CatByte
there are some orphaned entries and a couple of malware entries that need deleting still.
It's not looking too bad though now.
I expect Kaspersky to find some infected files.
Spyware / Malware / Virus Removal
Maleware Removal!
14 min read
jeff matthews
wow ok, i understand. Umm i ran Kaspersky before, prio to all this and it didn't find anything. So you think i should run it again huh?
Also in OTL do i have to use these instructions again, accept for the part where it says run scan.
# Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
# When the window appears, underneath Output at the top change it to Minimal Output.
# Check the boxes beside LOP Check and Purity Check.
# Under the Custom Scan box paste this in
CatByte
Hi
No that isn't necessary
follow the instructions in this post here: http://forums.whatthetech.com/index.php?sh…st&p=668483
paste the contents of the code box I gave you into the custom scan box and then press the RUN FIX button.
Yes, please run MBAM and Kaspersky again, let's make sure they come back clean.
Also advise how the computer is running and if there are any outstanding issues with the machine
No that isn't necessary
follow the instructions in this post here: http://forums.whatthetech.com/index.php?sh…st&p=668483
paste the contents of the code box I gave you into the custom scan box and then press the RUN FIX button.
Yes, please run MBAM and Kaspersky again, let's make sure they come back clean.
Also advise how the computer is running and if there are any outstanding issues with the machine
jeff matthews
Hey here are all the logs, i ran webroot also and it found some other malicious items. I just wanted to note that here so you can take a look at them.
They are:
Mal/JavaDeSp-A
Then there was a file with a bunch of letters and numbers. I googled it my self and found out that its some type of trojan i think. 32788r22fwjfw
Only webroot was able to find these files though.
All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43e30fa0-7427-11df-99b9-18a905c0d717}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
File L:\WD SmartWare.exe not found.
C:\Users\Tim\AppData\Local\ikchvaanr folder moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYFLASH]
User: All Users
User: Default
->Flash cache emptied: 41620 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
User: Tim
->Flash cache emptied: 90520 bytes
Total Flash Files Cleaned = 0.00 mb
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
User: Tim
->Temp folder emptied: 565212285 bytes
->Temporary Internet Files folder emptied: 202177414 bytes
->Java cache emptied: 1262004 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14925061 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes
RecycleBin emptied: 4763542 bytes
Total Files Cleaned = 752.00 mb
OTL by OldTimer - Version 3.2.9.1 log created on 07212010_004123
Files\Folders moved on Reboot…
C:\Users\Tim\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\hsperfdata_TIM-PC$\1648 not found!
Registry entries deleted on Reboot…
Maleware bytes still didn't find anything.
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4334
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
7/21/2010 12:56:07 AM
mbam-log-2010-07-21 (00-56-07).txt
Scan type: Quick scan
Objects scanned: 134588
Time elapsed: 3 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
I will post the kaspsersky scan later, it takes some time for this one to run. Look over these in the mean time though.
As for the computer, it still has non responsible programs from time to time and the internet will some times crash alot. So i am pretty sure this pc is not entirely clean yet. I guess this pc has some pretty deep infections huh?
They are:
Mal/JavaDeSp-A
Then there was a file with a bunch of letters and numbers. I googled it my self and found out that its some type of trojan i think. 32788r22fwjfw
Only webroot was able to find these files though.
All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43e30fa0-7427-11df-99b9-18a905c0d717}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43e30fa0-7427-11df-99b9-18a905c0d717}\ not found.
File L:\WD SmartWare.exe not found.
C:\Users\Tim\AppData\Local\ikchvaanr folder moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYFLASH]
User: All Users
User: Default
->Flash cache emptied: 41620 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
User: Tim
->Flash cache emptied: 90520 bytes
Total Flash Files Cleaned = 0.00 mb
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
User: Tim
->Temp folder emptied: 565212285 bytes
->Temporary Internet Files folder emptied: 202177414 bytes
->Java cache emptied: 1262004 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14925061 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes
RecycleBin emptied: 4763542 bytes
Total Files Cleaned = 752.00 mb
OTL by OldTimer - Version 3.2.9.1 log created on 07212010_004123
Files\Folders moved on Reboot…
C:\Users\Tim\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\hsperfdata_TIM-PC$\1648 not found!
Registry entries deleted on Reboot…
Maleware bytes still didn't find anything.
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4334
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
7/21/2010 12:56:07 AM
mbam-log-2010-07-21 (00-56-07).txt
Scan type: Quick scan
Objects scanned: 134588
Time elapsed: 3 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
I will post the kaspsersky scan later, it takes some time for this one to run. Look over these in the mean time though.
As for the computer, it still has non responsible programs from time to time and the internet will some times crash alot. So i am pretty sure this pc is not entirely clean yet. I guess this pc has some pretty deep infections huh?
jeff matthews
OK here is the webroot log. Kaspersky didn't find anything so i don't think i need to post the log it says.
Wednesday, July 21, 2010
Operating system: Microsoft (build 7600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, July 21, 2010 05:31:09
Records in database: 4229132
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
Scan statistics
Objects scanned 159663
Threats found 0
Infected objects found 0
Suspicious objects found 0
Scan duration 01:20:41
No threats found. Scanned area is clean.
Selected area has been scanned.
Webroot Log
7/21/2010 6:52:49 AM: Removal process completed. Elapsed time 00:00:28
7/21/2010 6:52:21 AM: Quarantining All Traces: Mal/JavaDeSp-A
7/21/2010 6:52:21 AM: Removal process initiated
7/21/2010 6:08:00 AM: Traces Found: 1
7/21/2010 6:08:00 AM: Full Sweep has completed. Elapsed time 04:56:23
7/21/2010 6:07:59 AM: File Sweep Complete, Elapsed Time: 04:53:47
7/21/2010 2:04:15 AM: ApplicationMinimized - EXIT
7/21/2010 2:04:15 AM: ApplicationMinimized - ENTER
7/21/2010 1:59:34 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:50:07 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:46:57 AM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
7/21/2010 1:46:56 AM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/21/2010 1:46:56 AM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/21/2010 1:44:05 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@scorecardresearch[1].txt". The system cannot find the file specified
7/21/2010 1:44:05 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\bases\five\avc\krn003.avc". The system cannot find the path specified
7/21/2010 1:44:04 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\index\master.xml.klz". The system cannot find the path specified
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@scorecardresearch[1].txt". The operation completed successfully
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\bases\five\avc\krn003.avc". The operation completed successfully
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\index\master.xml.klz". The operation completed successfully
7/21/2010 1:39:17 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:39:17 AM: Tracking Cookies Shield: Removed advertising cookie
7/21/2010 1:29:22 AM: ApplicationMinimized - EXIT
7/21/2010 1:29:22 AM: ApplicationMinimized - ENTER
7/21/2010 1:26:59 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/21/2010 1:26:58 AM: Tracking Cookies Shield: Removed advertising cookie
7/21/2010 1:26:57 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:26:34 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/21/2010 1:26:34 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/21/2010 1:14:11 AM: Starting File Sweep
7/21/2010 1:14:11 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/21/2010 1:14:11 AM: Starting Cookie Sweep
7/21/2010 1:14:10 AM: Registry Sweep Complete, Elapsed Time:00:00:20
7/21/2010 1:13:50 AM: Starting Registry Sweep
7/21/2010 1:13:50 AM: Memory Sweep Complete, Elapsed Time: 00:07:02
7/21/2010 1:09:11 AM: ApplicationMinimized - EXIT
7/21/2010 1:09:11 AM: ApplicationMinimized - ENTER
7/21/2010 1:08:28 AM: IE Favorites Shield: Entry Allowed: http://www.kaspersky.com/kos/eng/partner/d…n=1279698772787
7/21/2010 1:08:28 AM: IE Favorites Shield: Entry Allowed: http://www.kaspersky.com/kos/eng/partner/d…n=1279698772787
7/21/2010 1:06:47 AM: Starting Memory Sweep
7/21/2010 1:06:45 AM: Start Full Sweep
7/21/2010 1:06:45 AM: Sweep initiated using definitions version 1745
7/21/2010 1:01:57 AM: ApplicationMinimized - EXIT
7/21/2010 1:01:57 AM: ApplicationMinimized - ENTER
7/21/2010 1:01:00 AM: None
7/21/2010 1:01:00 AM: Traces Found: 0
7/21/2010 1:01:00 AM: Quick Sweep has completed. Elapsed time 00:07:08
7/21/2010 1:00:59 AM: File Sweep Complete, Elapsed Time: 00:05:08
7/21/2010 12:55:50 AM: Starting File Sweep
7/21/2010 12:55:49 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/21/2010 12:55:49 AM: Starting Cookie Sweep
7/21/2010 12:55:48 AM: Registry Sweep Complete, Elapsed Time:00:00:21
7/21/2010 12:55:33 AM: ApplicationMinimized - EXIT
7/21/2010 12:55:33 AM: ApplicationMinimized - ENTER
7/21/2010 12:55:27 AM: Starting Registry Sweep
7/21/2010 12:55:27 AM: Memory Sweep Complete, Elapsed Time: 00:01:34
7/21/2010 12:53:53 AM: Starting Memory Sweep
7/21/2010 12:53:51 AM: Start Quick Sweep
7/21/2010 12:53:51 AM: Sweep initiated using definitions version 1745
7/21/2010 12:53:39 AM: None
7/21/2010 12:53:39 AM: Traces Found: 0
7/21/2010 12:53:37 AM: Sweep Cancelled
7/21/2010 12:53:34 AM: Start Custom Sweep
7/21/2010 12:53:34 AM: Sweep initiated using definitions version 1745
7/21/2010 12:49:14 AM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/21/2010 12:49:14 AM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/21/2010 12:49:10 AM: Warning: Unable to secure run key from ambiguous path exploit for HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegistryMechanic. Parse Failure
7/21/2010 12:49:03 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:48:57 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/21/2010 12:48:37 AM: License Check Status (0): Success
7/21/2010 12:47:23 AM: Webroot Software 6.1.0.145 started
7/21/2010 12:47:23 AM: | Start of Session, Wednesday, July 21, 2010 |
***************
7/21/2010 12:44:51 AM: Sweep Cancelled
7/21/2010 12:42:39 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:42:28 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:42:00 AM: Access to Hosts file allowed for C:\Users\Tim\Desktop\OTL.exe
7/21/2010 12:41:57 AM: Access to Hosts file allowed for C:\Users\Tim\Desktop\OTL.exe
7/21/2010 12:29:37 AM: ApplicationMinimized - EXIT
7/21/2010 12:29:37 AM: ApplicationMinimized - ENTER
7/21/2010 12:28:06 AM: ApplicationMinimized - EXIT
7/21/2010 12:28:06 AM: ApplicationMinimized - ENTER
7/21/2010 12:22:56 AM: ApplicationMinimized - EXIT
7/21/2010 12:22:56 AM: ApplicationMinimized - ENTER
7/21/2010 12:18:54 AM: ApplicationMinimized - EXIT
7/21/2010 12:18:54 AM: ApplicationMinimized - ENTER
7/21/2010 12:13:19 AM: ApplicationMinimized - EXIT
7/21/2010 12:13:19 AM: ApplicationMinimized - ENTER
7/20/2010 11:57:23 PM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
Trace marked as Always Remove
7/20/2010 11:57:22 PM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/20/2010 11:57:22 PM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/20/2010 11:55:09 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\Desktop\New WinRAR ZIP archive.zip]
7/20/2010 11:54:57 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp1_system cleaner (keep this).zip\New WinRAR ZIP archive.zip]
7/20/2010 11:53:45 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][4].txt". The system cannot find the file specified
7/20/2010 11:53:42 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][4].txt". The system cannot find the file specified
7/20/2010 11:53:42 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@live[3].txt". The system cannot find the file specified
7/20/2010 11:53:41 PM: Warning: Failed to process link. Cannot open file "C:\Windows\System32\LogFiles\Scm\72c626cf-6ca2-4f6f-8af6-907350e4df14". The system cannot find the file specified
7/20/2010 11:53:39 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt00.sqm". The system cannot find the file specified
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][4].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][4].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@live[3].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Windows\System32\LogFiles\Scm\72c626cf-6ca2-4f6f-8af6-907350e4df14". The operation completed successfully
7/20/2010 11:53:37 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt00.sqm". The operation completed successfully
7/20/2010 11:36:06 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/20/2010 11:36:06 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/20/2010 11:26:32 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 11:19:59 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/20/2010 11:18:45 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp4_New WinRAR ZIP archive.zip\ComboFix.exe]
7/20/2010 11:18:16 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/20/2010 11:17:18 PM: ApplicationMinimized - EXIT
7/20/2010 11:17:18 PM: ApplicationMinimized - ENTER
7/20/2010 11:17:11 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/20/2010 11:17:06 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/20/2010 11:16:55 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 11:15:42 PM: Starting File Sweep
7/20/2010 11:15:42 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/20/2010 11:15:42 PM: Starting Cookie Sweep
7/20/2010 11:15:41 PM: Registry Sweep Complete, Elapsed Time:00:00:26
7/20/2010 11:15:38 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/20/2010 11:15:38 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\gupdate (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\gusvc (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SeaPort (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules || {57269AE5-85F1-4FF4-86BB-7ED28DDDDA5D} (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules || {2CF8E4DF-A1F5-4A97-83EB-59683D62C84F} (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\eventlog\Application\SeaPort (ID = 0)
7/20/2010 11:15:34 PM: Found System Monitor: potentially rootkit-masked registry
7/20/2010 11:15:15 PM: Starting Registry Sweep
7/20/2010 11:15:15 PM: Memory Sweep Complete, Elapsed Time: 00:01:09
7/20/2010 11:14:08 PM: ApplicationMinimized - EXIT
7/20/2010 11:14:08 PM: ApplicationMinimized - ENTER
7/20/2010 11:14:05 PM: Starting Memory Sweep
7/20/2010 11:14:03 PM: Start Custom Sweep
7/20/2010 11:14:03 PM: Sweep initiated using definitions version 1745
7/20/2010 11:13:30 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 11:13:30 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 11:13:27 PM: Warning: Unable to secure run key from ambiguous path exploit for HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegistryMechanic. Parse Failure
7/20/2010 11:13:21 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 11:13:16 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 11:12:57 PM: License Check Status (0): Success
7/20/2010 11:12:21 PM: Webroot Software 6.1.0.145 started
7/20/2010 11:12:21 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 10:55:06 PM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
Trace marked as Always Remove
7/20/2010 10:55:05 PM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/20/2010 10:55:04 PM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/20/2010 10:52:34 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\Desktop\New WinRAR ZIP archive.zip]
7/20/2010 10:52:21 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp1_system cleaner (keep this).zip\New WinRAR ZIP archive.zip]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SeaNote.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SearchBoxExt.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SHelper.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.cab]
7/20/2010 10:51:11 PM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\Search Enhancement Pack\SCServer\sbconfig.xml". The system cannot find the path specified
7/20/2010 10:51:11 PM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\Search Enhancement Pack\Search Helper\shelper.xml". The system cannot find the path specified
7/20/2010 10:51:09 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt". The system cannot find the file specified
7/20/2010 10:51:07 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt". The system cannot find the file specified
7/20/2010 10:51:06 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt". The system cannot find the file specified
7/20/2010 10:51:04 PM: Warning: Failed to open file "C:\ProgramData\Microsoft\Search Enhancement Pack\SCServer\sbconfig.xml". The operation completed successfully
7/20/2010 10:51:04 PM: Warning: Failed to open file "C:\ProgramData\Microsoft\Search Enhancement Pack\Search Helper\shelper.xml". The operation completed successfully
7/20/2010 10:51:03 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt". The operation completed successfully
7/20/2010 10:51:03 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt". The operation completed successfully
7/20/2010 10:51:01 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt". The operation completed successfully
7/20/2010 10:49:30 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533bf.msi]
7/20/2010 10:43:44 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533d1.msi]
7/20/2010 10:43:23 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Installers\DefaultManager2.1.54\DefaultManager.msi]
7/20/2010 10:43:17 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533c5.msp]
7/20/2010 10:39:19 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\12a1d85.msi]
7/20/2010 10:29:37 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Google\Update\1.2.183.13\GoogleUpdateHelper.msi]
7/20/2010 10:28:23 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/20/2010 10:28:23 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/20/2010 10:27:44 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Installers\SearchEnhancementPack2.0.264\SearchEnhancementPack.msi]
7/20/2010 10:26:31 PM: ApplicationMinimized - EXIT
7/20/2010 10:26:31 PM: ApplicationMinimized - ENTER
7/20/2010 10:10:03 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:09:29 PM: ApplicationMinimized - EXIT
7/20/2010 10:09:29 PM: ApplicationMinimized - ENTER
7/20/2010 10:07:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:07:17 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/20/2010 10:07:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:07:10 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:05:42 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp4_New WinRAR ZIP archive.zip\ComboFix.exe]
7/20/2010 10:05:14 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/20/2010 10:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/20/2010 10:03:45 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:03:44 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/20/2010 10:00:07 PM: Starting File Sweep
7/20/2010 10:00:06 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/20/2010 10:00:06 PM: Starting Cookie Sweep
7/20/2010 10:00:04 PM: Registry Sweep Complete, Elapsed Time:00:00:39
7/20/2010 9:59:57 PM: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update || DownloadExpirationTime (ID = 0)
7/20/2010 9:59:55 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/20/2010 9:59:55 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/20/2010 9:59:55 PM: Found System Monitor: potentially rootkit-masked registry
7/20/2010 9:59:25 PM: Starting Registry Sweep
7/20/2010 9:59:24 PM: Memory Sweep Complete, Elapsed Time: 00:01:56
7/20/2010 9:57:30 PM: ApplicationMinimized - EXIT
7/20/2010 9:57:30 PM: ApplicationMinimized - ENTER
7/20/2010 9:57:28 PM: Starting Memory Sweep
7/20/2010 9:57:26 PM: Start Custom Sweep
7/20/2010 9:57:26 PM: Sweep initiated using definitions version 1745
7/20/2010 9:43:50 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:43:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:31:59 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/20/2010 9:31:58 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:31:40 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:22:16 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:21:59 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 9:21:59 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 9:21:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 9:21:51 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 9:21:50 PM: License Check Status (0): Success
7/20/2010 9:21:45 PM: Webroot Software 6.1.0.145 started
7/20/2010 9:21:45 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 9:15:25 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 9:15:25 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 9:15:15 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 9:15:06 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 9:14:32 PM: License Check Status (0): Success
7/20/2010 9:13:44 PM: Webroot Software 6.1.0.145 started
7/20/2010 9:13:44 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 6:01:57 PM: Your virus definitions have been updated.
7/20/2010 6:01:57 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/20/2010 6:01:57 PM: Your security definitions have been updated.
7/20/2010 6:01:27 PM: License Check Status (0): Success
7/20/2010 6:01:25 PM: Automated check for program update in progress.
7/20/2010 11:07:28 AM: ApplicationMinimized - EXIT
7/20/2010 11:07:28 AM: ApplicationMinimized - ENTER
7/20/2010 11:07:26 AM: Startup Shield: Entry Denied: LimeWire On Startup.lnk
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000006.xml
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000006.dmp
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000005.xml
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000005.dmp
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000004.xml
7/20/2010 11:07:15 AM: Review and send the error report: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000004.dmp
7/20/2010 10:46:42 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:46:40 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/20/2010 10:45:17 AM: Tracking Cookies Shield: Removed serving-sys cookie
7/20/2010 10:45:17 AM: Tracking Cookies Shield: Removed bs.serving-sys cookie
7/20/2010 10:44:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:44:30 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 10:44:16 AM: Tracking Cookies Shield: Removed ic-live cookie
7/20/2010 10:44:11 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 12:53:49 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 12:12:11 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 11:00:40 PM: Tracking Cookies Shield: Removed ru4 cookie
7/19/2010 10:56:45 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 10:56:45 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:56:41 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:32:57 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 10:32:54 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:32:36 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 6:00:32 PM: Your virus definitions have been updated.
7/19/2010 6:00:32 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 6:00:32 PM: Your security definitions have been updated.
7/19/2010 6:00:12 PM: License Check Status (0): Success
7/19/2010 6:00:11 PM: Automated check for program update in progress.
7/19/2010 5:01:00 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 4:59:34 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 4:59:34 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 4:59:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 4:59:21 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 4:59:00 PM: License Check Status (0): Success
7/19/2010 4:58:20 PM: Webroot Software 6.1.0.145 started
7/19/2010 4:58:20 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:32:19 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 1:32:19 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 1:32:10 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:32:07 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 1:31:22 PM: License Check Status (0): Success
7/19/2010 1:30:42 PM: Webroot Software 6.1.0.145 started
7/19/2010 1:30:42 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:27:38 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:27:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:27:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:27:32 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:19:16 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:19:13 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:19:13 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:19:12 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:19:07 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:19:01 PM: Your virus definitions have been updated.
7/19/2010 1:19:01 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/19/2010 1:19:01 PM: Your security definitions have been updated.
7/19/2010 1:18:44 PM: License Check Status (0): Success
7/19/2010 1:18:44 PM: Automated check for program update in progress.
7/19/2010 1:18:17 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:18:14 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:18:14 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:18:10 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:18:09 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 1:18:09 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 1:18:04 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:18:00 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/19/2010 1:17:51 PM: License Check Status (0): Success
7/19/2010 1:17:38 PM: Webroot Software 6.1.0.145 started
7/19/2010 1:17:38 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:06:58 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:06:56 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:06:56 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:06:53 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:06:10 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:06:08 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:06:08 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:06:05 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:05:39 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:05:38 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:05:37 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:05:37 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:05:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:05:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:05:34 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:05:33 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:03:55 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:03:49 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 12:49:11 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 12:49:09 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 9:41:51 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 9:41:50 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 9:40:23 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 9:40:23 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 9:40:08 AM: Tracking Cookies Shield: Removed ic-live cookie
7/18/2010 11:41:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 9:40:29 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:40:14 PM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 9:40:10 PM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 9:40:10 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:40:09 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:37:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 9:35:47 PM: ApplicationMinimized - EXIT
7/18/2010 9:35:47 PM: ApplicationMinimized - ENTER
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000006.xml
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000006.dmp
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000005.xml
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000005.dmp
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000004.xml
7/18/2010 9:35:39 PM: Review and send the error report: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000004.dmp
7/18/2010 6:54:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 6:11:48 PM: ApplicationMinimized - EXIT
7/18/2010 6:11:48 PM: ApplicationMinimized - ENTER
7/18/2010 6:11:45 PM: BHO Shield: found: – BHO installation denied at user request
7/18/2010 5:35:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:32:41 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:32:19 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:26:07 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:25:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:25:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:16:14 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 5:16:14 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:15:59 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:15:53 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 5:15:08 PM: License Check Status (0): Success
7/18/2010 5:14:17 PM: Webroot Software 6.1.0.145 started
7/18/2010 5:14:17 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 5:10:52 PM: ApplicationMinimized - EXIT
7/18/2010 5:10:52 PM: ApplicationMinimized - ENTER
7/18/2010 5:00:37 PM: ApplicationMinimized - EXIT
7/18/2010 5:00:37 PM: ApplicationMinimized - ENTER
7/18/2010 4:58:22 PM: ApplicationMinimized - EXIT
7/18/2010 4:58:22 PM: ApplicationMinimized - ENTER
7/18/2010 4:57:30 PM: ApplicationMinimized - EXIT
7/18/2010 4:57:30 PM: ApplicationMinimized - ENTER
7/18/2010 4:55:17 PM: ApplicationMinimized - EXIT
7/18/2010 4:55:17 PM: ApplicationMinimized - ENTER
7/18/2010 4:54:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 4:53:49 PM: ApplicationMinimized - EXIT
7/18/2010 4:53:49 PM: ApplicationMinimized - ENTER
7/18/2010 4:53:13 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/18/2010 4:53:13 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/18/2010 4:53:00 PM: ApplicationMinimized - EXIT
7/18/2010 4:53:00 PM: ApplicationMinimized - ENTER
7/18/2010 4:36:27 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/18/2010 4:35:45 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/18/2010 4:33:05 PM: Starting File Sweep
7/18/2010 4:33:05 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/18/2010 4:33:05 PM: Starting Cookie Sweep
7/18/2010 4:33:05 PM: Registry Sweep Complete, Elapsed Time:00:00:17
7/18/2010 4:33:05 PM: Warning: ***CRegistryAccess::Enumerate: failed – UNKNOWN
7/18/2010 4:32:47 PM: Starting Registry Sweep
7/18/2010 4:32:47 PM: Memory Sweep Complete, Elapsed Time: 00:01:11
7/18/2010 4:31:36 PM: Starting Memory Sweep
7/18/2010 4:31:34 PM: Start Custom Sweep
7/18/2010 4:31:34 PM: Sweep initiated using definitions version 1743
7/18/2010 4:31:28 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 4:31:28 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed zedo cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed tribalfusion cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 4:31:15 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 4:30:59 PM: License Check Status (0): Success
7/18/2010 4:30:21 PM: Webroot Software 6.1.0.145 started
7/18/2010 4:30:21 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 1:55:04 PM: License Check Status (0): Success
7/18/2010 1:50:38 PM: ApplicationMinimized - EXIT
7/18/2010 1:50:38 PM: ApplicationMinimized - ENTER
7/18/2010 1:50:12 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 1:50:07 PM: Error: [MiniDump File: C:\ProgramData\Webroot\BugReports\SpySweeper.exe.000006.dmp]
7/18/2010 1:50:07 PM: Error: [MiniDump File: C:\ProgramData\Webroot\BugReports\SpySweeper.exe.000005.dmp]
7/18/2010 1:50:01 PM: Webroot Software 6.1.0.145 started
7/18/2010 1:50:01 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 12:28:17 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 12:10:54 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 12:10:29 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 12:10:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 12:10:27 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:54:45 AM: ApplicationMinimized - EXIT
7/18/2010 11:54:45 AM: ApplicationMinimized - ENTER
7/18/2010 11:54:40 AM: Removal process completed. Elapsed time 00:00:02
7/18/2010 11:54:39 AM: Quarantining All Traces: potentially rootkit-masked registry
7/18/2010 11:54:38 AM: Removal process initiated
7/18/2010 11:54:35 AM: Traces Found: 2
7/18/2010 11:54:35 AM: Custom Sweep has completed. Elapsed time 00:28:24
7/18/2010 11:54:35 AM: File Sweep Complete, Elapsed Time: 00:26:49
7/18/2010 11:54:14 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@collective-media[1].txt". The system cannot find the file specified
7/18/2010 11:54:08 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The system cannot find the file specified
7/18/2010 11:53:55 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VBBB7R02\b[2].gif". The system cannot find the file specified
7/18/2010 11:53:55 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@collective-media[1].txt". The operation completed successfully
7/18/2010 11:53:55 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/18/2010 11:53:54 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/18/2010 11:53:51 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VBBB7R02\b[2].gif". The operation completed successfully
7/18/2010 11:52:23 AM: ApplicationMinimized - EXIT
7/18/2010 11:52:22 AM: ApplicationMinimized - ENTER
7/18/2010 11:49:09 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMSUQLC2\zyngaIE_toolbar_5.7.2.2[1].exe]
7/18/2010 11:44:01 AM: ApplicationMinimized - EXIT
7/18/2010 11:44:01 AM: ApplicationMinimized - ENTER
7/18/2010 11:43:19 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QQARJ8AK\zyngaIE_toolbar_5.7.2.2[1].exe]
7/18/2010 11:42:20 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/18/2010 11:42:20 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/18/2010 11:41:01 AM: ApplicationMinimized - EXIT
7/18/2010 11:41:01 AM: ApplicationMinimized - ENTER
7/18/2010 11:40:13 AM: ApplicationMinimized - EXIT
7/18/2010 11:40:13 AM: ApplicationMinimized - ENTER
7/18/2010 11:36:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:36:56 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:36:38 AM: ApplicationMinimized - EXIT
7/18/2010 11:36:38 AM: ApplicationMinimized - ENTER
7/18/2010 11:35:25 AM: ApplicationMinimized - EXIT
7/18/2010 11:35:25 AM: ApplicationMinimized - ENTER
7/18/2010 11:35:04 AM: ApplicationMinimized - EXIT
7/18/2010 11:35:04 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:51 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:51 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:39 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:39 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:00 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:00 AM: ApplicationMinimized - ENTER
7/18/2010 11:33:25 AM: Tracking Cookies Shield: Removed ic-live cookie
7/18/2010 11:33:25 AM: ApplicationMinimized - EXIT
7/18/2010 11:33:25 AM: ApplicationMinimized - ENTER
7/18/2010 11:32:11 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:30:19 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/18/2010 11:29:52 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/18/2010 11:27:45 AM: Starting File Sweep
7/18/2010 11:27:45 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/18/2010 11:27:45 AM: Starting Cookie Sweep
7/18/2010 11:27:44 AM: Registry Sweep Complete, Elapsed Time:00:00:25
7/18/2010 11:27:42 AM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/18/2010 11:27:42 AM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/18/2010 11:27:42 AM: Found System Monitor: potentially rootkit-masked registry
7/18/2010 11:27:19 AM: Starting Registry Sweep
7/18/2010 11:27:19 AM: Memory Sweep Complete, Elapsed Time: 00:01:06
7/18/2010 11:26:12 AM: Starting Memory Sweep
7/18/2010 11:26:11 AM: Start Custom Sweep
7/18/2010 11:26:11 AM: Sweep initiated using definitions version 1743
7/18/2010 11:26:05 AM: IE Favorites Shield: Entry Allowed: http://go.microsoft.com/fwlink/?LinkId=55143
7/18/2010 11:25:59 AM: IE Favorites Shield: Entry Denied: http://redirect.hp.com/svs/rdr?TYPE=4&…d=pavilionc=101
7/18/2010 11:25:22 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:25:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:25:14 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:25:13 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:24:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:24:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:20:59 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:20:57 AM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 11:20:56 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:20:56 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:19:27 AM: IE Favorites Shield: Entry Denied: https://ieonline.microsoft.com/#ieslice
7/18/2010 11:19:27 AM: IE Favorites Shield: Entry Denied: http://go.microsoft.com/fwlink/?LinkId=121315
7/18/2010 11:16:41 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:16:40 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:16:38 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:16:38 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:13:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:11:28 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:11:27 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:11:27 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:09:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:09:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:08:15 AM: ApplicationMinimized - EXIT
7/18/2010 11:08:15 AM: ApplicationMinimized - ENTER
7/18/2010 11:08:12 AM: IE Security Shield: found: C:\Program Files (x86)\Internet Explorer\iexplore.exe – IE Security modification allowed at user request
7/18/2010 11:06:31 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:58:48 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:53:12 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:49:55 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:48:59 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:33:19 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:32:21 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:40 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:09 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:03 AM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 10:26:03 AM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 10:25:59 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:25:55 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:25:51 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 10:25:44 AM: License Check Status (0): Success
7/18/2010 10:25:39 AM: Webroot Software 6.1.0.145 started
7/18/2010 10:25:39 AM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 2:07:30 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 2:07:13 AM: Your virus definitions have been updated.
7/18/2010 2:07:12 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 04:33:52 (GMT)
7/18/2010 2:07:09 AM: Your definitions are up to date.
7/18/2010 2:06:50 AM: License Check Status (0): Success
7/18/2010 2:06:06 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 12:31:39 AM: ApplicationMinimized - EXIT
7/18/2010 12:31:39 AM: ApplicationMinimized - ENTER
7/18/2010 12:30:58 AM: ApplicationMinimized - EXIT
7/18/2010 12:30:58 AM: ApplicationMinimized - ENTER
7/18/2010 12:30:55 AM: Removal process completed. Elapsed time 00:00:04
7/18/2010 12:30:54 AM: Quarantining All Traces: potentially rootkit-masked registry
7/18/2010 12:30:51 AM: Removal process initiated
7/18/2010 12:25:42 AM: Traces Found: 2
7/18/2010 12:25:42 AM: Custom Sweep has completed. Elapsed time 00:58:48
7/18/2010 12:25:40 AM: File Sweep Complete, Elapsed Time: 00:57:13
7/17/2010 11:41:25 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:41:25 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:30:50 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 11:30:22 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 11:29:59 PM: ApplicationMinimized - EXIT
7/17/2010 11:29:59 PM: ApplicationMinimized - ENTER
7/17/2010 11:28:26 PM: Starting File Sweep
7/17/2010 11:28:26 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 11:28:26 PM: Starting Cookie Sweep
7/17/2010 11:28:25 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 11:28:23 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 11:28:23 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 11:28:23 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 11:28:00 PM: Starting Registry Sweep
7/17/2010 11:28:00 PM: Memory Sweep Complete, Elapsed Time: 00:01:04
7/17/2010 11:27:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:27:07 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:27:02 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:26:55 PM: Starting Memory Sweep
7/17/2010 11:26:53 PM: Start Custom Sweep
7/17/2010 11:26:53 PM: Sweep initiated using definitions version 1743
7/17/2010 11:25:41 PM: ApplicationMinimized - EXIT
7/17/2010 11:25:41 PM: ApplicationMinimized - ENTER
7/17/2010 11:25:29 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 11:25:27 PM: Removal process initiated
7/17/2010 11:18:55 PM: Traces Found: 2
7/17/2010 11:18:55 PM: Custom Sweep has completed. Elapsed time 00:24:42
7/17/2010 11:18:55 PM: File Sweep Complete, Elapsed Time: 00:23:02
7/17/2010 11:18:32 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\HP Support Framework\Resources\HPSetSystemRestore.xml". The system cannot find the file specified
7/17/2010 11:18:19 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\HP Support Framework\Resources\HPSetSystemRestore.xml". The operation completed successfully
7/17/2010 11:12:12 PM: ApplicationMinimized - EXIT
7/17/2010 11:12:12 PM: ApplicationMinimized - ENTER
7/17/2010 11:08:14 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:08:14 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:05:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:04:44 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:01:04 PM: ApplicationMinimized - EXIT
7/17/2010 11:01:04 PM: ApplicationMinimized - ENTER
7/17/2010 11:01:02 PM: ApplicationMinimized - EXIT
7/17/2010 11:01:02 PM: ApplicationMinimized - ENTER
7/17/2010 10:58:35 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 10:58:13 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 10:56:58 PM: ApplicationMinimized - EXIT
7/17/2010 10:56:58 PM: ApplicationMinimized - ENTER
7/17/2010 10:56:07 PM: ApplicationMinimized - EXIT
7/17/2010 10:56:07 PM: ApplicationMinimized - ENTER
7/17/2010 10:55:52 PM: Starting File Sweep
7/17/2010 10:55:52 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 10:55:52 PM: Starting Cookie Sweep
7/17/2010 10:55:51 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 10:55:49 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 10:55:49 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 10:55:49 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 10:55:26 PM: Starting Registry Sweep
7/17/2010 10:55:26 PM: Memory Sweep Complete, Elapsed Time: 00:01:11
7/17/2010 10:54:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 10:54:17 PM: ApplicationMinimized - EXIT
7/17/2010 10:54:17 PM: ApplicationMinimized - ENTER
7/17/2010 10:54:14 PM: Starting Memory Sweep
7/17/2010 10:54:12 PM: Start Custom Sweep
7/17/2010 10:54:12 PM: Sweep initiated using definitions version 1743
7/17/2010 10:47:47 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 10:47:46 PM: Quarantining All Traces: potentially rootkit-masked registry
7/17/2010 10:47:46 PM: Removal process initiated
7/17/2010 10:47:41 PM: Traces Found: 2
7/17/2010 10:47:41 PM: Custom Sweep has completed. Elapsed time 00:25:37
7/17/2010 10:47:40 PM: File Sweep Complete, Elapsed Time: 00:24:10
7/17/2010 10:35:59 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:35:59 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:34:00 PM: ApplicationMinimized - EXIT
7/17/2010 10:34:00 PM: ApplicationMinimized - ENTER
7/17/2010 10:26:35 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{A12A3222-9227-11DF-9AAC-18A905C0D717}.dat]
7/17/2010 10:26:03 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 10:25:37 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 10:25:33 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 10:23:29 PM: Starting File Sweep
7/17/2010 10:23:29 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 10:23:29 PM: Starting Cookie Sweep
7/17/2010 10:23:28 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 10:23:26 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 10:23:26 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 10:23:26 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 10:23:03 PM: Starting Registry Sweep
7/17/2010 10:23:03 PM: Memory Sweep Complete, Elapsed Time: 00:00:58
7/17/2010 10:22:04 PM: Starting Memory Sweep
7/17/2010 10:22:03 PM: Start Custom Sweep
7/17/2010 10:22:03 PM: Sweep initiated using definitions version 1743
7/17/2010 10:21:57 PM: Deletion from quarantine completed. Elapsed time 00:00:00
7/17/2010 10:21:57 PM: Processing: rogue security products
7/17/2010 10:21:57 PM: Deletion from quarantine initiated
7/17/2010 10:21:31 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 10:21:29 PM: Quarantining All Traces: potentially rootkit-masked registry
7/17/2010 10:21:29 PM: Quarantining All Traces: rogue security products
7/17/2010 10:21:29 PM: Removal process initiated
7/17/2010 10:15:12 PM: Traces Found: 3
7/17/2010 10:15:12 PM: Custom Sweep has completed. Elapsed time 00:26:59
7/17/2010 10:15:11 PM: File Sweep Complete, Elapsed Time: 00:25:32
7/17/2010 10:04:24 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:04:24 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 9:52:12 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 9:51:42 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 9:49:38 PM: Starting File Sweep
7/17/2010 9:49:38 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 9:49:38 PM: Starting Cookie Sweep
7/17/2010 9:49:38 PM: Registry Sweep Complete, Elapsed Time:00:00:24
7/17/2010 9:49:35 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 9:49:35 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 9:49:35 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 9:49:21 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\avsolution\ (ID = 7685460)
7/17/2010 9:49:21 PM: Found Adware: rogue security products
7/17/2010 9:49:13 PM: Starting Registry Sweep
7/17/2010 9:49:13 PM: Memory Sweep Complete, Elapsed Time: 00:00:58
7/17/2010 9:48:14 PM: Starting Memory Sweep
7/17/2010 9:48:12 PM: Start Custom Sweep
7/17/2010 9:48:12 PM: Sweep initiated using definitions version 1743
7/17/2010 9:48:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:47:58 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:47:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:37:42 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:35 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/17/2010 9:36:35 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/17/2010 9:36:28 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:17 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 04:33:52 (GMT)
7/17/2010 9:35:52 PM: License Check Status (0): Success
7/17/2010 9:35:38 PM: Webroot Software 6.1.0.145 started
7/17/2010 9:35:38 PM: | Start of Session, Saturday, July 17, 2010 |
***************
7/17/2010 9:31:26 PM: ApplicationMinimized - EXIT
7/17/2010 9:31:26 PM: ApplicationMinimized - ENTER
7/17/2010 9:29:54 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:29:54 PM: Your definitions are up to date.
7/17/2010 9:29:53 PM: License Check Status (0): Success
7/17/2010 9:28:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:27:51 PM: Your virus definitions have been updated.
7/17/2010 9:27:51 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/14/2010 14:17:56 (GMT)
7/17/2010 9:27:51 PM: Your security definitions have been updated.
7/17/2010 9:27:32 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:27:26 PM: License Check Status (0): Success
7/17/2010 9:26:43 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:26:24 PM: Deletion from quarantine completed. Elapsed time 00:00:00
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Deletion from quarantine initiated
7/17/2010 9:26:10 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/17/2010 9:26:10 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/17/2010 9:26:08 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:58 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:48 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:43 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/14/2010 14:17:56 (GMT)
7/17/2010 9:25:25 PM: License Check Status (0): Success
7/17/2010 9:24:59 PM: Webroot Software 6.1.0.145 started
7/17/2010 9:24:59 PM: | Start of Session, Saturday, July 17, 2010 |
***************
7/17/2010 9:22:02 PM: Removal process completed. Elapsed time 00:00:11
7/17/2010 9:22:02 PM: Preparing to restart your computer. Please wait…
7/17/2010 9:21:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:21:52 PM: Quarantining All Traces: rogue security products
7/17/2010 9:21:52 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 9:21:52 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 9:21:50 PM: Removal process initiated
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 1:09:49 PM: Traces Found: 7
7/17/2010 1:09:49 PM: Full Sweep has completed. Elapsed time 00:25:17
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\ikchvaanr\mytnlyttssd.exe (ID = 5615592)
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMSUQLC2\movie[1].exe (ID = 5615592)
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XG7R2TSW\movie97670[1].exe (ID = 5615592)
7/17/2010 1:09:48 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\microsoft\windows\currentversion\internet settings\ || proxyoverride (ID = 6739704)
7/17/2010 1:09:48 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run || rgkhmerp (ID = 0)
7/17/2010 1:09:48 PM: Detected running threat: C:\Users\Tim\AppData\Local\ikchvaanr\mytnlyttssd.exe (ID = 5615592)
7/17/2010 1:09:48 PM: File Sweep Complete, Elapsed Time: 00:22:04
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_LARGE.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MEDIUM.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_SMALL.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MINI.db-journal". The system cannot find the file specified
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_LARGE.db-journal". The operation completed successfully
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MEDIUM.db-journal". The operation completed successfully
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_SMALL.db-journal". The operation completed successfully
7/17/2010 1:09:18 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MINI.db-journal". The operation completed successfully
7/17/2010 1:00:25 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 1:00:25 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:50:26 PM: ApplicationMinimized - EXIT
7/17/2010 12:50:26 PM: ApplicationMinimized - ENTER
7/17/2010 12:50:11 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 12:49:47 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 12:49:09 PM: ApplicationMinimized - EXIT
7/17/2010 12:49:09 PM: ApplicationMinimized - ENTER
7/17/2010 12:48:49 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:49 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:43 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:47:43 PM: Starting File Sweep
7/17/2010 12:47:43 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 12:47:43 PM: Starting Cookie Sweep
7/17/2010 12:47:42 PM: Registry Sweep Complete, Elapsed Time:00:00:17
7/17/2010 12:47:33 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\avsuite\ (ID = 7339865)
7/17/2010 12:47:33 PM: Found Adware: rogue security products
7/17/2010 12:47:25 PM: Starting Registry Sweep
7/17/2010 12:47:25 PM: Memory Sweep Complete, Elapsed Time: 00:02:51
7/17/2010 12:46:37 PM: ApplicationMinimized - EXIT
7/17/2010 12:46:36 PM: ApplicationMinimized - ENTER
7/17/2010 12:46:27 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:46:15 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:46:13 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:44:33 PM: ApplicationMinimized - EXIT
7/17/2010 12:44:33 PM: ApplicationMinimized - ENTER
7/17/2010 12:44:33 PM: Starting Memory Sweep
7/17/2010 12:44:32 PM: Start Full Sweep
7/17/2010 12:44:32 PM: Sweep initiated using definitions version 1740
7/17/2010 12:44:26 PM: None
7/17/2010 12:44:26 PM: Traces Found: 0
7/17/2010 12:44:26 PM: Memory Sweep Complete, Elapsed Time: 00:00:04
7/17/2010 12:44:26 PM: Sweep Cancelled
7/17/2010 12:44:22 PM: Starting Memory Sweep
7/17/2010 12:44:21 PM: Start Custom Sweep
7/17/2010 12:44:21 PM: Sweep initiated using definitions version 1740
7/17/2010 12:43:39 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:40:37 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:40:35 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:40:27 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:40:25 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:39:34 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:39:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:26 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:29:22 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:11 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:29:07 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:06 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:26:04 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:26:04 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:26:03 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:25:55 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:25:52 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:07:26 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 8:19:24 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:40:12 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:40:12 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:40:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:39:04 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:38:41 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:38:31 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:38:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:38:07 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:37:51 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:32:17 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:53 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:49 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:36 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:32 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:12 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:01 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:25:30 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:25:29 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:25:28 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:21:18 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:21:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:21:01 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:44 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:20:44 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:36 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:34 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:33 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:20 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:16 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:14 AM: ApplicationMinimized - EXIT
7/17/2010 6:20:14 AM: ApplicationMinimized - ENTER
7/17/2010 3:38:02 AM: None
7/17/2010 3:38:02 AM: Traces Found: 0
7/17/2010 3:38:02 AM: Scheduled Sweep has completed. Elapsed time 03:37:58
7/17/2010 3:38:01 AM: File Sweep Complete, Elapsed Time: 03:36:16
7/17/2010 3:37:41 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The system cannot find the file specified
7/17/2010 3:37:29 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/17/2010 3:37:27 AM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\eHome\mcepg2-0\backup\recordings\20100715_155159". The system cannot find the file specified
7/17/2010 3:37:26 AM: Warning: Failed to open file "C:\ProgramData\Microsoft\eHome\mcepg2-0\backup\recordings\20100715_155159". The operation completed successfully
7/17/2010 12:14:39 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:14:39 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:04:08 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 12:03:45 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 12:01:45 AM: Starting File Sweep
7/17/2010 12:01:44 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 12:01:44 AM: Starting Cookie Sweep
7/17/2010 12:01:44 AM: Registry Sweep Complete, Elapsed Time:00:00:17
7/17/2010 12:01:27 AM: Starting Registry Sweep
7/17/2010 12:01:27 AM: Memory Sweep Complete, Elapsed Time: 00:01:20
7/17/2010 12:00:06 AM: Starting Memory Sweep
7/17/2010 12:00:03 AM: Start Scheduled Sweep
7/17/2010 12:00:03 AM: Sweep initiated using definitions version 1740
7/16/2010 11:41:31 PM: IE Favorites Shield: Entry Allowed: http://join.pantherexpedite.com/contact.aspx
7/16/2010 11:41:31 PM: IE Favorites Shield: Entry Allowed: http://join.pantherexpedite.com/contact.aspx
7/16/2010 11:41:25 PM: IE Favorites Shield: Entry Allowed: http://www.driveforknighttrans.com/
7/16/2010 11:41:25 PM: IE Favorites Shield: Entry Allowed: http://www.driveforknighttrans.com/
7/16/2010 11:34:27 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 11:34:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 11:34:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 11:34:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 7:54:54 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 7:54:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 7:54:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 7:54:51 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 6:53:40 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:49:50 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:49:17 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:37:13 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:37:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:32:58 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:32:58 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:31 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:11:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:28 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:54:52 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:52:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:43:39 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:43:36 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:37:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:35:19 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:30:12 PM: ApplicationMinimized - EXIT
7/16/2010 2:30:12 PM: ApplicationMinimized - ENTER
7/16/2010 11:06:22 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 11:06:20 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 11:06:18 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 10:15:54 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 10:15:54 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 9:45:08 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:56 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:54 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 9:44:54 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:53 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:43 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:54:22 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:45:35 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 8:45:35 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:45:34 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:44:57 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:42:15 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 8:42:06 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:41:21 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:56:08 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:55:41 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:55:12 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:53:47 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:41:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:52 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 11:38:49 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:48 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:37:17 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:37:15 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:37:05 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:49 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:33 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 11:36:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:29 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:07:25 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:07:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:06:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:02:15 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 10:50:32 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:50:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:50:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:50:26 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 5:13:12 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 5:13:09 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 5:13:08 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 4:09:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 4:08:59 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 4:08:59 PM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 1:00:03 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 1:00:03 PM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed advertising cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 10:35:08 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:35:05 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:35:04 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 10:14:46 AM: ApplicationMinimized - EXIT
7/15/2010 10:14:46 AM: ApplicationMinimized - ENTER
7/15/2010 10:14:31 AM: Startup Shield: Entry Denied: LimeWire On Startup.lnk
7/15/2010 10:08:49 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:08:46 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:08:40 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 1:42:43 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 12:38:32 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:51 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:51 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 12:09:50 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:50 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:52:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:45:03 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/14/2010 11:45:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:45:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:31:20 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:31:19 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:31:19 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed advertising cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:30:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/14/2010 11:26:32 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:15:29 PM: Tracking Cookies Shield: Removed advertising cookie
*** Session Log display limited to the first 1000 lines ***
It's strange how everything else is coming up with no infected files and webroot comes up with a bunch.
Wednesday, July 21, 2010
Operating system: Microsoft (build 7600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, July 21, 2010 05:31:09
Records in database: 4229132
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
Scan statistics
Objects scanned 159663
Threats found 0
Infected objects found 0
Suspicious objects found 0
Scan duration 01:20:41
No threats found. Scanned area is clean.
Selected area has been scanned.
Webroot Log
7/21/2010 6:52:49 AM: Removal process completed. Elapsed time 00:00:28
7/21/2010 6:52:21 AM: Quarantining All Traces: Mal/JavaDeSp-A
7/21/2010 6:52:21 AM: Removal process initiated
7/21/2010 6:08:00 AM: Traces Found: 1
7/21/2010 6:08:00 AM: Full Sweep has completed. Elapsed time 04:56:23
7/21/2010 6:07:59 AM: File Sweep Complete, Elapsed Time: 04:53:47
7/21/2010 2:04:15 AM: ApplicationMinimized - EXIT
7/21/2010 2:04:15 AM: ApplicationMinimized - ENTER
7/21/2010 1:59:34 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:50:07 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:46:57 AM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
7/21/2010 1:46:56 AM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/21/2010 1:46:56 AM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/21/2010 1:44:05 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@scorecardresearch[1].txt". The system cannot find the file specified
7/21/2010 1:44:05 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\bases\five\avc\krn003.avc". The system cannot find the path specified
7/21/2010 1:44:04 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\index\master.xml.klz". The system cannot find the path specified
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@scorecardresearch[1].txt". The operation completed successfully
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\bases\five\avc\krn003.avc". The operation completed successfully
7/21/2010 1:44:03 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Temp\KAV Updater update files\updateTemp\index\master.xml.klz". The operation completed successfully
7/21/2010 1:39:17 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:39:17 AM: Tracking Cookies Shield: Removed advertising cookie
7/21/2010 1:29:22 AM: ApplicationMinimized - EXIT
7/21/2010 1:29:22 AM: ApplicationMinimized - ENTER
7/21/2010 1:26:59 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/21/2010 1:26:58 AM: Tracking Cookies Shield: Removed advertising cookie
7/21/2010 1:26:57 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/21/2010 1:26:34 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/21/2010 1:26:34 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/21/2010 1:14:11 AM: Starting File Sweep
7/21/2010 1:14:11 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/21/2010 1:14:11 AM: Starting Cookie Sweep
7/21/2010 1:14:10 AM: Registry Sweep Complete, Elapsed Time:00:00:20
7/21/2010 1:13:50 AM: Starting Registry Sweep
7/21/2010 1:13:50 AM: Memory Sweep Complete, Elapsed Time: 00:07:02
7/21/2010 1:09:11 AM: ApplicationMinimized - EXIT
7/21/2010 1:09:11 AM: ApplicationMinimized - ENTER
7/21/2010 1:08:28 AM: IE Favorites Shield: Entry Allowed: http://www.kaspersky.com/kos/eng/partner/d…n=1279698772787
7/21/2010 1:08:28 AM: IE Favorites Shield: Entry Allowed: http://www.kaspersky.com/kos/eng/partner/d…n=1279698772787
7/21/2010 1:06:47 AM: Starting Memory Sweep
7/21/2010 1:06:45 AM: Start Full Sweep
7/21/2010 1:06:45 AM: Sweep initiated using definitions version 1745
7/21/2010 1:01:57 AM: ApplicationMinimized - EXIT
7/21/2010 1:01:57 AM: ApplicationMinimized - ENTER
7/21/2010 1:01:00 AM: None
7/21/2010 1:01:00 AM: Traces Found: 0
7/21/2010 1:01:00 AM: Quick Sweep has completed. Elapsed time 00:07:08
7/21/2010 1:00:59 AM: File Sweep Complete, Elapsed Time: 00:05:08
7/21/2010 12:55:50 AM: Starting File Sweep
7/21/2010 12:55:49 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/21/2010 12:55:49 AM: Starting Cookie Sweep
7/21/2010 12:55:48 AM: Registry Sweep Complete, Elapsed Time:00:00:21
7/21/2010 12:55:33 AM: ApplicationMinimized - EXIT
7/21/2010 12:55:33 AM: ApplicationMinimized - ENTER
7/21/2010 12:55:27 AM: Starting Registry Sweep
7/21/2010 12:55:27 AM: Memory Sweep Complete, Elapsed Time: 00:01:34
7/21/2010 12:53:53 AM: Starting Memory Sweep
7/21/2010 12:53:51 AM: Start Quick Sweep
7/21/2010 12:53:51 AM: Sweep initiated using definitions version 1745
7/21/2010 12:53:39 AM: None
7/21/2010 12:53:39 AM: Traces Found: 0
7/21/2010 12:53:37 AM: Sweep Cancelled
7/21/2010 12:53:34 AM: Start Custom Sweep
7/21/2010 12:53:34 AM: Sweep initiated using definitions version 1745
7/21/2010 12:49:14 AM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/21/2010 12:49:14 AM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/21/2010 12:49:10 AM: Warning: Unable to secure run key from ambiguous path exploit for HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegistryMechanic. Parse Failure
7/21/2010 12:49:03 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:48:57 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/21/2010 12:48:37 AM: License Check Status (0): Success
7/21/2010 12:47:23 AM: Webroot Software 6.1.0.145 started
7/21/2010 12:47:23 AM: | Start of Session, Wednesday, July 21, 2010 |
***************
7/21/2010 12:44:51 AM: Sweep Cancelled
7/21/2010 12:42:39 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:42:28 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/21/2010 12:42:00 AM: Access to Hosts file allowed for C:\Users\Tim\Desktop\OTL.exe
7/21/2010 12:41:57 AM: Access to Hosts file allowed for C:\Users\Tim\Desktop\OTL.exe
7/21/2010 12:29:37 AM: ApplicationMinimized - EXIT
7/21/2010 12:29:37 AM: ApplicationMinimized - ENTER
7/21/2010 12:28:06 AM: ApplicationMinimized - EXIT
7/21/2010 12:28:06 AM: ApplicationMinimized - ENTER
7/21/2010 12:22:56 AM: ApplicationMinimized - EXIT
7/21/2010 12:22:56 AM: ApplicationMinimized - ENTER
7/21/2010 12:18:54 AM: ApplicationMinimized - EXIT
7/21/2010 12:18:54 AM: ApplicationMinimized - ENTER
7/21/2010 12:13:19 AM: ApplicationMinimized - EXIT
7/21/2010 12:13:19 AM: ApplicationMinimized - ENTER
7/20/2010 11:57:23 PM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
Trace marked as Always Remove
7/20/2010 11:57:22 PM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/20/2010 11:57:22 PM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/20/2010 11:55:09 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\Desktop\New WinRAR ZIP archive.zip]
7/20/2010 11:54:57 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp1_system cleaner (keep this).zip\New WinRAR ZIP archive.zip]
7/20/2010 11:53:45 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][4].txt". The system cannot find the file specified
7/20/2010 11:53:42 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][4].txt". The system cannot find the file specified
7/20/2010 11:53:42 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@live[3].txt". The system cannot find the file specified
7/20/2010 11:53:41 PM: Warning: Failed to process link. Cannot open file "C:\Windows\System32\LogFiles\Scm\72c626cf-6ca2-4f6f-8af6-907350e4df14". The system cannot find the file specified
7/20/2010 11:53:39 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt00.sqm". The system cannot find the file specified
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][4].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][4].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@live[3].txt". The operation completed successfully
7/20/2010 11:53:38 PM: Warning: Failed to open file "C:\Windows\System32\LogFiles\Scm\72c626cf-6ca2-4f6f-8af6-907350e4df14". The operation completed successfully
7/20/2010 11:53:37 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt00.sqm". The operation completed successfully
7/20/2010 11:36:06 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/20/2010 11:36:06 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/20/2010 11:26:32 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 11:19:59 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/20/2010 11:18:45 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp4_New WinRAR ZIP archive.zip\ComboFix.exe]
7/20/2010 11:18:16 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/20/2010 11:17:18 PM: ApplicationMinimized - EXIT
7/20/2010 11:17:18 PM: ApplicationMinimized - ENTER
7/20/2010 11:17:11 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/20/2010 11:17:06 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/20/2010 11:16:55 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 11:15:42 PM: Starting File Sweep
7/20/2010 11:15:42 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/20/2010 11:15:42 PM: Starting Cookie Sweep
7/20/2010 11:15:41 PM: Registry Sweep Complete, Elapsed Time:00:00:26
7/20/2010 11:15:38 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/20/2010 11:15:38 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\gupdate (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\gusvc (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SeaPort (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules || {57269AE5-85F1-4FF4-86BB-7ED28DDDDA5D} (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules || {2CF8E4DF-A1F5-4A97-83EB-59683D62C84F} (ID = 0)
7/20/2010 11:15:34 PM: HKLM\SYSTEM\ControlSet002\services\eventlog\Application\SeaPort (ID = 0)
7/20/2010 11:15:34 PM: Found System Monitor: potentially rootkit-masked registry
7/20/2010 11:15:15 PM: Starting Registry Sweep
7/20/2010 11:15:15 PM: Memory Sweep Complete, Elapsed Time: 00:01:09
7/20/2010 11:14:08 PM: ApplicationMinimized - EXIT
7/20/2010 11:14:08 PM: ApplicationMinimized - ENTER
7/20/2010 11:14:05 PM: Starting Memory Sweep
7/20/2010 11:14:03 PM: Start Custom Sweep
7/20/2010 11:14:03 PM: Sweep initiated using definitions version 1745
7/20/2010 11:13:30 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 11:13:30 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 11:13:27 PM: Warning: Unable to secure run key from ambiguous path exploit for HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegistryMechanic. Parse Failure
7/20/2010 11:13:21 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 11:13:16 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 11:12:57 PM: License Check Status (0): Success
7/20/2010 11:12:21 PM: Webroot Software 6.1.0.145 started
7/20/2010 11:12:21 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 10:55:06 PM: Warning: Corrupt Archive: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 6.zip
Trace marked as Always Remove
7/20/2010 10:55:05 PM: K:\TIM-PC\Backup Set 2010-06-01 101655\Backup Files 2010-06-01 101655\Backup files 2.zip (ID = 0)
7/20/2010 10:55:04 PM: Found Mal/JavaDeSp-A: Mal/JavaDeSp-A
7/20/2010 10:52:34 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\Desktop\New WinRAR ZIP archive.zip]
7/20/2010 10:52:21 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp1_system cleaner (keep this).zip\New WinRAR ZIP archive.zip]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SeaNote.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SearchBoxExt.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SHelper.cab]
7/20/2010 10:52:17 PM: Warning: AntiVirus engine for IFO returned [Error Code FFFFFFFF] on [C:\ProgramData\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.cab]
7/20/2010 10:51:11 PM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\Search Enhancement Pack\SCServer\sbconfig.xml". The system cannot find the path specified
7/20/2010 10:51:11 PM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\Search Enhancement Pack\Search Helper\shelper.xml". The system cannot find the path specified
7/20/2010 10:51:09 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt". The system cannot find the file specified
7/20/2010 10:51:07 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt". The system cannot find the file specified
7/20/2010 10:51:06 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt". The system cannot find the file specified
7/20/2010 10:51:04 PM: Warning: Failed to open file "C:\ProgramData\Microsoft\Search Enhancement Pack\SCServer\sbconfig.xml". The operation completed successfully
7/20/2010 10:51:04 PM: Warning: Failed to open file "C:\ProgramData\Microsoft\Search Enhancement Pack\Search Helper\shelper.xml". The operation completed successfully
7/20/2010 10:51:03 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt". The operation completed successfully
7/20/2010 10:51:03 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt". The operation completed successfully
7/20/2010 10:51:01 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt". The operation completed successfully
7/20/2010 10:49:30 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533bf.msi]
7/20/2010 10:43:44 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533d1.msi]
7/20/2010 10:43:23 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Installers\DefaultManager2.1.54\DefaultManager.msi]
7/20/2010 10:43:17 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\f4533c5.msp]
7/20/2010 10:39:19 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Windows\Installer\12a1d85.msi]
7/20/2010 10:29:37 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Google\Update\1.2.183.13\GoogleUpdateHelper.msi]
7/20/2010 10:28:23 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/20/2010 10:28:23 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/20/2010 10:27:44 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Installers\SearchEnhancementPack2.0.264\SearchEnhancementPack.msi]
7/20/2010 10:26:31 PM: ApplicationMinimized - EXIT
7/20/2010 10:26:31 PM: ApplicationMinimized - ENTER
7/20/2010 10:10:03 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:09:29 PM: ApplicationMinimized - EXIT
7/20/2010 10:09:29 PM: ApplicationMinimized - ENTER
7/20/2010 10:07:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:07:17 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/20/2010 10:07:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:07:10 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:05:42 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\Users\Tim\AppData\Local\Temp\Temp4_New WinRAR ZIP archive.zip\ComboFix.exe]
7/20/2010 10:05:14 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/20/2010 10:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/20/2010 10:03:45 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:03:44 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/20/2010 10:00:07 PM: Starting File Sweep
7/20/2010 10:00:06 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/20/2010 10:00:06 PM: Starting Cookie Sweep
7/20/2010 10:00:04 PM: Registry Sweep Complete, Elapsed Time:00:00:39
7/20/2010 9:59:57 PM: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update || DownloadExpirationTime (ID = 0)
7/20/2010 9:59:55 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/20/2010 9:59:55 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/20/2010 9:59:55 PM: Found System Monitor: potentially rootkit-masked registry
7/20/2010 9:59:25 PM: Starting Registry Sweep
7/20/2010 9:59:24 PM: Memory Sweep Complete, Elapsed Time: 00:01:56
7/20/2010 9:57:30 PM: ApplicationMinimized - EXIT
7/20/2010 9:57:30 PM: ApplicationMinimized - ENTER
7/20/2010 9:57:28 PM: Starting Memory Sweep
7/20/2010 9:57:26 PM: Start Custom Sweep
7/20/2010 9:57:26 PM: Sweep initiated using definitions version 1745
7/20/2010 9:43:50 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:43:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:31:59 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/20/2010 9:31:58 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:31:40 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:22:16 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 9:21:59 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 9:21:59 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 9:21:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 9:21:51 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 9:21:50 PM: License Check Status (0): Success
7/20/2010 9:21:45 PM: Webroot Software 6.1.0.145 started
7/20/2010 9:21:45 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 9:15:25 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/20/2010 9:15:25 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/20/2010 9:15:15 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 9:15:06 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/21/2010 02:38:36 (GMT)
7/20/2010 9:14:32 PM: License Check Status (0): Success
7/20/2010 9:13:44 PM: Webroot Software 6.1.0.145 started
7/20/2010 9:13:44 PM: | Start of Session, Tuesday, July 20, 2010 |
***************
7/20/2010 6:01:57 PM: Your virus definitions have been updated.
7/20/2010 6:01:57 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/20/2010 6:01:57 PM: Your security definitions have been updated.
7/20/2010 6:01:27 PM: License Check Status (0): Success
7/20/2010 6:01:25 PM: Automated check for program update in progress.
7/20/2010 11:07:28 AM: ApplicationMinimized - EXIT
7/20/2010 11:07:28 AM: ApplicationMinimized - ENTER
7/20/2010 11:07:26 AM: Startup Shield: Entry Denied: LimeWire On Startup.lnk
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000006.xml
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000006.dmp
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000005.xml
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000005.dmp
7/20/2010 11:07:15 AM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000004.xml
7/20/2010 11:07:15 AM: Review and send the error report: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000004.dmp
7/20/2010 10:46:42 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:46:40 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/20/2010 10:45:17 AM: Tracking Cookies Shield: Removed serving-sys cookie
7/20/2010 10:45:17 AM: Tracking Cookies Shield: Removed bs.serving-sys cookie
7/20/2010 10:44:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 10:44:30 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 10:44:16 AM: Tracking Cookies Shield: Removed ic-live cookie
7/20/2010 10:44:11 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/20/2010 12:53:49 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/20/2010 12:12:11 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 11:00:40 PM: Tracking Cookies Shield: Removed ru4 cookie
7/19/2010 10:56:45 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 10:56:45 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:56:41 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:32:57 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 10:32:54 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 10:32:36 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 6:00:32 PM: Your virus definitions have been updated.
7/19/2010 6:00:32 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 6:00:32 PM: Your security definitions have been updated.
7/19/2010 6:00:12 PM: License Check Status (0): Success
7/19/2010 6:00:11 PM: Automated check for program update in progress.
7/19/2010 5:01:00 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 4:59:34 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 4:59:34 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 4:59:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 4:59:21 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 4:59:00 PM: License Check Status (0): Success
7/19/2010 4:58:20 PM: Webroot Software 6.1.0.145 started
7/19/2010 4:58:20 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:32:19 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 1:32:19 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 1:32:10 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:32:07 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/19/2010 22:12:58 (GMT)
7/19/2010 1:31:22 PM: License Check Status (0): Success
7/19/2010 1:30:42 PM: Webroot Software 6.1.0.145 started
7/19/2010 1:30:42 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:27:38 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:27:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:27:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:27:32 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:19:16 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:19:13 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:19:13 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:19:12 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:19:07 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:19:01 PM: Your virus definitions have been updated.
7/19/2010 1:19:01 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/19/2010 1:19:01 PM: Your security definitions have been updated.
7/19/2010 1:18:44 PM: License Check Status (0): Success
7/19/2010 1:18:44 PM: Automated check for program update in progress.
7/19/2010 1:18:17 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:18:14 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:18:14 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:18:10 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:18:09 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/19/2010 1:18:09 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/19/2010 1:18:04 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 1:18:00 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/19/2010 1:17:51 PM: License Check Status (0): Success
7/19/2010 1:17:38 PM: Webroot Software 6.1.0.145 started
7/19/2010 1:17:38 PM: | Start of Session, Monday, July 19, 2010 |
***************
7/19/2010 1:06:58 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:06:56 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:06:56 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:06:53 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:06:10 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:06:08 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:06:08 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:06:05 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:05:39 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:05:38 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:05:37 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:05:37 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:05:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:05:36 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:05:34 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:05:33 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 1:03:55 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\n.pif]
7/19/2010 1:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmdC.cfxxe]
7/19/2010 1:03:52 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\NirCmd.cfxxe]
7/19/2010 1:03:49 PM: Warning: AntiVirus engine for IFO returned [WL] on [C:\32788R22FWJFW\iexplore.exe]
7/19/2010 12:49:11 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 12:49:09 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 9:41:51 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/19/2010 9:41:50 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 9:40:23 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/19/2010 9:40:23 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/19/2010 9:40:08 AM: Tracking Cookies Shield: Removed ic-live cookie
7/18/2010 11:41:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 9:40:29 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:40:14 PM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 9:40:10 PM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 9:40:10 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:40:09 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 9:37:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 9:35:47 PM: ApplicationMinimized - EXIT
7/18/2010 9:35:47 PM: ApplicationMinimized - ENTER
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000006.xml
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000006.dmp
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000005.xml
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000005.dmp
7/18/2010 9:35:39 PM: C:\PROGRA~3\Webroot\BugReports\spysweeper.exe.000004.xml
7/18/2010 9:35:39 PM: Review and send the error report: C:\PROGRA~3\Webroot\BugReports\SpySweeper.exe.000004.dmp
7/18/2010 6:54:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 6:11:48 PM: ApplicationMinimized - EXIT
7/18/2010 6:11:48 PM: ApplicationMinimized - ENTER
7/18/2010 6:11:45 PM: BHO Shield: found: – BHO installation denied at user request
7/18/2010 5:35:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:32:41 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:32:19 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:26:07 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:25:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:25:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:16:14 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 5:16:14 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:16:05 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 5:15:59 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 5:15:53 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 5:15:08 PM: License Check Status (0): Success
7/18/2010 5:14:17 PM: Webroot Software 6.1.0.145 started
7/18/2010 5:14:17 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 5:10:52 PM: ApplicationMinimized - EXIT
7/18/2010 5:10:52 PM: ApplicationMinimized - ENTER
7/18/2010 5:00:37 PM: ApplicationMinimized - EXIT
7/18/2010 5:00:37 PM: ApplicationMinimized - ENTER
7/18/2010 4:58:22 PM: ApplicationMinimized - EXIT
7/18/2010 4:58:22 PM: ApplicationMinimized - ENTER
7/18/2010 4:57:30 PM: ApplicationMinimized - EXIT
7/18/2010 4:57:30 PM: ApplicationMinimized - ENTER
7/18/2010 4:55:17 PM: ApplicationMinimized - EXIT
7/18/2010 4:55:17 PM: ApplicationMinimized - ENTER
7/18/2010 4:54:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 4:53:49 PM: ApplicationMinimized - EXIT
7/18/2010 4:53:49 PM: ApplicationMinimized - ENTER
7/18/2010 4:53:13 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/18/2010 4:53:13 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/18/2010 4:53:00 PM: ApplicationMinimized - EXIT
7/18/2010 4:53:00 PM: ApplicationMinimized - ENTER
7/18/2010 4:36:27 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/18/2010 4:35:45 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/18/2010 4:33:05 PM: Starting File Sweep
7/18/2010 4:33:05 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/18/2010 4:33:05 PM: Starting Cookie Sweep
7/18/2010 4:33:05 PM: Registry Sweep Complete, Elapsed Time:00:00:17
7/18/2010 4:33:05 PM: Warning: ***CRegistryAccess::Enumerate: failed – UNKNOWN
7/18/2010 4:32:47 PM: Starting Registry Sweep
7/18/2010 4:32:47 PM: Memory Sweep Complete, Elapsed Time: 00:01:11
7/18/2010 4:31:36 PM: Starting Memory Sweep
7/18/2010 4:31:34 PM: Start Custom Sweep
7/18/2010 4:31:34 PM: Sweep initiated using definitions version 1743
7/18/2010 4:31:28 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 4:31:28 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed zedo cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed tribalfusion cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 4:31:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 4:31:15 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 4:30:59 PM: License Check Status (0): Success
7/18/2010 4:30:21 PM: Webroot Software 6.1.0.145 started
7/18/2010 4:30:21 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 1:55:04 PM: License Check Status (0): Success
7/18/2010 1:50:38 PM: ApplicationMinimized - EXIT
7/18/2010 1:50:38 PM: ApplicationMinimized - ENTER
7/18/2010 1:50:12 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 1:50:07 PM: Error: [MiniDump File: C:\ProgramData\Webroot\BugReports\SpySweeper.exe.000006.dmp]
7/18/2010 1:50:07 PM: Error: [MiniDump File: C:\ProgramData\Webroot\BugReports\SpySweeper.exe.000005.dmp]
7/18/2010 1:50:01 PM: Webroot Software 6.1.0.145 started
7/18/2010 1:50:01 PM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 12:28:17 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 12:10:54 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 12:10:29 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 12:10:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 12:10:27 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:54:45 AM: ApplicationMinimized - EXIT
7/18/2010 11:54:45 AM: ApplicationMinimized - ENTER
7/18/2010 11:54:40 AM: Removal process completed. Elapsed time 00:00:02
7/18/2010 11:54:39 AM: Quarantining All Traces: potentially rootkit-masked registry
7/18/2010 11:54:38 AM: Removal process initiated
7/18/2010 11:54:35 AM: Traces Found: 2
7/18/2010 11:54:35 AM: Custom Sweep has completed. Elapsed time 00:28:24
7/18/2010 11:54:35 AM: File Sweep Complete, Elapsed Time: 00:26:49
7/18/2010 11:54:14 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@collective-media[1].txt". The system cannot find the file specified
7/18/2010 11:54:08 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The system cannot find the file specified
7/18/2010 11:53:55 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VBBB7R02\b[2].gif". The system cannot find the file specified
7/18/2010 11:53:55 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\tim@collective-media[1].txt". The operation completed successfully
7/18/2010 11:53:55 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/18/2010 11:53:54 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/18/2010 11:53:51 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VBBB7R02\b[2].gif". The operation completed successfully
7/18/2010 11:52:23 AM: ApplicationMinimized - EXIT
7/18/2010 11:52:22 AM: ApplicationMinimized - ENTER
7/18/2010 11:49:09 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMSUQLC2\zyngaIE_toolbar_5.7.2.2[1].exe]
7/18/2010 11:44:01 AM: ApplicationMinimized - EXIT
7/18/2010 11:44:01 AM: ApplicationMinimized - ENTER
7/18/2010 11:43:19 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QQARJ8AK\zyngaIE_toolbar_5.7.2.2[1].exe]
7/18/2010 11:42:20 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/18/2010 11:42:20 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/18/2010 11:41:01 AM: ApplicationMinimized - EXIT
7/18/2010 11:41:01 AM: ApplicationMinimized - ENTER
7/18/2010 11:40:13 AM: ApplicationMinimized - EXIT
7/18/2010 11:40:13 AM: ApplicationMinimized - ENTER
7/18/2010 11:36:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:36:56 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:36:38 AM: ApplicationMinimized - EXIT
7/18/2010 11:36:38 AM: ApplicationMinimized - ENTER
7/18/2010 11:35:25 AM: ApplicationMinimized - EXIT
7/18/2010 11:35:25 AM: ApplicationMinimized - ENTER
7/18/2010 11:35:04 AM: ApplicationMinimized - EXIT
7/18/2010 11:35:04 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:51 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:51 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:39 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:39 AM: ApplicationMinimized - ENTER
7/18/2010 11:34:00 AM: ApplicationMinimized - EXIT
7/18/2010 11:34:00 AM: ApplicationMinimized - ENTER
7/18/2010 11:33:25 AM: Tracking Cookies Shield: Removed ic-live cookie
7/18/2010 11:33:25 AM: ApplicationMinimized - EXIT
7/18/2010 11:33:25 AM: ApplicationMinimized - ENTER
7/18/2010 11:32:11 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:30:19 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/18/2010 11:29:52 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/18/2010 11:27:45 AM: Starting File Sweep
7/18/2010 11:27:45 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/18/2010 11:27:45 AM: Starting Cookie Sweep
7/18/2010 11:27:44 AM: Registry Sweep Complete, Elapsed Time:00:00:25
7/18/2010 11:27:42 AM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/18/2010 11:27:42 AM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/18/2010 11:27:42 AM: Found System Monitor: potentially rootkit-masked registry
7/18/2010 11:27:19 AM: Starting Registry Sweep
7/18/2010 11:27:19 AM: Memory Sweep Complete, Elapsed Time: 00:01:06
7/18/2010 11:26:12 AM: Starting Memory Sweep
7/18/2010 11:26:11 AM: Start Custom Sweep
7/18/2010 11:26:11 AM: Sweep initiated using definitions version 1743
7/18/2010 11:26:05 AM: IE Favorites Shield: Entry Allowed: http://go.microsoft.com/fwlink/?LinkId=55143
7/18/2010 11:25:59 AM: IE Favorites Shield: Entry Denied: http://redirect.hp.com/svs/rdr?TYPE=4&…d=pavilionc=101
7/18/2010 11:25:22 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:25:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:25:14 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:25:13 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:24:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:24:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:20:59 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:20:57 AM: Tracking Cookies Shield: Removed advertising cookie
7/18/2010 11:20:56 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:20:56 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:19:27 AM: IE Favorites Shield: Entry Denied: https://ieonline.microsoft.com/#ieslice
7/18/2010 11:19:27 AM: IE Favorites Shield: Entry Denied: http://go.microsoft.com/fwlink/?LinkId=121315
7/18/2010 11:16:41 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:16:40 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:16:38 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:16:38 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:13:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:11:28 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/18/2010 11:11:27 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:11:27 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/18/2010 11:09:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:09:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 11:08:15 AM: ApplicationMinimized - EXIT
7/18/2010 11:08:15 AM: ApplicationMinimized - ENTER
7/18/2010 11:08:12 AM: IE Security Shield: found: C:\Program Files (x86)\Internet Explorer\iexplore.exe – IE Security modification allowed at user request
7/18/2010 11:06:31 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:58:48 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:53:12 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:49:55 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:48:59 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:33:19 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:32:21 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:40 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:09 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:26:03 AM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/18/2010 10:26:03 AM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/18/2010 10:25:59 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:25:55 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 10:25:51 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 14:37:04 (GMT)
7/18/2010 10:25:44 AM: License Check Status (0): Success
7/18/2010 10:25:39 AM: Webroot Software 6.1.0.145 started
7/18/2010 10:25:39 AM: | Start of Session, Sunday, July 18, 2010 |
***************
7/18/2010 2:07:30 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 2:07:13 AM: Your virus definitions have been updated.
7/18/2010 2:07:12 AM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 04:33:52 (GMT)
7/18/2010 2:07:09 AM: Your definitions are up to date.
7/18/2010 2:06:50 AM: License Check Status (0): Success
7/18/2010 2:06:06 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/18/2010 12:31:39 AM: ApplicationMinimized - EXIT
7/18/2010 12:31:39 AM: ApplicationMinimized - ENTER
7/18/2010 12:30:58 AM: ApplicationMinimized - EXIT
7/18/2010 12:30:58 AM: ApplicationMinimized - ENTER
7/18/2010 12:30:55 AM: Removal process completed. Elapsed time 00:00:04
7/18/2010 12:30:54 AM: Quarantining All Traces: potentially rootkit-masked registry
7/18/2010 12:30:51 AM: Removal process initiated
7/18/2010 12:25:42 AM: Traces Found: 2
7/18/2010 12:25:42 AM: Custom Sweep has completed. Elapsed time 00:58:48
7/18/2010 12:25:40 AM: File Sweep Complete, Elapsed Time: 00:57:13
7/17/2010 11:41:25 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:41:25 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:30:50 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 11:30:22 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 11:29:59 PM: ApplicationMinimized - EXIT
7/17/2010 11:29:59 PM: ApplicationMinimized - ENTER
7/17/2010 11:28:26 PM: Starting File Sweep
7/17/2010 11:28:26 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 11:28:26 PM: Starting Cookie Sweep
7/17/2010 11:28:25 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 11:28:23 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 11:28:23 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 11:28:23 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 11:28:00 PM: Starting Registry Sweep
7/17/2010 11:28:00 PM: Memory Sweep Complete, Elapsed Time: 00:01:04
7/17/2010 11:27:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:27:07 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:27:02 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:26:55 PM: Starting Memory Sweep
7/17/2010 11:26:53 PM: Start Custom Sweep
7/17/2010 11:26:53 PM: Sweep initiated using definitions version 1743
7/17/2010 11:25:41 PM: ApplicationMinimized - EXIT
7/17/2010 11:25:41 PM: ApplicationMinimized - ENTER
7/17/2010 11:25:29 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 11:25:27 PM: Removal process initiated
7/17/2010 11:18:55 PM: Traces Found: 2
7/17/2010 11:18:55 PM: Custom Sweep has completed. Elapsed time 00:24:42
7/17/2010 11:18:55 PM: File Sweep Complete, Elapsed Time: 00:23:02
7/17/2010 11:18:32 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\HP Support Framework\Resources\HPSetSystemRestore.xml". The system cannot find the file specified
7/17/2010 11:18:19 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\HP Support Framework\Resources\HPSetSystemRestore.xml". The operation completed successfully
7/17/2010 11:12:12 PM: ApplicationMinimized - EXIT
7/17/2010 11:12:12 PM: ApplicationMinimized - ENTER
7/17/2010 11:08:14 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:08:14 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 11:05:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:04:44 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 11:01:04 PM: ApplicationMinimized - EXIT
7/17/2010 11:01:04 PM: ApplicationMinimized - ENTER
7/17/2010 11:01:02 PM: ApplicationMinimized - EXIT
7/17/2010 11:01:02 PM: ApplicationMinimized - ENTER
7/17/2010 10:58:35 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 10:58:13 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 10:56:58 PM: ApplicationMinimized - EXIT
7/17/2010 10:56:58 PM: ApplicationMinimized - ENTER
7/17/2010 10:56:07 PM: ApplicationMinimized - EXIT
7/17/2010 10:56:07 PM: ApplicationMinimized - ENTER
7/17/2010 10:55:52 PM: Starting File Sweep
7/17/2010 10:55:52 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 10:55:52 PM: Starting Cookie Sweep
7/17/2010 10:55:51 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 10:55:49 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 10:55:49 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 10:55:49 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 10:55:26 PM: Starting Registry Sweep
7/17/2010 10:55:26 PM: Memory Sweep Complete, Elapsed Time: 00:01:11
7/17/2010 10:54:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 10:54:17 PM: ApplicationMinimized - EXIT
7/17/2010 10:54:17 PM: ApplicationMinimized - ENTER
7/17/2010 10:54:14 PM: Starting Memory Sweep
7/17/2010 10:54:12 PM: Start Custom Sweep
7/17/2010 10:54:12 PM: Sweep initiated using definitions version 1743
7/17/2010 10:47:47 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 10:47:46 PM: Quarantining All Traces: potentially rootkit-masked registry
7/17/2010 10:47:46 PM: Removal process initiated
7/17/2010 10:47:41 PM: Traces Found: 2
7/17/2010 10:47:41 PM: Custom Sweep has completed. Elapsed time 00:25:37
7/17/2010 10:47:40 PM: File Sweep Complete, Elapsed Time: 00:24:10
7/17/2010 10:35:59 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:35:59 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:34:00 PM: ApplicationMinimized - EXIT
7/17/2010 10:34:00 PM: ApplicationMinimized - ENTER
7/17/2010 10:26:35 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{A12A3222-9227-11DF-9AAC-18A905C0D717}.dat]
7/17/2010 10:26:03 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 10:25:37 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 10:25:33 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 10:23:29 PM: Starting File Sweep
7/17/2010 10:23:29 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 10:23:29 PM: Starting Cookie Sweep
7/17/2010 10:23:28 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7/17/2010 10:23:26 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 10:23:26 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 10:23:26 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 10:23:03 PM: Starting Registry Sweep
7/17/2010 10:23:03 PM: Memory Sweep Complete, Elapsed Time: 00:00:58
7/17/2010 10:22:04 PM: Starting Memory Sweep
7/17/2010 10:22:03 PM: Start Custom Sweep
7/17/2010 10:22:03 PM: Sweep initiated using definitions version 1743
7/17/2010 10:21:57 PM: Deletion from quarantine completed. Elapsed time 00:00:00
7/17/2010 10:21:57 PM: Processing: rogue security products
7/17/2010 10:21:57 PM: Deletion from quarantine initiated
7/17/2010 10:21:31 PM: Removal process completed. Elapsed time 00:00:01
7/17/2010 10:21:29 PM: Quarantining All Traces: potentially rootkit-masked registry
7/17/2010 10:21:29 PM: Quarantining All Traces: rogue security products
7/17/2010 10:21:29 PM: Removal process initiated
7/17/2010 10:15:12 PM: Traces Found: 3
7/17/2010 10:15:12 PM: Custom Sweep has completed. Elapsed time 00:26:59
7/17/2010 10:15:11 PM: File Sweep Complete, Elapsed Time: 00:25:32
7/17/2010 10:04:24 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 10:04:24 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 9:52:12 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 9:51:42 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 9:49:38 PM: Starting File Sweep
7/17/2010 9:49:38 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 9:49:38 PM: Starting Cookie Sweep
7/17/2010 9:49:38 PM: Registry Sweep Complete, Elapsed Time:00:00:24
7/17/2010 9:49:35 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.SONY\CurVer (ID = 0)
7/17/2010 9:49:35 PM: HKLM\SOFTWARE\Classes\Wow6432Node\RTCOMDLL.RTLCSSAPI\CurVer (ID = 0)
7/17/2010 9:49:35 PM: Found System Monitor: potentially rootkit-masked registry
7/17/2010 9:49:21 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\avsolution\ (ID = 7685460)
7/17/2010 9:49:21 PM: Found Adware: rogue security products
7/17/2010 9:49:13 PM: Starting Registry Sweep
7/17/2010 9:49:13 PM: Memory Sweep Complete, Elapsed Time: 00:00:58
7/17/2010 9:48:14 PM: Starting Memory Sweep
7/17/2010 9:48:12 PM: Start Custom Sweep
7/17/2010 9:48:12 PM: Sweep initiated using definitions version 1743
7/17/2010 9:48:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:47:58 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:47:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:37:42 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:35 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/17/2010 9:36:35 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/17/2010 9:36:28 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:22 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:36:17 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/18/2010 04:33:52 (GMT)
7/17/2010 9:35:52 PM: License Check Status (0): Success
7/17/2010 9:35:38 PM: Webroot Software 6.1.0.145 started
7/17/2010 9:35:38 PM: | Start of Session, Saturday, July 17, 2010 |
***************
7/17/2010 9:31:26 PM: ApplicationMinimized - EXIT
7/17/2010 9:31:26 PM: ApplicationMinimized - ENTER
7/17/2010 9:29:54 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:29:54 PM: Your definitions are up to date.
7/17/2010 9:29:53 PM: License Check Status (0): Success
7/17/2010 9:28:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:27:51 PM: Your virus definitions have been updated.
7/17/2010 9:27:51 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/14/2010 14:17:56 (GMT)
7/17/2010 9:27:51 PM: Your security definitions have been updated.
7/17/2010 9:27:32 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:27:26 PM: License Check Status (0): Success
7/17/2010 9:26:43 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:26:24 PM: Deletion from quarantine completed. Elapsed time 00:00:00
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: rogue security products
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Processing: Mal/FakeAvHm-A
7/17/2010 9:26:23 PM: Deletion from quarantine initiated
7/17/2010 9:26:10 PM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
7/17/2010 9:26:10 PM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
7/17/2010 9:26:08 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:58 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:48 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:25:43 PM: Informational: Loaded AntiVirus Engine: 3.9.0; SDK Version: 4.55E; Virus Definitions: 07/14/2010 14:17:56 (GMT)
7/17/2010 9:25:25 PM: License Check Status (0): Success
7/17/2010 9:24:59 PM: Webroot Software 6.1.0.145 started
7/17/2010 9:24:59 PM: | Start of Session, Saturday, July 17, 2010 |
***************
7/17/2010 9:22:02 PM: Removal process completed. Elapsed time 00:00:11
7/17/2010 9:22:02 PM: Preparing to restart your computer. Please wait…
7/17/2010 9:21:53 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 9:21:52 PM: Quarantining All Traces: rogue security products
7/17/2010 9:21:52 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 9:21:52 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 9:21:50 PM: Removal process initiated
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:39 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:38 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 3:13:37 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 1:09:49 PM: Traces Found: 7
7/17/2010 1:09:49 PM: Full Sweep has completed. Elapsed time 00:25:17
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\ikchvaanr\mytnlyttssd.exe (ID = 5615592)
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMSUQLC2\movie[1].exe (ID = 5615592)
7/17/2010 1:09:49 PM: C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XG7R2TSW\movie97670[1].exe (ID = 5615592)
7/17/2010 1:09:48 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\microsoft\windows\currentversion\internet settings\ || proxyoverride (ID = 6739704)
7/17/2010 1:09:48 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\Software\Microsoft\Windows\CurrentVersion\Run || rgkhmerp (ID = 0)
7/17/2010 1:09:48 PM: Detected running threat: C:\Users\Tim\AppData\Local\ikchvaanr\mytnlyttssd.exe (ID = 5615592)
7/17/2010 1:09:48 PM: File Sweep Complete, Elapsed Time: 00:22:04
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_LARGE.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MEDIUM.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_SMALL.db-journal". The system cannot find the file specified
7/17/2010 1:09:30 PM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MINI.db-journal". The system cannot find the file specified
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_LARGE.db-journal". The operation completed successfully
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MEDIUM.db-journal". The operation completed successfully
7/17/2010 1:09:20 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_SMALL.db-journal". The operation completed successfully
7/17/2010 1:09:18 PM: Warning: Failed to open file "C:\Users\Tim\AppData\Local\Hewlett-Packard\TouchSmart\Media\CLML\CLDB_SUB_MINI.db-journal". The operation completed successfully
7/17/2010 1:00:25 PM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 1:00:25 PM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:50:26 PM: ApplicationMinimized - EXIT
7/17/2010 12:50:26 PM: ApplicationMinimized - ENTER
7/17/2010 12:50:11 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 12:49:47 PM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 12:49:09 PM: ApplicationMinimized - EXIT
7/17/2010 12:49:09 PM: ApplicationMinimized - ENTER
7/17/2010 12:48:49 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:49 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:46 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:48:43 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:47:43 PM: Starting File Sweep
7/17/2010 12:47:43 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 12:47:43 PM: Starting Cookie Sweep
7/17/2010 12:47:42 PM: Registry Sweep Complete, Elapsed Time:00:00:17
7/17/2010 12:47:33 PM: HKU\S-1-5-21-2012041797-626570749-3346547719-1000\software\avsuite\ (ID = 7339865)
7/17/2010 12:47:33 PM: Found Adware: rogue security products
7/17/2010 12:47:25 PM: Starting Registry Sweep
7/17/2010 12:47:25 PM: Memory Sweep Complete, Elapsed Time: 00:02:51
7/17/2010 12:46:37 PM: ApplicationMinimized - EXIT
7/17/2010 12:46:36 PM: ApplicationMinimized - ENTER
7/17/2010 12:46:27 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:46:15 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:46:13 PM: File System Shield: found: Virus: Mal/FakeAvHm-A, version
7/17/2010 12:44:33 PM: ApplicationMinimized - EXIT
7/17/2010 12:44:33 PM: ApplicationMinimized - ENTER
7/17/2010 12:44:33 PM: Starting Memory Sweep
7/17/2010 12:44:32 PM: Start Full Sweep
7/17/2010 12:44:32 PM: Sweep initiated using definitions version 1740
7/17/2010 12:44:26 PM: None
7/17/2010 12:44:26 PM: Traces Found: 0
7/17/2010 12:44:26 PM: Memory Sweep Complete, Elapsed Time: 00:00:04
7/17/2010 12:44:26 PM: Sweep Cancelled
7/17/2010 12:44:22 PM: Starting Memory Sweep
7/17/2010 12:44:21 PM: Start Custom Sweep
7/17/2010 12:44:21 PM: Sweep initiated using definitions version 1740
7/17/2010 12:43:39 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:40:37 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:40:35 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:40:27 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:40:25 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:39:34 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:39:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:26 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 12:29:22 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:11 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:29:07 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:29:06 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:26:04 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:26:04 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:26:03 PM: Tracking Cookies Shield: Removed pointroll cookie
7/17/2010 12:25:55 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 12:25:52 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 12:07:26 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 8:19:24 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:40:12 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:40:12 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:40:10 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:39:04 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:38:41 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:38:31 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:38:31 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:38:07 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:37:51 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:32:17 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:53 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:49 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:36 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:32 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:12 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:31:01 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:25:30 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:25:29 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:25:28 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:21:18 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:21:15 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:21:01 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:44 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/17/2010 6:20:44 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:36 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:34 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:33 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:20 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/17/2010 6:20:16 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/17/2010 6:20:14 AM: ApplicationMinimized - EXIT
7/17/2010 6:20:14 AM: ApplicationMinimized - ENTER
7/17/2010 3:38:02 AM: None
7/17/2010 3:38:02 AM: Traces Found: 0
7/17/2010 3:38:02 AM: Scheduled Sweep has completed. Elapsed time 03:37:58
7/17/2010 3:38:01 AM: File Sweep Complete, Elapsed Time: 03:36:16
7/17/2010 3:37:41 AM: Warning: Failed to process link. Cannot open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The system cannot find the file specified
7/17/2010 3:37:29 AM: Warning: Failed to open file "C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt". The operation completed successfully
7/17/2010 3:37:27 AM: Warning: Failed to process link. Cannot open file "C:\ProgramData\Microsoft\eHome\mcepg2-0\backup\recordings\20100715_155159". The system cannot find the file specified
7/17/2010 3:37:26 AM: Warning: Failed to open file "C:\ProgramData\Microsoft\eHome\mcepg2-0\backup\recordings\20100715_155159". The operation completed successfully
7/17/2010 12:14:39 AM: Warning: Failed to process link. Cannot open file "C:\pagefile.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:14:39 AM: Warning: Failed to process link. Cannot open file "C:\hiberfil.sys". The process cannot access the file because it is being used by another process
7/17/2010 12:04:08 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DF089619B19F8A54D5.TMP]
7/17/2010 12:03:45 AM: Warning: AntiVirus engine for IFO returned [File Corrupted] on [C:\Users\Tim\AppData\Local\Temp\~DFA19760B067DDEF9E.TMP]
7/17/2010 12:01:45 AM: Starting File Sweep
7/17/2010 12:01:44 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
7/17/2010 12:01:44 AM: Starting Cookie Sweep
7/17/2010 12:01:44 AM: Registry Sweep Complete, Elapsed Time:00:00:17
7/17/2010 12:01:27 AM: Starting Registry Sweep
7/17/2010 12:01:27 AM: Memory Sweep Complete, Elapsed Time: 00:01:20
7/17/2010 12:00:06 AM: Starting Memory Sweep
7/17/2010 12:00:03 AM: Start Scheduled Sweep
7/17/2010 12:00:03 AM: Sweep initiated using definitions version 1740
7/16/2010 11:41:31 PM: IE Favorites Shield: Entry Allowed: http://join.pantherexpedite.com/contact.aspx
7/16/2010 11:41:31 PM: IE Favorites Shield: Entry Allowed: http://join.pantherexpedite.com/contact.aspx
7/16/2010 11:41:25 PM: IE Favorites Shield: Entry Allowed: http://www.driveforknighttrans.com/
7/16/2010 11:41:25 PM: IE Favorites Shield: Entry Allowed: http://www.driveforknighttrans.com/
7/16/2010 11:34:27 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 11:34:26 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 11:34:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 11:34:03 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 7:54:54 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 7:54:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 7:54:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 7:54:51 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 6:53:40 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:49:50 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:49:17 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:37:13 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:37:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:32:58 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:32:58 PM: Tracking Cookies Shield: Removed advertising cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:14:13 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:31 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 6:11:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 6:11:28 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:54:52 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:52:13 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:43:39 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:43:36 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:37:35 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:35:19 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 2:30:12 PM: ApplicationMinimized - EXIT
7/16/2010 2:30:12 PM: ApplicationMinimized - ENTER
7/16/2010 11:06:22 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 11:06:20 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 11:06:18 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 10:15:54 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 10:15:54 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 9:45:08 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:56 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:54 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 9:44:54 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:53 AM: Tracking Cookies Shield: Removed webtrendslive cookie
7/16/2010 9:44:43 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:54:22 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:45:35 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 8:45:35 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:45:34 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:44:57 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:42:15 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/16/2010 8:42:06 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/16/2010 8:41:57 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/16/2010 8:41:21 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:56:08 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:55:41 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:55:12 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:53:47 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:41:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:52 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 11:38:49 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:38:48 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:37:17 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:37:15 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:37:05 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:49 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:33 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 11:36:30 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:36:29 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 11:07:25 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:07:21 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:06:53 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 11:02:15 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 10:50:32 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:50:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:50:28 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:50:26 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 5:13:12 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 5:13:09 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 5:13:08 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 4:09:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 4:08:59 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 4:08:59 PM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 1:00:03 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 1:00:03 PM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed advertising cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed realmedia cookie
7/15/2010 10:56:53 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 10:35:08 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:35:05 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:35:04 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 10:14:46 AM: ApplicationMinimized - EXIT
7/15/2010 10:14:46 AM: ApplicationMinimized - ENTER
7/15/2010 10:14:31 AM: Startup Shield: Entry Denied: LimeWire On Startup.lnk
7/15/2010 10:08:49 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 10:08:46 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/15/2010 10:08:40 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 1:42:43 AM: Tracking Cookies Shield: Removed atlas dmt cookie
7/15/2010 12:38:32 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:51 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:51 AM: Tracking Cookies Shield: Removed doubleclick cookie
7/15/2010 12:09:50 AM: Tracking Cookies Shield: Removed specificclick.com cookie
7/15/2010 12:09:50 AM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:52:32 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:45:03 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/14/2010 11:45:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:45:00 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:31:20 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:31:19 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:31:19 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed realmedia cookie
7/14/2010 11:30:39 PM: Tracking Cookies Shield: Removed doubleclick cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed advertising cookie
7/14/2010 11:30:38 PM: Tracking Cookies Shield: Removed yieldmanager cookie
7/14/2010 11:30:24 PM: Tracking Cookies Shield: Removed atlas dmt cookie
7/14/2010 11:26:32 PM: Tracking Cookies Shield: Removed specificclick.com cookie
7/14/2010 11:15:29 PM: Tracking Cookies Shield: Removed advertising cookie
*** Session Log display limited to the first 1000 lines ***
It's strange how everything else is coming up with no infected files and webroot comes up with a bunch.
CatByte
Webroot is only reporting tracking cookies. Every time you connect to the internet, you get them, if you delete your browsing history and cookies often, it wont be reporting them.
Use this program:
Download TFC to your desktop
NEXT
Download and run Auslogics Disc Defragmenter
Make sure when installing that you say NO to the Ask toolbar.
I would also uninstall any toolbars that you are not using or don't find useful, the less you have the better.
How is the computer running? Are there any outstanding issues?
Use this program:
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
NEXT
Download and run Auslogics Disc Defragmenter
Make sure when installing that you say NO to the Ask toolbar.
I would also uninstall any toolbars that you are not using or don't find useful, the less you have the better.
How is the computer running? Are there any outstanding issues?
jeff matthews
Ill check it out, what is TFC, another maleware scan software? Oh btw the link doesn't work so can you post a correct link so i can dl it. thanks!
Is this the same software? http://filegets.com/get/tfc-mfc-library—…-compliant.html
I tried googling it and it says one of the sites that has it is offline.
The link i clicked on, that you sent me, it said "error 403 forbidden"
Oh also, after im done using these programs, is there anything else you can suggest i do so im better protected in the future, like create a restore point, or make sure i have no compatibility issues with software installed and also make sure im well protected using a good firewall for this computer, Thanks
Is this the same software? http://filegets.com/get/tfc-mfc-library—…-compliant.html
I tried googling it and it says one of the sites that has it is offline.
The link i clicked on, that you sent me, it said "error 403 forbidden"
Oh also, after im done using these programs, is there anything else you can suggest i do so im better protected in the future, like create a restore point, or make sure i have no compatibility issues with software installed and also make sure im well protected using a good firewall for this computer, Thanks
CatByte
Hi
No It's not the same program at all, TFC is a temporary File Cleaner, Geeks to Go where the program is hosted is experiencing some technical difficulties:
It can be found here:
http://www.itxassociates.com/OT-Tools/TFC.exe
Yes I do have recommendations:
Clean up with OTL:
If there are any remaining tools/logs that I had you download, on the desktop > right click and delete them
NEXT
Now we need to create a new clean SYSTEM RESTORE point.
Then remove all previous Restore Points
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
As a general rule, One antivirus, one firewall and 1 realtime protection scanner is all you need, plus a stand alone scanner such as MalwareBytes for occasional scans.
No It's not the same program at all, TFC is a temporary File Cleaner, Geeks to Go where the program is hosted is experiencing some technical difficulties:
It can be found here:
http://www.itxassociates.com/OT-Tools/TFC.exe
Yes I do have recommendations:
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If there are any remaining tools/logs that I had you download, on the desktop > right click and delete them
NEXT
Now we need to create a new clean SYSTEM RESTORE point.
- press the Win key on the keyboard, type Restore then press enter to get to the System Restore section.
- Click "Create a restore point" Click on the "Create" button to create a new restore point. You may be prompted for permission to continue - ALLOW it to continue. You'll be prompted for a name, and you might want to give it a useful name that you'll be able to easily identify later.
- Click the Create button, and then the system will create the restore point.
- When it's all finished, you'll get a message saying it's completed successfully.
- You will now have a new restore point
Then remove all previous Restore Points
- Click Win key on the keyboard, type cleanmgr to access the disk cleanup
- choose all files on the computer, then choose the C: drive, press OK Disk cleanup calculates the files, this takes a few minutes > another menu will pop up.
- At the top, click on the More Options tab, under System Restore and Shadow Copies group,
- Click the Clean up button,
- You will be asked if you’re sure, click on the Delete button, click OK > Delete Files
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
- It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.
- Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
- Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
- WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
- Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
- ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
- In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
As a general rule, One antivirus, one firewall and 1 realtime protection scanner is all you need, plus a stand alone scanner such as MalwareBytes for occasional scans.
jeff matthews
Ok well im doing all this, i would like to ask a quick question. I used the "backup" feature on another computer (not this one) to back up all the files on the C drive but i did it with windows xp. I placed it on my external drive, but now that i installed windows 7, i can't access the .BKF file type. Do you have any idea how to access these files, cause there really immportant and i have to some how restore them for my other computer.
CatByte
Hi
I'm afraid I don't have an answer for you on that.
I suggest posting a new topic in our tech forum and having our tech experts help you with that.
good luck
~CB
jeff matthews
Hey catebyte, im finishing up this machine real quick to. I just have one question, isn't there any program that you want me to use that will uninstall all the tools that we have used.
Also you said to delete all the toolbars right? i realize this is kind of difficult working on two separate machines, but this is kind of the closing message, i just want to hurry this one up so i can just focus on the other computer. So if you have anything else to add, do so. thanks!
CatByte
Hi
the OTL clean up button should clean up most of the tools, if there are any remaining tools/logs on the desktop > right click and delete them, and yes, uninstall the toolbars you are not using, they are just clutter.
CatByte
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI