Spyware / Malware / Virus Removal

IE, Dr Watson, and Bonjour

21 min read

Looking for the outcome? Ask AI

heehaw2 Topic Starter

Post #1May 11, 2011, 1:39 PM UTC

HiJack Log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:33:01 AM, on 5/11/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17096)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro SafeSync\hrfscore.exe
C:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Trend Micro SafeSync\HrfsClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Anne\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://verizon.my.msn.com/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LELA] "C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" /minimized
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [WebEx Document Loader] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P21 "WebEx Document Loader" /O26 "WebEx Document Loader Port" /M "Stylus C82"
O4 - HKLM\..\Run: [Trend Micro Titanium] "C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [OE] "C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_OE\TMAS_OEMon.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.explorelearning.com/index.cfm?method=cResource.dspView&ResourceID=427"
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Trend Micro SafeSync.lnk = C:\Program Files\Trend Micro SafeSync\HrfsClient.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.durhamcountync.gov
O15 - Trusted Zone: http://www.restaronline.com
O15 - Trusted Zone: *.taxsoftware.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} (JInitiator 1.3.1.28) - https://esis.ncwise.org/forms/jinitiator/jinit13128.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: humyo.com - Trend Micro Inc. - C:\Program Files\Trend Micro SafeSync\hrfscore.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11869 bytes

patndoris

Post #2May 14, 2011, 4:03 PM UTC last edited May 14, 2011, 4:06 PM UTC

Hello and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

I see that you have SmartDefrag by iObit installed. IOBit based in China has stolen and incorporated proprietary databases and intellectual property into their software in the past. This calls into question the reliability and safety of this program. I would suggest you use uninstall this program, but the decision is yours. You can read more about it here

HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.

Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt

Please attach the second file; Attach.txt.

Scan With RootKitUnHooker

Please choose one link and download Rootkit Unhooker and save it to your desktop.

Link 1
Link 2
Link 3
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:/ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

heehaw2

Post #3May 14, 2011, 8:02 PM UTC

. DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 15:49:11.01 on Sat 05/14/2011 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_24 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.474 [GMT -4:00] . AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE svchost.exe C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\LogMeIn\x86\LogMeIn.exe C:\WINDOWS\system32\java.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_OE\TMAS_OEMon.exe C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\Program Files\Epson Software\Event Manager\EEventManager.exe C:\Program Files\Trend Micro SafeSync\HrfsClient.exe C:\Program Files\Trend Micro SafeSync\hrfscore.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Anne\Desktop\dds.scr . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.explorelearning.com/index.cfm?method=cResource.dspView&ResourceID=427" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [Alcmtr] ALCMTR.EXE mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe" mRun: [WebEx Document Loader] c:\windows\system32\spool\drivers\w32x86\3\E_S0HIC1.EXE /P21 "WebEx Document Loader" /O26 "WebEx Document Loader Port" /M "Stylus C82" mRun: [Trend Micro Titanium] "c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe" -set Silent "1" SplashURL "" mRun: [OE] "c:\program files\trend micro\titanium\plugin\tmas\tmas_oe\TMAS_OEMon.exe" mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe" mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe" dRun: [OE] c:\program files\trend micro\internet security\tmas_oe\TMAS_OEMon.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dlbcserv.lnk - c:\program files\dell photo printer 720\dlbcserv.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\trendm~1.lnk - c:\program files\trend micro safesync\HrfsClient.exe mPolicies-system: HideShutdownScripts = 0 (0x0) IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL Trusted Zone: durhamcountync.gov\dcapps Trusted Zone: durhamcountync.gov\www Trusted Zone: restaronline.com\www Trusted Zone: taxsoftware.com DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} - hxxp://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} - hxxps://esis.ncwise.org/forms/jinitiator/jinit13128.exe DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100 Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll Notify: igfxcui - igfxdev.dll Notify: LMIinit - LMIinit.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\anne\applic~1\mozilla\firefox\profiles\0kdzjn2r.default\ FF - prefs.js: browser.search.selectedEngine - GoodSearch FF - prefs.js: browser.startup.homepage - hxxp://www.womenshealthmag.com/fitness/abs-diet-weekly-menu?page=2#2|http://verizon.my.msn.com/default.aspx FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll FF - component: c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\firefoxextension\components\TmFFExt.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: Trend Micro NSC Firefox Extension: {22C7F6C6-8D67-4534-92B5-529A0EC09405} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\firefoxextension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} . ============= SERVICES / DRIVERS =============== . R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2010-11-16 188272] R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800] R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-12-8 374152] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-9-17 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-12-14 47640] R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2010-11-16 64080] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-12-23 24652] R3 hrfsmrx;hrfsmrx;c:\windows\system32\drivers\hrfsmrx.sys [2010-10-17 143504] R3 humyo.com;humyo.com;c:\program files\trend micro safesync\hrfscore.exe [2010-10-17 3541776] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-20 136176] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-20 136176] S4 LMIRfsClientNP;LMIRfsClientNP; [x] . =============== Created Last 30 ================ . 2011-05-09 13:55:22 ——– d-sh–w- c:\documents and settings\anne\IECompatCache 2011-05-09 13:52:40 ——– d-sh–w- c:\documents and settings\anne\PrivacIE 2011-05-09 13:51:20 ——– d-sh–w- c:\documents and settings\anne\IETldCache 2011-05-09 13:47:57 ——– d—–w- c:\windows\ie8updates 2011-05-09 13:44:35 78336 —-a-w- c:\windows\system32\ieencode.dll 2011-05-09 13:44:35 78336 —-a-w- c:\windows\system32\dllcache\ieencode.dll 2011-05-09 13:39:23 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2011-05-09 13:39:17 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll 2011-05-09 13:39:17 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2011-05-09 13:39:16 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2011-05-06 23:33:46 ——– d—–w- c:\docume~1\anne\applic~1\IObit 2011-05-06 23:33:40 ——– d—–w- c:\program files\IObit 2011-04-27 19:08:22 77824 —-a-w- c:\windows\system32\EBAPI.dll 2011-04-27 19:08:22 65536 —-a-w- c:\windows\system32\EEBUtil.dll 2011-04-27 19:08:22 55808 —-a-w- c:\windows\system32\EEBSDKIF.dll 2011-04-27 19:08:22 135168 —-a-w- c:\windows\system32\EEBAPI.dll 2011-04-27 19:08:22 110592 —-a-w- c:\windows\system32\EEBDSCVR.dll 2011-04-27 19:06:02 475410 —-a-w- c:\windows\system32\ensppmon.dll 2011-04-27 19:06:02 458129 —-a-w- c:\windows\system32\ensppui.dll 2011-04-27 19:06:02 458129 —-a-w- c:\windows\system32\enppui.dll 2011-04-27 19:06:02 249344 —-a-w- c:\windows\system32\enspres.dll 2011-04-27 19:06:02 249344 —-a-w- c:\windows\system32\enpres.dll 2011-04-27 19:06:01 475410 —-a-w- c:\windows\system32\enppmon.dll 2011-04-27 19:06:00 ——– d—–w- c:\program files\EpsonNet 2011-04-27 19:04:49 ——– d—–w- c:\program files\common files\EPSON 2011-04-27 19:04:48 80024 —-a-w- c:\windows\system32\PICSDK.dll 2011-04-27 19:04:48 51360 —-a-w- c:\windows\system32\EpPicPrt.dll 2011-04-27 19:04:48 501912 —-a-w- c:\windows\system32\PICSDK2.dll 2011-04-27 19:04:48 108704 —-a-w- c:\windows\system32\PICEntry.dll 2011-04-27 19:04:47 51360 —-a-w- c:\windows\system32\EpPicMgr.dll 2011-04-27 19:04:21 93696 —-a-w- c:\windows\system32\E_FLBGCA.DLL 2011-04-27 19:04:21 63488 —-a-w- c:\windows\system32\E_FD4BGCA.DLL 2011-04-27 19:03:28 ——– d—–w- c:\docume~1\alluse~1\applic~1\EPSON 2011-04-27 19:02:34 ——– d—–w- c:\program files\Epson Software 2011-04-27 19:01:31 128392 —-a-w- c:\windows\system32\esdevapp.exe 2011-04-27 19:01:30 342016 —-a-w- c:\windows\system32\eswiaud.dll 2011-04-27 19:01:30 15872 —-a-w- c:\windows\system32\escdev.dll . ==================== Find3M ==================== . 2011-04-08 13:42:46 172032 —-a-w- c:\windows\system32\hrfsnp.dll 2011-03-11 14:10:38 471552 —-a-w- c:\windows\apppatch\aclayers.dll 2011-03-07 05:33:50 692736 —-a-w- c:\windows\system32\inetcomm.dll 2011-03-04 06:45:07 434176 —-a-w- c:\windows\system32\vbscript.dll 2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys 2011-03-03 01:47:15 398760 —-a-r- c:\windows\system32\cpnprt2.cid 2011-02-17 19:00:29 832512 —-a-w- c:\windows\system32\wininet.dll 2011-02-17 19:00:28 1830912 ——w- c:\windows\system32\inetcpl.cpl 2011-02-17 19:00:27 17408 —-a-w- c:\windows\system32\corpol.dll 2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2011-02-17 11:44:16 389120 —-a-w- c:\windows\system32\html.iec 2011-02-15 12:56:39 290432 —-a-w- c:\windows\system32\atmfd.dll . ============= FINISH: 15:49:50.37 ===============

Attachments:

[attachment removed: Attach.zip]

heehaw2

Post #4May 14, 2011, 8:11 PM UTC

RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >Drivers ============================================== 0xF65C3000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5857280 bytes (Intel Corporation, Intel Graphics Miniport Driver) 0xA95C4000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4820992 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver) 0xBF1E7000 C:\WINDOWS\System32\igxpdx32.DLL 2699264 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology) 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2154496 bytes 0x804D7000 RAW 2154496 bytes 0x804D7000 WMIxWDM 2154496 bytes 0xBF800000 Win32k 1859584 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xBF04F000 C:\WINDOWS\System32\igxpdv32.DLL 1671168 bytes (Intel Corporation, Component GHAL Driver) 0xF73A1000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xA937C000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xF6479000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xA94C4000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xA8A49000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBF47A000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xF656E000 C:\WINDOWS\system32\DRIVERS\e1e5132.sys 266240 bytes (Intel Corporation, Intel® PRO/1000 Adapter NDIS 5.2 deserialized driver) 0xA8198000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xA8D78000 C:\WINDOWS\system32\DRIVERS\tmcomm.sys 212992 bytes (Trend Micro Inc., TrendMicro Common Module) 0xF74BF000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xA8DD4000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF7374000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 176128 bytes (Intel Corporation, Intel Graphics 2D Driver) 0xA93EC000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF6522000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xA9476000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xA949E000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xA95A0000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF654A000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF64FF000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xA942C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0xA8036000 C:\WINDOWS\System32\Drivers\hrfsmrx.sys 139264 bytes (Trend Micro Inc., Hrfs Minirdr) 0x806E5000 ACPI_HAL 134400 bytes 0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF7457000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF748F000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xA8D21000 C:\WINDOWS\system32\DRIVERS\tmactmon.sys 118784 bytes (Trend Micro Inc., TrendMicro Activity Monitor Module) 0xF735A000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF7477000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xA92C4000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF742E000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF64E8000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xA9417000 C:\WINDOWS\system32\DRIVERS\tmtdi.sys 86016 bytes (Trend Micro Inc., Trend Micro TDI Driver (i386-fre)) 0xA8EEF000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF65AF000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xA951D000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver) 0xF7445000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xA8D3E000 C:\WINDOWS\system32\DRIVERS\tmevtmgr.sys 73728 bytes (Trend Micro Inc., TrendMicro Event Management Module) 0xF74AE000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF64D7000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF77FE000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF6BD9000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xF76FE000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xF75FE000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xF771E000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF775E000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xF773E000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF6BC9000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xA8FAC000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF772E000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF760E000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xF764E000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF770E000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF6BB9000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF762E000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF6B99000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF777E000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF6BE9000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF761E000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF6BA9000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF75EE000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xA8AD9000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver) 0xF6B69000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF6B79000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF763E000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF778E000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xF76DE000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF6B89000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF776E000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xA682A000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF765E000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF774E000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF78EE000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF79CE000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF78D6000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xF7986000 C:\DOCUME~1\Anne\LOCALS~1\Temp\mbr.sys 28672 bytes 0xF786E000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF78F6000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver) 0xF79E6000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0xF79DE000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF79D6000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF79C6000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF78DE000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF78E6000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF7876000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF7926000 C:\WINDOWS\system32\DRIVERS\pnarp.sys 20480 bytes (Pure Networks, Inc., Address Resolution Protocol Driver) 0xF79F6000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF792E000 C:\WINDOWS\system32\DRIVERS\purendis.sys 20480 bytes (Pure Networks, Inc., NDIS Relay Driver) 0xF7886000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF79EE000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF7906000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xA7F00000 C:\WINDOWS\system32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver) 0xF7319000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xA919C000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xF7AE2000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xF7A8A000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver) 0xF79FE000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xA9578000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF7A8E000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xA959C000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xF7AEA000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF6471000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7B28000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF7B32000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF7B26000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF7AEE000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7B2A000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7B74000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider) 0xF7B2C000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF7B20000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF7B22000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7AF0000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7C78000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xF7C82000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7C77000 C:\WINDOWS\system32\DRIVERS\lmimirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver) 0xF7D1A000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7BB6000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== 0x04970000 Hidden Image–>LelaResource.resources.dll [ EPROCESS 0x85840020 ] PID: 3032, 10285056 bytes 0x03B60000 Hidden Image–>LelaNetworkLib.dll [ EPROCESS 0x85840020 ] PID: 3032, 167936 bytes 0x05C40000 Hidden Image–>LelaServices.dll [ EPROCESS 0x85840020 ] PID: 3032, 200704 bytes 0x03BC0000 Hidden Image–>Linksys EasyLink Advisor.resources.dll [ EPROCESS 0x85840020 ] PID: 3032, 2027520 bytes 0x00F10000 Hidden Image–>log4net.dll [ EPROCESS 0x85840020 ] PID: 3032, 249856 bytes 0x05580000 Hidden Image–>Interop.NetworkCore.dll [ EPROCESS 0x85840020 ] PID: 3032, 258048 bytes 0x03A40000 Hidden Image–>LelaNetwork.dll [ EPROCESS 0x85840020 ] PID: 3032, 274432 bytes 0x03860000 Hidden Image–>LelaResource.dll [ EPROCESS 0x85840020 ] PID: 3032, 405504 bytes 0x05340000 Hidden Image–>LelaNetwork.resources.dll [ EPROCESS 0x85840020 ] PID: 3032, 512000 bytes

patndoris

Post #5May 14, 2011, 8:37 PM UTC

I'm not seeing any malware so far in your logs. Let's just do a couple more scans to be safe, since different tools look in different places for malware.

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Unheck Remove found threats.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.

heehaw2

Post #6May 16, 2011, 3:16 PM UTC

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6589 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 5/16/2011 11:12:57 AM mbam-log-2011-05-16 (11-12-57).txt Scan type: Quick scan Objects scanned: 175658 Time elapsed: 6 minute(s), 16 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

heehaw2

Post #7May 16, 2011, 4:16 PM UTC

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=e6e4a9f5d581a3428a7fa4c75da0380f # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-05-16 04:12:10 # local_time=2011-05-16 12:12:10 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777191 100 0 14685685 14685685 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=161087 # found=2 # cleaned=0 # scan_time=2991 C:\Documents and Settings\Anne\My Documents\My Pictures\AUTORUN.INF probably a variant of Win32/Autorun.JZSRXJQ worm (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\Temp\1133ccbd.exe a variant of Win32/Kunhitta.A trojan (unable to clean) 00000000000000000000000000000000 I

patndoris

Post #8May 16, 2011, 9:46 PM UTC

Since the ESET scan did find a couple of items that may be trojans, I'd like to go ahead and have you run Combofix. Please follow the instructions carefully.

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

heehaw2

Post #9May 17, 2011, 12:50 AM UTC

Used IE for a while after Combo Fix and didn't have a problem. Here's the log.

ComboFix 11-05-16.02 - Anne 05/16/2011 19:46:23.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.399 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Anne\WINDOWS
c:\documents and settings\Anne\WINDOWS\BlackBoysOnMopeds.ttf
c:\documents and settings\Anne\WINDOWS\system\BlackBoysOnMopeds[1].zip
c:\windows\system32\service
c:\windows\system32\service\01012009_TIS17_SfFniAU.log
c:\windows\system32\service\08032009_TIS17_SfFniAU.log
c:\windows\system32\service\09122009_TIS17_SfFniAU.log
c:\windows\system32\service\10062009_TIS17_SfFniAU.log
c:\windows\system32\service\17062009_TIS17_SfFniAU.log
c:\windows\system32\service\25102009_TIS17_SfFniAU.log
c:\windows\system32\service\27102009_TIS17_SfFniAU.log
c:\windows\system32\service\29012009_TIS17_SfFniAU.log
c:\windows\system32\service\31082010_TIS17_SfFniAU.log
.
.
((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-16 15:18 . 2011-05-16 15:18 ——– d—–w- c:\program files\ESET
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\documents and settings\Anne\Application Data\Malwarebytes
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-16 15:05 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-16 15:05 . 2010-12-20 22:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-16 11:42 . 2011-05-16 11:42 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-09 22:19 . 2011-05-09 22:19 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2011-05-09 13:55 . 2011-05-09 13:55 ——– d-sh–w- c:\documents and settings\Anne\IECompatCache
2011-05-09 13:52 . 2011-05-09 13:52 ——– d-sh–w- c:\documents and settings\Anne\PrivacIE
2011-05-09 13:51 . 2011-05-09 13:51 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2011-05-09 13:51 . 2011-05-09 13:51 ——– d-sh–w- c:\documents and settings\Anne\IETldCache
2011-05-09 13:47 . 2011-05-10 15:25 ——– d—–w- c:\windows\ie8updates
2011-05-09 13:44 . 2011-02-17 19:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-05-09 13:44 . 2011-02-17 19:00 78336 —-a-w- c:\windows\system32\dllcache\ieencode.dll
2011-05-09 13:39 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2011-05-09 13:39 . 2011-02-22 23:06 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-05-09 13:39 . 2011-02-22 23:06 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-05-09 13:39 . 2011-02-22 23:06 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-05-06 23:33 . 2011-05-06 23:33 ——– d—–w- c:\documents and settings\Anne\Application Data\IObit
2011-05-06 23:33 . 2011-05-06 23:33 ——– d—–w- c:\program files\IObit
2011-05-04 21:19 . 2011-05-04 21:19 ——– d—–w- c:\documents and settings\Anne\Application Data\Epson
2011-04-27 19:04 . 2006-10-31 04:10 51360 —-a-w- c:\windows\system32\EpPicPrt.dll
2011-04-27 19:04 . 2006-10-20 04:10 80024 —-a-w- c:\windows\system32\PICSDK.dll
2011-04-27 19:04 . 2006-10-20 04:10 501912 —-a-w- c:\windows\system32\PICSDK2.dll
2011-04-27 19:04 . 2006-10-20 04:10 108704 —-a-w- c:\windows\system32\PICEntry.dll
2011-04-27 19:04 . 2006-10-31 04:10 51360 —-a-w- c:\windows\system32\EpPicMgr.dll
2011-04-27 19:04 . 2011-04-27 19:04 ——– d—–w- c:\documents and settings\Anne\Application Data\InstallShield
2011-04-27 19:04 . 2009-09-30 20:01 63488 —-a-w- c:\windows\system32\E_FD4BGCA.DLL
2011-04-27 19:04 . 2008-11-11 19:00 93696 —-a-w- c:\windows\system32\E_FLBGCA.DLL
2011-04-27 19:03 . 2011-04-27 19:08 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2011-04-27 19:02 . 2011-04-27 19:02 ——– d—–w- c:\program files\Epson Software
2011-04-27 19:01 . 2009-05-01 04:00 128392 —-a-w- c:\windows\system32\esdevapp.exe
2011-04-27 19:01 . 2009-09-17 04:00 342016 —-a-w- c:\windows\system32\eswiaud.dll
2011-04-27 19:01 . 2009-05-01 04:00 15872 —-a-w- c:\windows\system32\escdev.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-08 14:08 . 2010-10-17 23:41 143504 —-a-w- c:\windows\system32\drivers\hrfsmrx.sys
2011-04-08 13:42 . 2010-10-17 23:41 172032 —-a-w- c:\windows\system32\hrfsnp.dll
2011-03-11 14:10 . 2008-04-14 09:41 471552 —-a-w- c:\windows\apppatch\aclayers.dll
2011-03-07 05:33 . 2008-06-19 16:01 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45 . 2008-04-14 09:42 434176 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 05:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-03-03 01:47 . 2010-02-11 00:58 398760 —-a-r- c:\windows\system32\cpnprt2.cid
2011-02-17 19:00 . 2008-04-14 09:42 832512 —-a-w- c:\windows\system32\wininet.dll
2011-02-17 19:00 . 2008-04-14 09:42 1830912 ——w- c:\windows\system32\inetcpl.cpl
2011-02-17 19:00 . 2008-04-14 09:41 17408 —-a-w- c:\windows\system32\corpol.dll
2011-02-17 13:18 . 2008-04-14 04:47 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2008-04-14 04:45 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-04-17 21:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-17 11:44 . 2008-04-14 04:07 389120 —-a-w- c:\windows\system32\html.iec
.
.
——- Sigcheck ——-
.
[-] 2008-06-06 . 9F42478360E9B053A6703DEF39B4CE33 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2C}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
[HKEY_CLASSES_ROOT\CLSID\{06F5F772-99DF-4191-9AED-3037B0DF154B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoConflict]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2B}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2C}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
[HKEY_CLASSES_ROOT\CLSID\{06F5F772-99DF-4191-9AED-3037B0DF154B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-03 135168]
"LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-08-06 159744]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"WebEx Document Loader"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-09-17 63048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2008-7-10 315392]
Trend Micro SafeSync.lnk - c:\program files\Trend Micro SafeSync\HrfsClient.exe [2010-10-17 2149136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-12-08 18:11 87424 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-28 00:17 207424 —-a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-12-23 22:05 143360 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 20:08 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 09:42 1695232 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 17:19 69632 —-a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-09-30 04:14 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"RTHDCPL"=RTHDCPL.EXE
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
.
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [12/8/2010 2:11 PM 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/17/2010 4:40 PM 12856]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [11/16/2010 9:02 PM 64080]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/23/2008 2:30 PM 24652]
R3 hrfsmrx;hrfsmrx;c:\windows\system32\drivers\hrfsmrx.sys [10/17/2010 7:41 PM 143504]
R3 humyo.com;humyo.com;c:\program files\Trend Micro SafeSync\hrfscore.exe [10/17/2010 7:41 PM 3541776]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [11/16/2010 9:00 PM 188272]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2010 3:38 PM 136176]
S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2010 3:38 PM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 19:38]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 19:38]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
Trusted Zone: durhamcountync.gov\dcapps
Trusted Zone: durhamcountync.gov\www
Trusted Zone: restaronline.com\www
Trusted Zone: taxsoftware.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} - hxxps://esis.ncwise.org/forms/jinitiator/jinit13128.exe
FF - ProfilePath - c:\documents and settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\
FF - prefs.js: browser.search.selectedEngine - GoodSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.womenshealthmag.com/fitness/abs-diet-weekly-menu?page=3|http://verizon.my.msn.com/default.aspx
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Trend Micro NSC Firefox Extension: {22C7F6C6-8D67-4534-92B5-529A0EC09405} - c:\program files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\firefoxextension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-Microsoft_World_of_Flight - d:\data\00Setup\App\Uninstal.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 19:51
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\System32\hrfsnp.dll
.
Completion time: 2011-05-16 19:54:05
ComboFix-quarantined-files.txt 2011-05-16 23:53
.
Pre-Run: 437,556,830,208 bytes free
Post-Run: 439,217,561,600 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - E276B0748CCD508501A4570545396AD9

patndoris

Post #10May 17, 2011, 12:55 AM UTC

CF removed several things, but it did not grab those 2 files identified by ESET. Let's go ahead and use CF to remove them now.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Anne\My Documents\My Pictures\AUTORUN.INF
C:\WINDOWS\Temp\1133ccbd.exe

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

heehaw2

Post #11May 17, 2011, 2:27 PM UTC last edited May 17, 2011, 3:02 PM UTC

I'm still having the problem of IE 7 shutting down unexpectedly.

ComboFix 11-05-16.03 - Anne 05/17/2011 10:16:47.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.403 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Anne\Desktop\CFScript.txt
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
FILE ::
"c:\documents and settings\Anne\My Documents\My Pictures\AUTORUN.INF"
"c:\windows\Temp\1133ccbd.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\boost_interprocess\20110515080402.375000
c:\documents and settings\Anne\My Documents\My Pictures\AUTORUN.INF
.
.
((((((((((((((((((((((((( Files Created from 2011-04-17 to 2011-05-17 )))))))))))))))))))))))))))))))
.
.
2011-05-16 15:18 . 2011-05-16 15:18 ——– d—–w- c:\program files\ESET
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\documents and settings\Anne\Application Data\Malwarebytes
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-16 15:05 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-16 15:05 . 2011-05-16 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-16 15:05 . 2010-12-20 22:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-16 11:42 . 2011-05-16 11:42 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-09 22:19 . 2011-05-09 22:19 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2011-05-09 13:55 . 2011-05-09 13:55 ——– d-sh–w- c:\documents and settings\Anne\IECompatCache
2011-05-09 13:52 . 2011-05-09 13:52 ——– d-sh–w- c:\documents and settings\Anne\PrivacIE
2011-05-09 13:51 . 2011-05-09 13:51 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2011-05-09 13:51 . 2011-05-09 13:51 ——– d-sh–w- c:\documents and settings\Anne\IETldCache
2011-05-09 13:47 . 2011-05-10 15:25 ——– d—–w- c:\windows\ie8updates
2011-05-09 13:44 . 2011-02-17 19:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-05-09 13:44 . 2011-02-17 19:00 78336 —-a-w- c:\windows\system32\dllcache\ieencode.dll
2011-05-09 13:39 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2011-05-09 13:39 . 2011-02-22 23:06 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-05-09 13:39 . 2011-02-22 23:06 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-05-09 13:39 . 2011-02-22 23:06 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-05-06 23:33 . 2011-05-06 23:33 ——– d—–w- c:\documents and settings\Anne\Application Data\IObit
2011-05-06 23:33 . 2011-05-06 23:33 ——– d—–w- c:\program files\IObit
2011-05-04 21:19 . 2011-05-04 21:19 ——– d—–w- c:\documents and settings\Anne\Application Data\Epson
2011-04-27 19:04 . 2006-10-31 04:10 51360 —-a-w- c:\windows\system32\EpPicPrt.dll
2011-04-27 19:04 . 2006-10-20 04:10 80024 —-a-w- c:\windows\system32\PICSDK.dll
2011-04-27 19:04 . 2006-10-20 04:10 501912 —-a-w- c:\windows\system32\PICSDK2.dll
2011-04-27 19:04 . 2006-10-20 04:10 108704 —-a-w- c:\windows\system32\PICEntry.dll
2011-04-27 19:04 . 2006-10-31 04:10 51360 —-a-w- c:\windows\system32\EpPicMgr.dll
2011-04-27 19:04 . 2011-04-27 19:04 ——– d—–w- c:\documents and settings\Anne\Application Data\InstallShield
2011-04-27 19:04 . 2009-09-30 20:01 63488 —-a-w- c:\windows\system32\E_FD4BGCA.DLL
2011-04-27 19:04 . 2008-11-11 19:00 93696 —-a-w- c:\windows\system32\E_FLBGCA.DLL
2011-04-27 19:03 . 2011-04-27 19:08 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2011-04-27 19:02 . 2011-04-27 19:02 ——– d—–w- c:\program files\Epson Software
2011-04-27 19:01 . 2009-05-01 04:00 128392 —-a-w- c:\windows\system32\esdevapp.exe
2011-04-27 19:01 . 2009-09-17 04:00 342016 —-a-w- c:\windows\system32\eswiaud.dll
2011-04-27 19:01 . 2009-05-01 04:00 15872 —-a-w- c:\windows\system32\escdev.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-08 14:08 . 2010-10-17 23:41 143504 —-a-w- c:\windows\system32\drivers\hrfsmrx.sys
2011-04-08 13:42 . 2010-10-17 23:41 172032 —-a-w- c:\windows\system32\hrfsnp.dll
2011-03-11 14:10 . 2008-04-14 09:41 471552 —-a-w- c:\windows\apppatch\aclayers.dll
2011-03-07 05:33 . 2008-06-19 16:01 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45 . 2008-04-14 09:42 434176 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 05:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-03-03 01:47 . 2010-02-11 00:58 398760 —-a-r- c:\windows\system32\cpnprt2.cid
2011-02-17 19:00 . 2008-04-14 09:42 832512 —-a-w- c:\windows\system32\wininet.dll
2011-02-17 19:00 . 2008-04-14 09:42 1830912 ——w- c:\windows\system32\inetcpl.cpl
2011-02-17 19:00 . 2008-04-14 09:41 17408 —-a-w- c:\windows\system32\corpol.dll
2011-02-17 13:18 . 2008-04-14 04:47 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2008-04-14 04:45 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-04-17 21:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-17 11:44 . 2008-04-14 04:07 389120 —-a-w- c:\windows\system32\html.iec
.
.
——- Sigcheck ——-
.
[-] 2008-06-06 . 9F42478360E9B053A6703DEF39B4CE33 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2C}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
[HKEY_CLASSES_ROOT\CLSID\{06F5F772-99DF-4191-9AED-3037B0DF154B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoConflict]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2B}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoReadonly]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2C}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2C}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HumyoUnavailable]
@="{06F5F772-99DF-4191-9AED-3037B0DF154B}"
[HKEY_CLASSES_ROOT\CLSID\{06F5F772-99DF-4191-9AED-3037B0DF154B}]
2011-04-08 14:07 1047312 —-a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-03 135168]
"LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-08-06 159744]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"WebEx Document Loader"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-09-17 63048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2008-7-10 315392]
Trend Micro SafeSync.lnk - c:\program files\Trend Micro SafeSync\HrfsClient.exe [2010-10-17 2149136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-12-08 18:11 87424 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-28 00:17 207424 —-a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-12-23 22:05 143360 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 20:08 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 09:42 1695232 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 17:19 69632 —-a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-09-30 04:14 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"RTHDCPL"=RTHDCPL.EXE
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
.
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [12/8/2010 2:11 PM 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/17/2010 4:40 PM 12856]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [11/16/2010 9:02 PM 64080]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/23/2008 2:30 PM 24652]
R3 hrfsmrx;hrfsmrx;c:\windows\system32\drivers\hrfsmrx.sys [10/17/2010 7:41 PM 143504]
R3 humyo.com;humyo.com;c:\program files\Trend Micro SafeSync\hrfscore.exe [10/17/2010 7:41 PM 3541776]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [11/16/2010 9:00 PM 188272]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2010 3:38 PM 136176]
S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2010 3:38 PM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
2011-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 19:38]
.
2011-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 19:38]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
Trusted Zone: durhamcountync.gov\dcapps
Trusted Zone: durhamcountync.gov\www
Trusted Zone: restaronline.com\www
Trusted Zone: taxsoftware.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} - hxxps://esis.ncwise.org/forms/jinitiator/jinit13128.exe
FF - ProfilePath - c:\documents and settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\
FF - prefs.js: browser.search.selectedEngine - GoodSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.womenshealthmag.com/fitness/abs-diet-weekly-menu?page=3|http://verizon.my.msn.com/default.aspx
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Trend Micro NSC Firefox Extension: {22C7F6C6-8D67-4534-92B5-529A0EC09405} - c:\program files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\firefoxextension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-17 10:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\System32\hrfsnp.dll
.
Completion time: 2011-05-17 10:24:28
ComboFix-quarantined-files.txt 2011-05-17 14:24
ComboFix2.txt 2011-05-16 23:54
.
Pre-Run: 439,207,616,512 bytes free
Post-Run: 439,228,735,488 bytes free
.
- - End Of File - - 0D5E65DB8D6B9BA2EAE69B8EEFACD877

patndoris

Post #12May 17, 2011, 9:21 PM UTC

I noticed you have IE7 on your machine. There are many vulnerabilities in this version, and it is recommended you update. You could go to IE8 but IE9 is stable and even more secure. I would strongly recommend that you update to the latest version and see if the problems persist.

Thanks for your patience, I know we've done a lot of scans. Since we have just removed a number of files, I'd like to do one final scan before we address a few other updates and do some clean up of tools.

Please download and install SUPERAntiSpyware Home Edition (free edition)

Load SUPERAntiSpyware and click the Check for Updates button.
Once the update has finished, exit SUPERAntiSpyware. Please do NOT run a scan yet!

IMPORTANT: Do NOT open any other windows or programs while SUPERAntiSpyware is scanning, it may interfere with the scanning process.

Open SUPERAntiSpyware and click the Scan your Computer button.
Check Perform Complete Scan and then click Next.
SUPERAntiSpyware will now scan your computer and when it’s finished it will list all the infections it has found.
Make sure that they all have a check next to them, and then click Next.
Click Finish and you will be taken back to the main interface.
It could be possible that it will ask you to reboot your computer in order to delete some files after reboot.
I'll need a log afterwards of what has been found.
To get the log, click Preferences and then click the Statistics/Logs tab. Click the dated log and press View Log and a text file will appear.
Please post the results of the SUPERAntiSpyware log in your next reply.

heehaw2

Post #13May 18, 2011, 12:10 AM UTC

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/17/2011 at 07:59 PM

Application Version : 4.52.1000

Core Rules Database Version : 7077
Trace Rules Database Version: 4889

Scan type : Complete Scan
Total Scan Time : 00:50:20

Memory items scanned : 509
Memory threats detected : 0
Registry items scanned : 7572
Registry threats detected : 0
File items scanned : 47040
File threats detected : 852

Adware.Tracking Cookie
C:\Documents and Settings\Anne\Cookies\[removed][5].txt
C:\Documents and Settings\Anne\Cookies\anne@2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@usatoday1.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@msnportal.112.2o7[2].txt
C:\Documents and Settings\Anne\Cookies\anne@interclick[1].txt
C:\Documents and Settings\Anne\Cookies\anne@lockedonmedia[2].txt
C:\Documents and Settings\Anne\Cookies\anne@adinterax[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][3].txt
C:\Documents and Settings\Anne\Cookies\anne@traditionalhome[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]-sys[2].txt
C:\Documents and Settings\Anne\Cookies\anne@kontera[2].txt
C:\Documents and Settings\Anne\Cookies\anne@celebritysexxxtapes[1].txt
C:\Documents and Settings\Anne\Cookies\anne@hearstmagazines.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@primediabusiness.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@fatbackmedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@hippocounter[2].txt
C:\Documents and Settings\Anne\Cookies\anne@qnsr[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@actualstat[2].txt
C:\Documents and Settings\Anne\Cookies\anne@hotelscom.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@healthgrades.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@invitemedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@oddcast[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@activenetwork.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@dmtracker[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@collective-media[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@msnbc.112.2o7[2].txt
C:\Documents and Settings\Anne\Cookies\anne@adbrite[2].txt
C:\Documents and Settings\Anne\Cookies\anne@yieldmanager[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@traveladvertising[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@mediafire[1].txt
C:\Documents and Settings\Anne\Cookies\anne@movieticketscom.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@media6degrees[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@premiumtv.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@cendantchg.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@smartadserver[1].txt
C:\Documents and Settings\Anne\Cookies\anne@specificmedia[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[3].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@pfizer.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@bruceclay.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@legolas-media[1].txt
C:\Documents and Settings\Anne\Cookies\anne@mtvn.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@crackberry[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@shopping.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@clicksor[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@lfg.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@wachovia.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@eyewonder[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@nextag[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@adlegend[2].txt
C:\Documents and Settings\Anne\Cookies\anne@adxpose[1].txt
C:\Documents and Settings\Anne\Cookies\anne@accountantsintl[2].txt
C:\Documents and Settings\Anne\Cookies\anne@cbcnewmedia.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@mywebsearch[1].txt
C:\Documents and Settings\Anne\Cookies\anne@microsoftconsumermarketing.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@ice.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@lucidmedia[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@samsclub.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[4].txt
C:\Documents and Settings\Anne\Cookies\anne@transunioninteractive.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@roiservice[2].txt
C:\Documents and Settings\Anne\Cookies\anne@dealtime[2].txt
C:\Documents and Settings\Anne\Cookies\anne@selfstoragefinders[2].txt
C:\Documents and Settings\Anne\Cookies\anne@myroitracking[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@peoplefinders[2].txt
C:\Documents and Settings\Anne\Cookies\anne@kanoodle[2].txt
C:\Documents and Settings\Anne\Cookies\anne@medhelpinternational.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@discounttire[2].txt
C:\Documents and Settings\Anne\Cookies\anne@earthlink.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@smartmoney.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@pro-market[2].txt
C:\Documents and Settings\Anne\Cookies\anne@espn.112.2o7[2].txt
C:\Documents and Settings\Anne\Cookies\anne@accountemps[1].txt
C:\Documents and Settings\Anne\Cookies\anne@pinnacledirectresponse.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@tribuneinteractive.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@ticketnetwork.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@livenation.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@thinkgeek.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@westernunionglobal.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@22squared.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@findagrave[1].txt
C:\Documents and Settings\Anne\Cookies\anne@qksrv[1].txt
C:\Documents and Settings\Anne\Cookies\anne@timeinc.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@beatthetraffic[2].txt
C:\Documents and Settings\Anne\Cookies\anne@bizrate[2].txt
C:\Documents and Settings\Anne\Cookies\anne@durhamcountylibrary[2].txt
C:\Documents and Settings\Anne\Cookies\anne@yadro[2].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[1].txt
C:\Documents and Settings\Anne\Cookies\anne@govtrack[1].txt
C:\Documents and Settings\Anne\Cookies\anne@discounttire.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@mediabrandsww[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@jobs3.netmedia1[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@walmart.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@trackalyzer[1].txt
C:\Documents and Settings\Anne\Cookies\anne@edgeadx[1].txt
C:\Documents and Settings\Anne\Cookies\anne@citizenstelecom.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[7].txt
C:\Documents and Settings\Anne\Cookies\anne@bronto.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@idgenterprise.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@travidia.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][3].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@goodyeartires.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@interchangecorporation.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@surveymonkey.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@foxinteractivemedia.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@ontarget.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@bluecrossblueshieldofnc.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@educationdynamics.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@gecmedia[2].txt
C:\Documents and Settings\Anne\Cookies\anne@adecn[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@novozymes.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@curtismedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[2].txt
C:\Documents and Settings\Anne\Cookies\anne@gladstonemedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@trafficmp[1].txt
C:\Documents and Settings\Anne\Cookies\anne@cbsdigitalmedia.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed]-rewards[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@amex-insights[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@crackle[2].txt
C:\Documents and Settings\Anne\Cookies\anne@durhamcountync[2].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[6].txt
C:\Documents and Settings\Anne\Cookies\anne@andomedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@112.2o7[2].txt
C:\Documents and Settings\Anne\Cookies\anne@serving-sys[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@associatedcontent.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@bizjournals.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@kantarmedia[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\anne@specificclick[1].txt
C:\Documents and Settings\Anne\Cookies\anne@marthastewart.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[11].txt
C:\Documents and Settings\Anne\Cookies\anne@tribalfusion[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@wpni.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@manpower.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@randallscottcompany.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[8].txt
C:\Documents and Settings\Anne\Cookies\anne@steelhousemedia[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@usnews.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][4].txt
C:\Documents and Settings\Anne\Cookies\anne@dardenrestaurants.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@tomsshoes.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[10].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@pointclickhome[1].txt
C:\Documents and Settings\Anne\Cookies\anne@mediaforge[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@backcountry[2].txt
C:\Documents and Settings\Anne\Cookies\anne@reztrack[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@ru4[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@questionmarket[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][3].txt
C:\Documents and Settings\Anne\Cookies\anne@marketlive.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@adp.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\anne@saxogoerie.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@solvemedia[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@insightexpressai[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\anne@tysonfoodsinc.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@myweather.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@mediate[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@realmedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@telefloracom.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][3].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@xiti[1].txt
C:\Documents and Settings\Anne\Cookies\anne@liveperson[9].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\anne@eliteopensourcejobs[2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@clickbooth[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@goodyear.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@lfstmedia[2].txt
C:\Documents and Settings\Anne\Cookies\anne@evite.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@uso.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@fathomseo.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@ihire.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@findlocation[2].txt
C:\Documents and Settings\Anne\Cookies\anne@concurtechnologies.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@yahoogroups.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@countryliving[1].txt
C:\Documents and Settings\Anne\Cookies\anne@tjx.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\anne@ihireaccounting[2].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@thechronicleofhighereducation.122.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\anne@dominionenterprises.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\anne@accountingproviders[1].txt
C:\Documents and Settings\Anne\Cookies\anne@microsoftmachinetranslation.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed]
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@oasc05126.247realmedia[1].txt
C:\Documents and Settings\Anne\Cookies\anne@microsoftwlsearchcrm.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@microsoftwindows.112.2o7[1].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@lucidmedia[4].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\Documents and Settings\Anne\Cookies\anne@streaming.countrylegends971[2].txt
C:\Documents and Settings\Anne\Cookies\anne@lucidmedia[3].txt
C:\Documents and Settings\Anne\Cookies\anne@journalofaccountancy[2].txt
C:\Documents and Settings\Anne\Cookies\anne@revsci[1].txt
C:\Documents and Settings\Anne\Cookies\anne@findarticles[2].txt
a.media.abcfamily.go.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
a.media.community.abcfamily.go.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
adsatt.espn.go.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
bbca.channelfinder.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
cdn.eyewonder.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
cdn4.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
content.video.imedia.ro [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
core.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
espn360.channelfinder.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
foxchannels.channelfinder.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
googleads.g.doubleclick.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
ia.media-imdb.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
interclick.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
m1.2mdn.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media-macys.pictela.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media.jambocast.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media.mtvnservices.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media.resulthost.org [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media.scanscout.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media.tattomedia.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
media1.break.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
mediaserver.vrxstudios.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
mediastore.verizonwireless.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
msnbcmedia.msn.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
msntest.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
objects.tremormedia.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
s0.2mdn.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
secure-us.imrworldwide.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
sftrack.searchforce.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
socialstreamingplayer.crystalmedianetworks.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
speed.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
udn.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
wdw2.wdpromedia.com [ C:\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\XHUPUUEZ ]
.mediaforge.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.mediaforge.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.network.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ontarget.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.optimize.indieclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ordie.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.overture.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.overture.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.peoplefinders.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pfizer.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pinnacledirectresponse.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pointclickhome.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.premiumtv.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.primediabusiness.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.qksrv.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.qksrv.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.qksrv.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.qnsr.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.randallscottcompany.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.recipefinder.womansday.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.recipefinder.womansday.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.rm.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.rm.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roberthalf-finance-accounting.jobs.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roberthalf-finance-accounting.jobs.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roberthalf-finance-accounting.jobs.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roberthalf-finance-accounting.jobs.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roiservice.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roiservice.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.s.clickability.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.s.clickability.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.samsclub.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.selfstoragefinders.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.shopping.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.smartadserver.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.smartadserver.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.smartadserver.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.smartmoney.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.solvemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.specificmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stat.dealtime.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stat.onestat.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stat.onestat.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stat.onestat.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stat.onestat.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stats.thecleaningauthority.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stats4.clicktracks.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stats4.clicktracks.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stats4.clicktracks.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.stats4.clicktracks.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.steelhousemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.steelhousemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.steelhousemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.surveymonkey.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.thinkgeek.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ticketnetwork.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.timeinc.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trackalyzer.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tracking.admarketplace.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tracking.foxnews.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tracking.foxnews.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tracking.godatafeed.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.traditionalhome.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.traffic.jostens.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trafficmp.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.transunioninteractive.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.traveladvertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.travidia.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tribuneinteractive.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.trvlnet.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tysonfoodsinc.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.usatoday1.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.usnews.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.uso.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.viacom.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.videoegg.adbureau.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.wachovia.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.walmart.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.westernunionglobal.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.wpni.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.accountemps.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.backcountry.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.backcountry.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.backcountry.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.backcountry.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.backcountry.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.discounttire.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.discounttire.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.findmyorder.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.findmyorder.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.frontieradserving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.qksrv.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.questionhub.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.questionhub.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.questionhub.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.questionhub.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.questionhub.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.vertadnet.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.windowsmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.windowsmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www7.addfreestats.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.xiti.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.xm.xtendmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.yadro.ru [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.yieldmanager.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.durhamcountync.gov [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.durhamcountync.gov [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.apmebf.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.mediabrandsww.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.burstnet.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.dmtracker.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.liveperson.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.liveperson.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
www.visitortracklog.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.mm.chitika.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pubads.g.doubleclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
www.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.hearstmagazines.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.www.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.lucidmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tribalfusion.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.eyewonder.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.eyewonder.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ar.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.basco.122.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.cbcnewmedia.112.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.clickbooth.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adlegend.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adlegend.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
adserver.warpradio.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
adserver.warpradio.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
o1.qnsr.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
e1.cdn.qnsr.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
e1.cdn.qnsr.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
e1.cdn.qnsr.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
www.qsstats.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
www.qsstats.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.andomedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.r1-ads.ace.advertising.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.roiservice.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.lucidmedia.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.countryliving.com [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\0kdzjn2r.default\cookies.sqlite ]
interclick.com [ C:\olddata\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\SALDD44P ]
media.scanscout.com [ C:\olddata\Documents and Settings\Anne\Application Data\Macromedia\Flash Player\#SharedObjects\SALDD44P ]
C:\olddata\Documents and Settings\Anne\Cookies\anne@atdmt[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@revsci[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@interclick[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@adserver[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@advertising[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@atwola[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@realmedia[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@bizrate[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@2o7[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@buycom.122.2o7[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@dealtime[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@insightexpressai[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@msnportal.112.2o7[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@northwestairlines.112.2o7[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@specificclick[2].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@tacoda[1].txt
C:\olddata\Documents and Settings\Anne\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\Anne\Cookies\anne@tribalfusion[1].txt
C:\olddata\Documents and Settings\Blondie (guests)\Cookies\blondie (guests)@atdmt[1].txt
C:\olddata\Documents and Settings\Blondie (guests)\Cookies\blondie (guests)@statcounter[1].txt
interclick.com [ C:\olddata\Documents and Settings\natalie\Application Data\Macromedia\Flash Player\#SharedObjects\4H86ARNJ ]
m1.2mdn.net [ C:\olddata\Documents and Settings\natalie\Application Data\Macromedia\Flash Player\#SharedObjects\4H86ARNJ ]
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@brightcove.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@media-convert[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@northshore.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@maxim.122.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@atwola[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@overture[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@ford.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed]-traffic[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@sourceinterlink.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@specificclick[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@cpvfeed[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@pictage.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@valpak.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@socialmedia[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@roiservice[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@mediaplex[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@kontera[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@interclick[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@partner2profit[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@doubleclick[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@volkswagen.122.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@blockbuster.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@accounts[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@accounts[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@adinterax[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@login.tracking101[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed]-sys[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@toplist[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@qnsr[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@adlegend[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@livenation.122.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@cbs.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@warnerbros.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@2o7[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@marketlive.122.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@accessexcellence[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@adecn[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@petfinder[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@media6degrees[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@questionmarket[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@dealtime[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@microsoftwlmessengermkt.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@atdmt[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@nextag[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@adbrite[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@tacoda[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@advertising[4].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@cbcnewmedia.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@collective-media[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@advertising[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@revsci[2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@advertising[3].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@care2.112.2o7[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@adserver[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][2].txt
C:\olddata\Documents and Settings\natalie\Cookies\natalie@valueclick[1].txt
C:\olddata\Documents and Settings\natalie\Cookies\[removed][3].txt

I had upgraded to IE 8 before and it didn't solve the problem so I went back to 7. I tried to do IE 9 but I can't with Windows XP. I went ahead and installed IE 8 again.

patndoris

Post #14May 18, 2011, 12:19 AM UTC

The items SuperAntiSpyware found are all browser cookies. Nothing to worry about.

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 25 and save it to your desktop.
Scroll down to where it says JDK 6 Update 25 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u25 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u25-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Download ATF Cleaner by Atribune.
Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Also, I noted that your Trend Micro is updated but disabled in all your logs. You should keep your antivirus enabled all the time for the best security.

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run
Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

There are no logs to post when these steps are done, please just let me know when you have finished.

heehaw2

Post #15May 18, 2011, 4:08 PM UTC

I've done all of the above. While installing the Java, my computer froze which is another problem I'm having sometimes. The computer will completly freeze, even ctrl-alt-delete does nothing. I have to manually shut down. I wait about 1 minute and turn the computer back on. The first time, the monitor doesn't come on and I have to manually shut down again. I wait another minute, turn it on, and everything's fine. This happens when I'm using the machine and also sometimes when Windows updates that require a restart are installed overnight, I find the "Windows is shutting down" screen still on in the morning and I have to go through the above process. I only disabled Trend Micro during installations of the various downloads and scans. Otherwise it is always on.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

IE, Dr Watson, and Bonjour

✨ Ask AI

Ask AI