)
I:\ [Removable] (Total:3827 Mo/Free:1441 Mo)

2009-04-07|18:20

———————-\\ Processes..

–Locked– [System Process]
–Locked– System
———- \SystemRoot\System32\smss.exe
———- C:\Windows\system32\csrss.exe
———- C:\Windows\system32\wininit.exe
———- C:\Windows\system32\csrss.exe
———- C:\Windows\system32\winlogon.exe
———- C:\Windows\system32\services.exe
———- C:\Windows\system32\lsass.exe
———- C:\Windows\system32\lsm.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\System32\svchost.exe
———- C:\Windows\System32\svchost.exe
———- C:\Windows\System32\svchost.exe
———- C:\Windows\system32\svchost.exe
–Locked– audiodg.exe
———- C:\Windows\system32\SLsvc.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\System32\WLTRYSVC.EXE
———- C:\Windows\System32\bcmwltry.exe
———- C:\Windows\System32\spoolsv.exe
———- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\system32\aestsrv.exe
———- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
———- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
———- C:\Windows\system32\svchost.exe
———- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
———- C:\Windows\system32\STacSV.exe
———- C:\Windows\system32\svchost.exe
———- C:\Windows\System32\svchost.exe
———- C:\Windows\system32\SearchIndexer.exe
———- C:\Windows\system32\DRIVERS\xaudio.exe
———- C:\Windows\system32\taskeng.exe
———- C:\Windows\system32\Dwm.exe
———- C:\Windows\Explorer.EXE
———- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
———- C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
———- C:\Windows\System32\igfxpers.exe
———- C:\Windows\system32\igfxsrvc.exe
———- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
———- C:\Program Files\Java\jre6\bin\jusched.exe
———- C:\Windows\ehome\ehtray.exe
———- C:\Windows\system32\wbem\unsecapp.exe
———- C:\Windows\system32\wbem\wmiprvse.exe
———- C:\Windows\ehome\ehmsas.exe
———- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
———- C:\Windows\system32\taskeng.exe
———- C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
———- C:\Windows\system32\cmd.exe
———- C:\Windows\system32\SearchProtocolHost.exe
———- C:\Windows\system32\SearchFilterHost.exe
———- C:\Rooter$\RK.exe

———————-\\ Search..

———————-\\ ROOTKIT !!


———————-\\ Cracks & Keygens..

C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )\SN.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )\Torrent downloaded from Demonoid.com.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\READ ME PLEASE.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Torrent downloaded from Demonoid.com.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Key Generator\Microsoft Windows Key Generator.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Automated Activation Crack v3.0\Read Me.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Automated Activation Crack v3.0\Vista Automated Activation Crack v3.0.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Crack\Windows Vista Test Crack - ISHY.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\OEMTool.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\pkeys.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\readme.txt
C:\Users\babs\Desktop\misc\Utils\nero - pass=www.fullandfree.info\Nero 7 Premium Reloaded v7.5.9.0A\keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\Microsoft Office 2007\Crack\Office 2007 Keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\Microsoft Office 2007 Keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\MS Office 2007 KeyGen\msoe2007kg.exe
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\README.txt
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\loadlin.exe
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\readme.txt
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\syslinux.exe
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\README-10k.TXT
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\WIN\mkisofs.exe


1 - "C:\Rooter$\Rooter_1.txt" - 2009-04-07|19:07

———————-\\ Scan completed at 19:07

LopS&D took ages to finish, but here's the log finally:


——————–\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel® Celeron® CPU 540 @ 1.86GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A03
USER : babs ( Not Administrator ! )
BOOT : Normal boot
Firewall : ZoneAlarm Pro Firewall 7.1.248.000 (Not Activated)
C:\ (Local Disk) - NTFS - Total:99 Go (Free:22 Go)
D:\ (Local Disk) - NTFS - Total:9 Go (Free:5 Go)
E:\ (CD or DVD)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (USB)
H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
I:\ (USB) - FAT32 - Total:3827 Mo (Free:1 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 2009-04-07|19:14 )

[ UAC => 1 ]

——————–\\ Listing folders in Local

[2009-03-01|16:41] C:\Users\babs\AppData\Local\{DA6A30CA-2668-4F5F-93A5-9BDA19E3CCC4}
[2008-04-07|16:06] C:\Users\babs\AppData\Local\Application Data
[2008-04-07|18:43] C:\Users\babs\AppData\Local\Apps
[2009-01-14|14:18] C:\Users\babs\AppData\Local\d3d9caps.dat
[2009-02-11|04:12] C:\Users\babs\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-02-13|19:22] C:\Users\babs\AppData\Local\Dell
[2009-03-01|16:43] C:\Users\babs\AppData\Local\desktop.ini
[2009-02-27|22:25] C:\Users\babs\AppData\Local\Digsby
[2008-11-09|20:00] C:\Users\babs\AppData\Local\GDIPFONTCACHEV1.DAT
[2009-02-07|17:42] C:\Users\babs\AppData\Local\Google
[2008-08-25|20:29] C:\Users\babs\AppData\Local\Handbrake
[2008-04-07|16:06] C:\Users\babs\AppData\Local\History
[2009-04-07|07:29] C:\Users\babs\AppData\Local\IconCache.db
[2008-05-09|19:47] C:\Users\babs\AppData\Local\IsolatedStorage
[2009-04-06|18:13] C:\Users\babs\AppData\Local\Last.fm
[2008-04-10|00:21] C:\Users\babs\AppData\Local\MediaDirect
[2009-04-07|17:48] C:\Users\babs\AppData\Local\Microsoft
[2008-04-08|20:11] C:\Users\babs\AppData\Local\Microsoft Games
[2009-02-04|19:54] C:\Users\babs\AppData\Local\Microsoft Help
[2008-04-07|16:41] C:\Users\babs\AppData\Local\MicroVision Applications
[2008-04-08|21:01] C:\Users\babs\AppData\Local\MigWiz
[2008-04-08|20:19] C:\Users\babs\AppData\Local\Mozilla
[2008-06-17|15:30] C:\Users\babs\AppData\Local\Opera
[2008-04-08|15:13] C:\Users\babs\AppData\Local\Powercinema
[2008-04-07|18:23] C:\Users\babs\AppData\Local\Real
[2008-05-07|15:14] C:\Users\babs\AppData\Local\SupportSoft
[2009-04-07|19:11] C:\Users\babs\AppData\Local\Temp
[2008-08-25|20:17] C:\Users\babs\AppData\Local\TempImages
[2008-04-07|16:06] C:\Users\babs\AppData\Local\Temporary Internet Files
[2008-04-07|16:41] C:\Users\babs\AppData\Local\VirtualStore
[2008-05-09|19:44] C:\Users\babs\AppData\Local\Yahoo!
[2008-05-09|19:52] C:\Users\babs\AppData\Local\Yahoo!_Inc

——————–\\ Scheduled Tasks located in C:\Windows\Tasks

[2009-04-07 17:12][–ah—–] C:\Windows\tasks\SA.DAT
[2009-04-07 07:29][–a——] C:\Windows\tasks\SCHEDLGU.TXT

——————–\\ Listing Folders in C:\ProgramData

[2008-10-17|17:24] C:\ProgramData\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
[2008-10-12|21:45] C:\ProgramData\Adobe
[2008-04-07|17:46] C:\ProgramData\AOL
[2008-09-20|12:35] C:\ProgramData\Apple Computer
[2008-04-07|16:02] C:\ProgramData\Application Data
[2008-06-19|03:47] C:\ProgramData\Avira
[2008-04-07|18:37] C:\ProgramData\AVS4YOU
[2008-05-21|16:30] C:\ProgramData\CheckPoint
[2009-03-30|18:54] C:\ProgramData\Comodo
[2007-11-12|10:34] C:\ProgramData\CyberLink
[2008-05-07|17:05] C:\ProgramData\Dell
[2008-04-07|16:02] C:\ProgramData\Desktop
[2008-03-07|14:47] C:\ProgramData\DeviceInstaller.xml
[2008-03-07|17:43] C:\ProgramData\DeviceManager.xml.rc4
[2009-01-31|06:22] C:\ProgramData\Digsby
[2008-04-07|16:02] C:\ProgramData\Documents
[2009-03-30|20:41] C:\ProgramData\DVD Shrink
[2008-04-07|18:21] C:\ProgramData\ESTsoft
[2008-05-29|14:37] C:\ProgramData\ezsidmv.dat
[2008-04-07|16:02] C:\ProgramData\Favorites
[2009-02-07|17:42] C:\ProgramData\Google
[2007-11-12|10:35] C:\ProgramData\Gtek
[2007-11-12|10:30] C:\ProgramData\InstallShield
[2008-10-20|19:01] C:\ProgramData\Last.fm
[2008-07-04|00:36] C:\ProgramData\Lavasoft
[2009-04-02|21:40] C:\ProgramData\Malwarebytes
[2008-04-07|17:55] C:\ProgramData\McAfee
[2009-04-04|02:56] C:\ProgramData\Microsoft
[2009-03-11|08:02] C:\ProgramData\Microsoft Help
[2009-02-26|01:30] C:\ProgramData\ntuser.pol
[2008-10-28|16:18] C:\ProgramData\QuickSet.xml
[2008-04-07|18:23] C:\ProgramData\Real
[2008-11-05|20:58] C:\ProgramData\Roxio
[2008-05-09|15:24] C:\ProgramData\Skype
[2007-11-12|10:33] C:\ProgramData\Sonic
[2008-06-01|23:35] C:\ProgramData\SonicStage
[2008-06-01|23:35] C:\ProgramData\Sony Corporation
[2008-08-15|23:25] C:\ProgramData\Spybot - Search & Destroy
[2008-04-07|16:02] C:\ProgramData\Start Menu
[2009-04-03|23:28] C:\ProgramData\SUPERAntiSpyware.com
[2008-05-07|09:42] C:\ProgramData\SupportSoft
[2009-03-29|17:01] C:\ProgramData\TEMP
[2008-04-07|16:02] C:\ProgramData\Templates
[2007-11-12|10:43] C:\ProgramData\Viewpoint
[2009-03-23|22:25] C:\ProgramData\Vodafone
[2008-11-16|21:24] C:\ProgramData\WindowsSearch
[2008-06-17|13:33] C:\ProgramData\WLInstaller

——————–\\ Listing Folders in C:\Program Files

[2008-10-12|21:45] C:\Program Files\Adobe
[2009-04-07|05:14] C:\Program Files\Any Video Converter
[2008-04-07|17:46] C:\Program Files\AOL
[2007-11-12|10:43] C:\Program Files\AOL 9.0 VR
[2008-11-05|21:14] C:\Program Files\AskTBar
[2008-06-19|03:47] C:\Program Files\Avira
[2008-05-18|07:34] C:\Program Files\AVS4YOU
[2009-04-04|02:47] C:\Program Files\BillP Studios
[2008-09-08|18:47] C:\Program Files\bitRipper
[2007-11-12|10:29] C:\Program Files\Broadcom
[2008-12-23|00:25] C:\Program Files\CCleaner
[2009-04-06|12:19] C:\Program Files\Common Files
[2009-03-30|19:19] C:\Program Files\COMODO
[2007-11-12|10:16] C:\Program Files\CONEXANT
[2009-04-07|05:14] C:\Program Files\ConvertHelper
[2008-08-24|14:49] C:\Program Files\Cucusoft
[2007-11-12|10:34] C:\Program Files\CyberLink
[2008-05-18|07:45] C:\Program Files\Dell
[2008-05-07|09:41] C:\Program Files\Dell Support Center
[2007-11-12|10:35] C:\Program Files\DellSupport
[2007-11-12|10:25] C:\Program Files\Digital Line Detect
[2009-04-07|05:14] C:\Program Files\Digsby
[2009-04-07|05:14] C:\Program Files\DVD Shrink
[2009-04-05|04:57] C:\Program Files\EsetOnlineScanner
[2008-04-07|18:21] C:\Program Files\ESTsoft
[2009-02-09|19:29] C:\Program Files\Google
[2009-02-04|05:38] C:\Program Files\Handbrake
[2009-04-03|23:20] C:\Program Files\Hijackthis
[2009-02-14|21:52] C:\Program Files\Inbox
[2008-05-31|15:00] C:\Program Files\InstallShield Installation Information
[2008-09-20|12:37] C:\Program Files\Internet Explorer
[2008-11-24|00:08] C:\Program Files\Inventel
[2009-01-31|05:33] C:\Program Files\IObit
[2008-06-10|23:55] C:\Program Files\J River
[2009-04-06|00:09] C:\Program Files\Java
[2009-03-28|13:03] C:\Program Files\Last.fm
[2008-06-19|12:44] C:\Program Files\Lavasoft
[2009-04-02|21:40] C:\Program Files\Malwarebytes' Anti-Malware
[2009-02-13|23:13] C:\Program Files\Microsoft
[2006-11-02|13:37] C:\Program Files\Microsoft Games
[2008-12-06|15:52] C:\Program Files\Microsoft LifeCam
[2008-11-09|19:53] C:\Program Files\Microsoft Office
[2009-02-26|17:18] C:\Program Files\Microsoft Silverlight
[2008-11-09|19:53] C:\Program Files\Microsoft Visual Studio
[2008-11-09|19:48] C:\Program Files\Microsoft Visual Studio 8
[2008-11-09|19:54] C:\Program Files\Microsoft Works
[2008-11-09|19:51] C:\Program Files\Microsoft.NET
[2007-11-12|10:25] C:\Program Files\Modem Diagnostic Tool
[2008-06-10|13:01] C:\Program Files\Movie Maker
[2009-04-06|00:34] C:\Program Files\Mozilla Firefox
[2008-11-09|19:54] C:\Program Files\MSBuild
[2008-05-07|03:04] C:\Program Files\MSXML 4.0
[2009-04-07|18:10] C:\Program Files\Navilog1
[2007-11-12|10:25] C:\Program Files\NetWaiting
[2008-11-01|16:36] C:\Program Files\Opera
[2008-11-01|16:48] C:\Program Files\Opera 9
[2008-06-19|06:47] C:\Program Files\Panda Security
[2008-11-09|02:52] C:\Program Files\PhotoScape
[2008-09-20|12:37] C:\Program Files\QuickTime
[2008-06-19|03:39] C:\Program Files\RamBooster 2.0
[2008-04-07|18:23] C:\Program Files\Real Alternative
[2006-11-02|13:37] C:\Program Files\Reference Assemblies
[2009-04-06|18:24] C:\Program Files\Roxio
[2007-11-12|10:26] C:\Program Files\SigmaTel
[2008-05-09|15:24] C:\Program Files\Skype
[2008-05-31|15:00] C:\Program Files\Sony
[2008-06-10|00:16] C:\Program Files\SoundSpectrum
[2008-08-15|23:26] C:\Program Files\Spybot - Search & Destroy
[2009-03-30|19:12] C:\Program Files\SpywareGuard
[2009-04-03|23:27] C:\Program Files\SUPERAntiSpyware
[2007-11-12|18:10] C:\Program Files\Synaptics
[2008-06-20|15:57] C:\Program Files\T-Mobile
[2009-03-29|19:59] C:\Program Files\Trend Micro
[2006-11-02|14:01] C:\Program Files\Uninstall Information
[2008-04-07|18:22] C:\Program Files\VideoLAN
[2007-11-12|10:43] C:\Program Files\Viewpoint
[2009-03-19|19:11] C:\Program Files\Vodafone
[2008-09-06|01:24] C:\Program Files\Winamp
[2008-06-10|13:01] C:\Program Files\Windows Calendar
[2008-06-10|13:01] C:\Program Files\Windows Collaboration
[2008-06-10|13:01] C:\Program Files\Windows Defender
[2008-06-10|13:01] C:\Program Files\Windows Journal
[2008-06-17|13:46] C:\Program Files\Windows Live
[2008-12-14|15:17] C:\Program Files\Windows Live SkyDrive
[2009-03-11|18:59] C:\Program Files\Windows Mail
[2009-03-11|18:59] C:\Program Files\Windows Media Player
[2006-11-02|13:37] C:\Program Files\Windows NT
[2008-06-10|13:01] C:\Program Files\Windows Photo Gallery
[2008-06-10|13:01] C:\Program Files\Windows Sidebar
[2009-04-07|05:12] C:\Program Files\Zone Labs
[2009-03-28|14:34] C:\Program Files\ZTE Mobile Connection

——————–\\ Listing Folders in C:\Program Files\Common Files

[2008-10-12|21:45] C:\Program Files\Common Files\Adobe
[2009-02-09|19:27] C:\Program Files\Common Files\Ahead
[2008-04-07|17:46] C:\Program Files\Common Files\aol
[2007-11-12|10:43] C:\Program Files\Common Files\aolshare
[2008-09-20|12:35] C:\Program Files\Common Files\Apple
[2008-04-07|18:25] C:\Program Files\Common Files\AVSMedia
[2008-11-09|19:53] C:\Program Files\Common Files\DESIGNER
[2007-11-12|10:31] C:\Program Files\Common Files\InstallShield
[2007-11-12|10:24] C:\Program Files\Common Files\Java
[2009-03-05|19:31] C:\Program Files\Common Files\microsoft shared
[2007-11-12|10:43] C:\Program Files\Common Files\Nullsoft
[2008-05-16|08:29] C:\Program Files\Common Files\Real
[2007-11-12|10:30] C:\Program Files\Common Files\Roxio Shared
[2006-11-02|12:18] C:\Program Files\Common Files\Services
[2008-05-09|15:24] C:\Program Files\Common Files\Skype
[2007-11-12|10:32] C:\Program Files\Common Files\Sonic Shared
[2008-05-31|14:57] C:\Program Files\Common Files\Sony Shared
[2006-11-02|12:18] C:\Program Files\Common Files\SpeechEngines
[2008-05-07|09:41] C:\Program Files\Common Files\supportsoft
[2007-11-12|10:30] C:\Program Files\Common Files\SureThing Shared
[2008-11-09|19:48] C:\Program Files\Common Files\System
[2008-05-06|23:44] C:\Program Files\Common Files\WindowsLiveInstaller
[2009-04-03|23:26] C:\Program Files\Common Files\Wise Installation Wizard

——————–\\ Process

( 57 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 19:23:44
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\Users\babs\AppData\Roaming\uTorrent\Microsoft Office 2007 FULL + Keygen ( Vista comp ).torrent
C:\Users\babs\AppData\Roaming\uTorrent\Microsoft Windows Key Generator and Crack v2.1.torrent
C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp
C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )\Microsoft Office 2007 FULL + Keygen ( Vista comp).daa
C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )\SN.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Office 2007 FULL + Keygen ( Vista comp )\Torrent downloaded from Demonoid.com.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Key Generator
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Automated Activation Crack v3.0
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Crack
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\READ ME PLEASE.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Torrent downloaded from Demonoid.com.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\~uTorrentPartFile_129EF1.dat
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Key Generator\Microsoft Windows Key Generator.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Automated Activation Crack v3.0\Read Me.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Automated Activation Crack v3.0\Vista Automated Activation Crack v3.0.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Crack\Please read first - ISHY .nfo
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 32x and 64x Crack\Windows Vista Test Crack - ISHY.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\CERTS
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\DIFxAPI.dll
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\OEMTool.exe
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\pkeys.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\readme.txt
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\royal.inf
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\royal.sys
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\CERTS\Acer.xrm-ms
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\CERTS\ASUS.xrm-ms
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\CERTS\Hewlett-Packard.xrm-ms
C:\Users\babs\Desktop\misc\Utils\Microsoft Windows Key Generator and Crack v2.1\Microsoft Windows Vista 86x activator and crack\CERTS\Lenovo.xrm-ms
C:\Users\babs\Desktop\misc\Utils\nero - pass=www.fullandfree.info\Nero 7 Premium Reloaded v7.5.9.0A\keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\Microsoft Office 2007\Crack
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\Microsoft Office 2007\Crack\Office 2007 Keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\file_id.diz
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\Microsoft Office 2007 Keygen.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\microsoft.nfo
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\MS Office 2007 KeyGen
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\MS Office 2007 KeyGen\msoe2007kg.exe
C:\Users\babs\Desktop\misc\Utils\office 2007 (key=kgfvy-7733b-8wck9-ktg64-bc7d8)\office 2007 home & student keygen\MS Office 2007 KeyGen\msoe2007kg.md5
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack-xp-livecd-2.0.iso
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\README.txt
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\bootinst.bat
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\bootinst.sh
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\chain.c32
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\initrd.gz
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\isolinux
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\liloinst.sh
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\mt86p
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\ophcrack.cfg
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\ophcrack.png
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\vesamenu.c32
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\vmlinuz
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\config
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\loadlin.exe
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\ophcrack.bat
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\dos\readme.txt
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\isolinux\isolinux.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\isolinux\isolinux.boot
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\isolinux\isolinux.cfg
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\lilo
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\mbr.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\syslinux
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\syslinux.cfg
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\syslinux.com
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\boot\syslinux\syslinux.exe
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\LICENSE
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\livecd.sgn
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\make_iso.bat
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\make_iso.sh
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\modules
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\optional
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\rootcopy
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\bin.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\etc.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\home.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\lib.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\ophcrack-3.0.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\opt.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\root.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\sbin.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\srv.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\usr.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\base\var.lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\rootcopy\root
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\rootcopy\root\launch.sh
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\README-10k.TXT
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table0.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table0.index
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table0.start
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table1.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table1.index
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table1.start
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table2.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table2.index
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table2.start
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table3.bin
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table3.index
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tables\table3.start
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\activate
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\deactivate
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\deb2lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\dir2lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\liblinuxlive
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\lzm2dir
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\mksquashfs
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\tgz2lzm
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\unsquashfs
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\WIN
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\WIN\config
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\WIN\cygwin1.dll
C:\Users\babs\Desktop\misc\Utils\ophcrack-xp\ophcrack\tools\WIN\mkisofs.exe
C:\Users\babs\Music\Electronik\Alec Empire\1996 - The Destroyer [224]\13 My Face Would Crack.mp3
C:\Users\babs\Music\fast\Doomriders\Black Thunder\Doomriders 12 The whipcrack.mp3
C:\Users\babs\Music\fast\Pixies - Live in Toronto 11.24.04\11-CD1- Crackity Jones.mp3


[F:6][D:1]-> C:\Users\babs\AppData\Local\Temp
[F:4][D:1]-> C:\Users\babs\AppData\Roaming\MICROS~1\Windows\Cookies
[F:6][D:4]-> C:\Users\babs\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:11][D:12]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 2009-04-07|23:20 - Option : [1]

——————–\\ Scan completed at 23:20:58
[ UAC => 1 ]


I hope this will help