Lots Of "delete Failed" Stuff And Pop Ups

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 32 Objects found so far: 32 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 32 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Hits:195 Value : Cookie:[removed]/ Expires : 12-19-2004 8:44:26 PM LastSync : Hits:195 UseCount : 0 Hits : 195 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Hits:37 Value : Cookie:[removed]/ Expires : 12-18-2005 7:31:14 PM LastSync : Hits:37 UseCount : 0 Hits : 37 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@centrport[1].txt Category : Data Miner Comment : Hits:3 Value : Cookie:[removed]/ Expires : 12-31-2029 4:00:00 PM LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@revenue[2].txt Category : Data Miner Comment : Hits:175 Value : Cookie:[removed]/ Expires : 6-9-2022 9:05:42 PM LastSync : Hits:175 UseCount : 0 Hits : 175 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Hits:2 Value : Cookie:[removed]/ Expires : 9-6-2014 3:50:08 PM LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@zedo[1].txt Category : Data Miner Comment : Hits:21 Value : Cookie:[removed]/ Expires : 12-16-2014 9:22:22 AM LastSync : Hits:21 UseCount : 0 Hits : 21 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@2o7[1].txt Category : Data Miner Comment : Hits:141 Value : Cookie:[removed]/ Expires : 12-17-2009 1:45:24 PM LastSync : Hits:141 UseCount : 0 Hits : 141 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt Category : Data Miner Comment : Hits:6 Value : Cookie:[removed]/ Expires : 12-31-2009 4:00:00 PM LastSync : Hits:6 UseCount : 0 Hits : 6 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@maxserving[1].txt Category : Data Miner Comment : Hits:4 Value : Cookie:[removed]/ Expires : 12-16-2014 9:32:52 AM LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@casalemedia[1].txt Category : Data Miner Comment : Hits:3 Value : Cookie:[removed]/ Expires : 12-9-2005 4:34:40 AM LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@gator[1].txt Category : Data Miner Comment : Hits:9 Value : Cookie:[removed]/ Expires : 2-16-2005 7:17:08 PM LastSync : Hits:9 UseCount : 0 Hits : 9 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@questionmarket[2].txt Category : Data Miner Comment : Hits:4 Value : Cookie:[removed]/ Expires : 2-8-2006 2:11:40 AM LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@edge.ru4[1].txt Category : Data Miner Comment : Hits:24 Value : Cookie:[removed]/ Expires : 2-16-2005 7:31:46 PM LastSync : Hits:24 UseCount : 0 Hits : 24 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@trafficmp[1].txt Category : Data Miner Comment : Hits:48 Value : Cookie:[removed]/ Expires : 12-18-2005 9:45:30 AM LastSync : Hits:48 UseCount : 0 Hits : 48 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@bluestreak[2].txt Category : Data Miner Comment : Hits:3 Value : Cookie:[removed]/ Expires : 12-16-2014 3:44:30 PM LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@tickle[2].txt Category : Data Miner Comment : Hits:4 Value : Cookie:[removed]/ Expires : 12-18-2006 10:26:02 AM LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : lessa@realmedia[2].txt Category : Data Miner Comment : Hits:45 Value : Cookie:[removed]/ Expires : 12-31-2010 4:00:00 PM LastSync : Hits:45 UseCount : 0 Hits : 45 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 17 Objects found so far: 49 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@2o7[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@2o7[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@advertising[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@advertising[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@atdmt[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@atdmt[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@bfast[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@bfast[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@bluestreak[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@bluestreak[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@casalemedia[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@casalemedia[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@centrport[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@centrport[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@doubleclick[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@doubleclick[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@edge.ru4[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@edge.ru4[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@fastclick[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@fastclick[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@gator[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@gator[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@hitbox[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@hitbox[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@mediaplex[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@mediaplex[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@questionmarket[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@questionmarket[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@realmedia[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@realmedia[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@revenue[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@revenue[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@targetnet[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@targetnet[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@tickle[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@tickle[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@trafficmp[1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@trafficmp[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : ashley@tribalfusion[2].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\ashley@tribalfusion[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt Category : Data Miner Comment : Value : C:\Documents and Settings\Ashley\Cookies\[removed][1].txt Search Miracle Object Recognized! Type : File Data : protector[1].exe Category : Malware Comment : Object : C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\CX472BKV\ IBIS Toolbar Object Recognized! Type : File Data : WToolsP[1].cab Category : Data Miner Comment : Object : C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\CX472BKV\ Search Miracle Object Recognized! Type : File Data : bobby[1].exe Category : Malware Comment : Object : C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\S1GUZ4HV\ IBIS Toolbar Object Recognized! Type : File Data : WToolsC[1].cab Category : Data Miner Comment : Object : C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\S1GUZ4HV\ Search Miracle Object Recognized! Type : File Data : prot.exe Category : Malware Comment : Object : C:\ BargainBuddy Object Recognized! Type : File Data : A0001796.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP15\ FileVersion : 8.0.3.2 ProductName : BargainBuddy Decoupling Package CompanyName : eXact Advertising FileDescription : BargainBuddy Decoupling Package LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. LegalTrademarks : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. Comments : BargainBuddy Decoupling Package BargainBuddy Object Recognized! Type : File Data : A0001798.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP15\ BargainBuddy Object Recognized! Type : File Data : A0001799.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP15\ FileVersion : 2, 0, 0, 17 ProductVersion : 2, 0, 0, 17 ProductName : cbdll Module CompanyName : eXact Advertising FileDescription : cb.dll Module InternalName : cb.dll LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : cb.dll VX2 Object Recognized! Type : File Data : A0001830.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP15\ SecondThought Object Recognized! Type : File Data : A0001863.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 8.0.7.2 ProductVersion : 8.0.7.2 ProductName : Loader FileDescription : Loader InternalName : loader LegalCopyright : Copyright © 2003 OriginalFilename : loader.exe DyFuCA Object Recognized! Type : File Data : A0001865.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ DyFuCA Object Recognized! Type : File Data : A0001866.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ DyFuCA Object Recognized! Type : File Data : A0001867.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ BargainBuddy Object Recognized! Type : File Data : A0001875.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 2, 0, 0, 17 ProductVersion : 2, 0, 0, 17 ProductName : apuc Module CompanyName : eXact Advertising FileDescription : apuc Module InternalName : apuc LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : apuc.DLL BargainBuddy Object Recognized! Type : File Data : A0001876.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 8.0.3.2 ProductName : BullsEye Network CompanyName : eXact Advertising FileDescription : BargainBuddy Module LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. LegalTrademarks : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. Comments : BargainBuddy Module BargainBuddy Object Recognized! Type : File Data : A0001877.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 2, 0, 0, 2 ProductVersion : 2, 0, 0, 2 ProductName : BargainsBuddy ADP Module CompanyName : eXact Advertising FileDescription : bargains InternalName : ADP LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : bargains.exe BargainBuddy Object Recognized! Type : File Data : A0001878.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adv CompanyName : eXact Advertising InternalName : adv LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adv.exe BargainBuddy Object Recognized! Type : File Data : A0001879.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adx CompanyName : eXact Advertising InternalName : adx LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adx.exe BargainBuddy Object Recognized! Type : File Data : A0001887.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe BargainBuddy Object Recognized! Type : File Data : A0001888.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 2 ProductVersion : 1, 0, 0, 2 ProductName : Upload Module CompanyName : eXact Advertising FileDescription : Upload Module InternalName : Upload Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exul.exe VX2 Object Recognized! Type : File Data : A0001896.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ BargainBuddy Object Recognized! Type : File Data : A0001911.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe BargainBuddy Object Recognized! Type : File Data : A0001912.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 2 ProductVersion : 1, 0, 0, 2 ProductName : Upload Module CompanyName : eXact Advertising FileDescription : Upload Module InternalName : Upload Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exul.exe BargainBuddy Object Recognized! Type : File Data : A0001918.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe BargainBuddy Object Recognized! Type : File Data : A0001919.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe BargainBuddy Object Recognized! Type : File Data : A0001920.srg Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe BargainBuddy Object Recognized! Type : File Data : A0001921.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 2 ProductVersion : 1, 0, 0, 2 ProductName : Upload Module CompanyName : eXact Advertising FileDescription : Upload Module InternalName : Upload Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exul.exe BargainBuddy Object Recognized! Type : File Data : A0001922.vxd Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 2 ProductVersion : 1, 0, 0, 2 ProductName : Upload Module CompanyName : eXact Advertising FileDescription : Upload Module InternalName : Upload Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exul.exe BargainBuddy Object Recognized! Type : File Data : A0001924.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 2, 0, 0, 2 ProductVersion : 2, 0, 0, 2 ProductName : BargainsBuddy ADP Module CompanyName : eXact Advertising FileDescription : bargains InternalName : ADP LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : bargains.exe BargainBuddy Object Recognized! Type : File Data : A0001925.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adv CompanyName : eXact Advertising InternalName : adv LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adv.exe BargainBuddy Object Recognized! Type : File Data : A0001926.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adx CompanyName : eXact Advertising InternalName : adx LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adx.exe BargainBuddy Object Recognized! Type : File Data : A0001927.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 8.0.3.2 ProductName : BullsEye Network CompanyName : eXact Advertising FileDescription : BargainBuddy Module LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. LegalTrademarks : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. Comments : BargainBuddy Module BargainBuddy Object Recognized! Type : File Data : A0001928.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 3 ProductVersion : 1, 0, 0, 3 Rads01.Quadrogram Object Recognized! Type : File Data : A0001930.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1, 0, 0, 1 ProductVersion : 1, 0, 0, 1 BargainBuddy Object Recognized! Type : File Data : A0001952.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00.0004 ProductVersion : 1.00.0004 ProductName : CashBack Program CompanyName : eXact Advertising InternalName : cb LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : cb.exe BargainBuddy Object Recognized! Type : File Data : A0001953.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP17\ FileVersion : 1.00.0005 ProductVersion : 1.00.0005 ProductName : CashBack Flash Notification Module CompanyName : eXact Advertising InternalName : flash LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : flash.exe BargainBuddy Object Recognized! Type : File Data : A0001985.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 2, 0, 0, 2 ProductVersion : 2, 0, 0, 2 ProductName : BargainsBuddy ADP Module CompanyName : eXact Advertising FileDescription : bargains InternalName : ADP LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : bargains.exe BargainBuddy Object Recognized! Type : File Data : A0001986.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1, 0, 0, 5 ProductVersion : 1, 0, 0, 5 ProductName : NAVISearch Module CompanyName : eXact Advertising FileDescription : NLS Module InternalName : NLS LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : nls.exe SecondThought Object Recognized! Type : File Data : A0001987.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ BargainBuddy Object Recognized! Type : File Data : A0001989.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adv CompanyName : eXact Advertising InternalName : adv LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adv.exe BargainBuddy Object Recognized! Type : File Data : A0001990.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : adx CompanyName : eXact Advertising InternalName : adx LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : adx.exe SecondThought Object Recognized! Type : File Data : A0001995.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 8.0.7.1 ProductVersion : 8.0.7.1 ProductName : STC Application FileDescription : Second Thought InternalName : STC LegalCopyright : Copyright © 2003 OriginalFilename : STC.exe VX2 Object Recognized! Type : File Data : A0001999.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ SecondThought Object Recognized! Type : File Data : A0002000.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ DyFuCA Object Recognized! Type : File Data : A0002001.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ VX2 Object Recognized! Type : File Data : A0002002.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ DyFuCA Object Recognized! Type : File Data : A0002003.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1, 0, 0, 1 ProductVersion : 1, 0, 0, 1 ProductName : DyFuCA_BH Module FileDescription : DyFuCA_BH Module InternalName : DyFuCA_BH LegalCopyright : Copyright 2002 OriginalFilename : DyFuCA_BH.DLL SecondThought Object Recognized! Type : File Data : A0002004.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 8.0.7.8 ProductVersion : 8.0.7.8 InternalName : runpool.dll OriginalFilename : runpool.dll VX2 Object Recognized! Type : File Data : A0002005.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ BargainBuddy Object Recognized! Type : File Data : A0002006.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Download Module CompanyName : eXact Advertising FileDescription : Download Module InternalName : Download Utility LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : exdl.exe VX2 Object Recognized! Type : File Data : A0002007.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ BargainBuddy Object Recognized! Type : File Data : A0002008.dll Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 2, 0, 0, 17 ProductVersion : 2, 0, 0, 17 ProductName : apuc Module CompanyName : eXact Advertising FileDescription : apuc Module InternalName : apuc LegalCopyright : Copyright © 2003, 2004. eXact Advertising, LLC. All Rights Reserved. OriginalFilename : apuc.DLL Rads01.Quadrogram Object Recognized! Type : File Data : A0002009.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1, 0, 0, 1 ProductVersion : 1, 0, 0, 1 Winpup32 Object Recognized! Type : File Data : A0002010.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ FileVersion : 1.00 ProductVersion : 1.00 ProductName : trkgif CompanyName : .. InternalName : trkgif OriginalFilename : trkgif.exe IBIS Toolbar Object Recognized! Type : File Data : A0002020.exe Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ IBIS Toolbar Object Recognized! Type : File Data : A0002026.dll Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ SecondThought Object Recognized! Type : File Data : A0002084.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ IBIS Toolbar Object Recognized! Type : File Data : A0002086.exe Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ IBIS Toolbar Object Recognized! Type : File Data : A0002088.cfg Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ IBIS Toolbar Object Recognized! Type : File Data : A0002089.cfg Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ IBIS Toolbar Object Recognized! Type : File Data : A0002090.cfg Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP18\ Elitum.ElitebarBHO Object Recognized! Type : File Data : A0002203.dll Category : Data Miner Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP19\ FileVersion : 1, 0, 0, 7 ProductVersion : 1, 0, 0, 7 ProductName : Elite SideBar FileDescription : Elite SideBar InternalName : Elite SideBar LegalCopyright : Copyright 2004 OriginalFilename : EliteSideBar.DLL Search Miracle Object Recognized! Type : File Data : A0002204.exe Category : Malware Comment : Object : C:\System Volume Information\_restore{28192166-DCD0-4901-AD1A-CB57DD193595}\RP19\ Elitum.ElitebarBHO Object Recognized! Type : File Data : EliteToolBar version 58.dll Category : Data Miner Comment : Object : C:\WINDOWS\EliteToolBar\ FileVersion : 1, 0, 0, 58 ProductVersion : 1, 0, 0, 58 ProductName : EliteToolBar Dynamic Link Library FileDescription : EliteToolBar DLL InternalName : EliteToolBar LegalCopyright : Copyright © 2004 OriginalFilename : EliteToolBar.DLL CoolWebSearch Object Recognized! Type : File Data : muwqqqkg.exe Category : Malware Comment : Object : C:\WINDOWS\ Elitum.ElitebarBHO Object Recognized! Type : File Data : doolsav.dat Category : Data Miner Comment : Object : C:\WINDOWS\system32\ FileVersion : 1, 0, 0, 58 ProductVersion : 1, 0, 0, 58 ProductName : EliteToolBar Dynamic Link Library FileDescription : EliteToolBar DLL InternalName : EliteToolBar LegalCopyright : Copyright © 2004 OriginalFilename : EliteToolBar.DLL Elitum.ElitebarBHO Object Recognized! Type : File Data : 493937.dll Category : Data Miner Comment : Object : C:\WINDOWS\Temp\ FileVersion : 1, 0, 0, 58 ProductVersion : 1, 0, 0, 58 ProductName : EliteToolBar Dynamic Link Library FileDescription : EliteToolBar DLL InternalName : EliteToolBar LegalCopyright : Copyright © 2004 OriginalFilename : EliteToolBar.DLL Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 144 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 144 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Elitum.ElitebarBHO Object Recognized! Type : Regkey Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : TM Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : AT Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : AC Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : AD Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : AM Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : U Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : ohb_ie_plugin Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : I Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : TR Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : country Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : city Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : state Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : RX Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : RX2.8 Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : RX2.9 Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CURRENT_USER Object : software\lq Value : RX3.0 Elitum.ElitebarBHO Object Recognized! Type : Regkey Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum Elitum.ElitebarBHO Object Recognized! Type : Folder Category : Data Miner Comment : Object : C:\WINDOWS\EliteToolBar Search Miracle Object Recognized! Type : File Data : tmp7.tmp Category : Malware Comment : Object : C:\DOCUME~1\Lessa\LOCALS~1\Temp\ Search Miracle Object Recognized! Type : File Data : tmp8.tmp Category : Malware Comment : Object : C:\DOCUME~1\Lessa\LOCALS~1\Temp\ Search Miracle Object Recognized! Type : File Data : tmp9.tmp Category : Malware Comment : Object : C:\DOCUME~1\Lessa\LOCALS~1\Temp\ Search Miracle Object Recognized! Type : File Data : tmpA.tmp Category : Malware Comment : Object : C:\DOCUME~1\Lessa\LOCALS~1\Temp\ IBIS Toolbar Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\internet explorer\main Value : CustomizeSearch VX2 Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_CURRENT_USER Object : software\microsoft\internet explorer\toolbar\webbrowser Value : {0E5CBF21-D15F-11D0-8301-00AA005B4383} SecondThought Object Recognized! Type : Folder Category : Malware Comment : Object : c:\\temporary SecondThought Object Recognized! Type : File Data : install201.exe Category : Malware Comment : Object : c:\temporary\ CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_CURRENT_USER Object : software\microsoft\internet explorer\main Value : Search Bar CoolWebSearch Object Recognized! Type : File Data : myPcsearch.exe Category : Malware Comment : Object : c:\ FileVersion : 1, 2, 1, 2 ProductVersion : 2, 1, 2, 1 ProductName : myPCsearchbar FileDescription : Search for anything in your computer. InternalName : myPCsearchbar OriginalFilename : mypcsearchbar.EXE Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 30 Objects found so far: 174 11:52:42 PM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:03:07:36.533 Objects scanned:116850 Objects identified:174 Objects ignored:0 New critical objects:174

Need the Find_It and HijackThis logs.

do i do that find bat again?

Yes, we need a new find.bat log and new HijackThis log

Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 06:41 PM dllcache 05/07/2004 10:12 AM Microsoft 0 File(s) 0 bytes 2 Dir(s) 52,229,865,472 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/19/2004 12:02 AM 890 vsconfig.xml 12/18/2004 06:41 PM dllcache 12/15/2004 10:53 PM 4,212 zllictbl.dat 05/07/2004 10:03 AM 488 WindowsLogon.manifest 05/07/2004 10:03 AM 488 logonui.exe.manifest 05/07/2004 10:03 AM 749 sapi.cpl.manifest 05/07/2004 10:03 AM 749 nwc.cpl.manifest 05/07/2004 10:03 AM 749 wuaucpl.cpl.manifest 05/07/2004 10:03 AM 749 cdplayer.exe.manifest 05/07/2004 10:03 AM 749 ncpa.cpl.manifest 9 File(s) 9,823 bytes 1 Dir(s) 52,229,861,376 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 09/22/2004 06:46 PM 2,362,104 SET51.tmp 09/22/2004 06:46 PM 86,016 SET9A.tmp 09/22/2004 06:46 PM 229,376 SET3F.tmp 03/31/2003 04:00 AM 2,577 CONFIG.TMP 4 File(s) 2,680,073 bytes 0 Dir(s) 52,229,861,376 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{D2605C38-05A4-48EA-BA07-805844EE796F}"="" "iebar"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\r2p80c7uef.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————- Xfind Locked Files —————– ————– XFind Qoologic Results ————– ————– XFind Aspack Results ————— * resultC:\WINDOWS\System32\SAIE_KYF.DAT ————– Locate.com Results ————— C:\WINDOWS\SYSTEM32\ vsconfig.xml Sun Dec 19 2004 12:02:40a A..H. 890 0.87 K zllictbl.dat Wed Dec 15 2004 10:53:02p …H. 4,212 4.11 K 2 items found: 2 files, 0 directories. Total of file sizes: 5,102 bytes 4.98 K 

If you have not rebooted or shutdown/restarted, proceed as follows:

First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)
____
Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{D2605C38-05A4-48EA-BA07-805844EE796F}"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]


Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.
____
Double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\system32\r2p80c7uef.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____

Also, check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation.
Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document
Right click the text document and delete it.
When a file is deleted, it should ask if you want to send it to Recycle Bin.
Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted?
Post back what it does.


Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)


Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Make sure all windows are closed before proceeding to run HijackThis and Scan. Fix the following by placing a check in the appropriate box and selecting Fix Checked:

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvgyj32.exe
O4 - Global Startup: VTAgentReboot.exe


Use Add/Remove Programs and remove EliteToolBar


Open C:\Documents and Settings\All Users\StartMenu\Programs\Startup\VTAgentReboot.exe <–Delete File

Reboot:

Scan with HijackThis and post a new HijackThis log, and a new Find_It log.

If you encounter any problems with the steps above, please describe them.

And my find it log: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 06:41 PM dllcache 05/07/2004 10:12 AM Microsoft 0 File(s) 0 bytes 2 Dir(s) 52,224,720,896 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/20/2004 08:33 PM 890 vsconfig.xml 12/18/2004 06:41 PM dllcache 12/15/2004 10:53 PM 4,212 zllictbl.dat 05/07/2004 10:03 AM 488 WindowsLogon.manifest 05/07/2004 10:03 AM 488 logonui.exe.manifest 05/07/2004 10:03 AM 749 sapi.cpl.manifest 05/07/2004 10:03 AM 749 nwc.cpl.manifest 05/07/2004 10:03 AM 749 wuaucpl.cpl.manifest 05/07/2004 10:03 AM 749 cdplayer.exe.manifest 05/07/2004 10:03 AM 749 ncpa.cpl.manifest 9 File(s) 9,823 bytes 1 Dir(s) 52,224,716,800 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 09/22/2004 06:46 PM 2,362,104 SET51.tmp 09/22/2004 06:46 PM 86,016 SET9A.tmp 09/22/2004 06:46 PM 229,376 SET3F.tmp 03/31/2003 04:00 AM 2,577 CONFIG.TMP 4 File(s) 2,680,073 bytes 0 Dir(s) 52,224,716,800 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{D2605C38-05A4-48EA-BA07-805844EE796F}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\r2p80c7uef.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————- Xfind Locked Files —————– ————– XFind Qoologic Results ————– ————– XFind Aspack Results ————— * resultC:\WINDOWS\System32\SAIE_KYF.DAT ————– Locate.com Results ————— C:\WINDOWS\SYSTEM32\ vsconfig.xml Mon Dec 20 2004 8:33:10p A..H. 890 0.87 K zllictbl.dat Wed Dec 15 2004 10:53:02p …H. 4,212 4.11 K 2 items found: 2 files, 0 directories. Total of file sizes: 5,102 bytes 4.98 K 

And a great big THANK YOU….things are better already!!

If you have not rebooted or shutdown/restarted, proceed as follows:

First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)
____
Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]



Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.
____
Double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\\WINDOWS\\system32\\r2p80c7uef.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Do the same as above for each of the files that follow, and select No when asked to reboot!
C:\WINDOWS\System32\SAIE_KYF.DAT
C:\WINDOWS\System32\zllictbl.dat
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these. Close ALL windows and browsers except HijackThis and click "Fix checked"

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)


Also, check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation.
Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document
Right click the text document and delete it.
When a file is deleted, it should ask if you want to send it to Recycle Bin.
Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted?
Post back what it does.

Empty Recycle Bin

Scan with HijackThis and post a new HijackThis log, and a new Find_It log

C:\\WINDOWS\\system32\\r2p80c7uef.dll C:\WINDOWS\System32\guard.tmp These two came up with a message that said something to the effect of: File apparently not found or not there. Something like that. It's like it was saying those files were not there. I went on with all the instructions and just said ok when I got that message for each of these.

Find It log: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 06:41 PM dllcache 05/07/2004 10:12 AM Microsoft 0 File(s) 0 bytes 2 Dir(s) 52,220,493,824 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/20/2004 09:37 PM 4,212 zllictbl.dat 12/20/2004 09:36 PM 890 vsconfig.xml 12/18/2004 06:41 PM dllcache 05/07/2004 10:03 AM 488 WindowsLogon.manifest 05/07/2004 10:03 AM 488 logonui.exe.manifest 05/07/2004 10:03 AM 749 sapi.cpl.manifest 05/07/2004 10:03 AM 749 nwc.cpl.manifest 05/07/2004 10:03 AM 749 wuaucpl.cpl.manifest 05/07/2004 10:03 AM 749 cdplayer.exe.manifest 05/07/2004 10:03 AM 749 ncpa.cpl.manifest 9 File(s) 9,823 bytes 1 Dir(s) 52,220,493,824 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 09/22/2004 06:46 PM 2,362,104 SET51.tmp 09/22/2004 06:46 PM 86,016 SET9A.tmp 09/22/2004 06:46 PM 229,376 SET3F.tmp 03/31/2003 04:00 AM 2,577 CONFIG.TMP 4 File(s) 2,680,073 bytes 0 Dir(s) 52,220,493,824 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{D2605C38-05A4-48EA-BA07-805844EE796F}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————- Xfind Locked Files —————– ————– XFind Qoologic Results ————– ————– XFind Aspack Results ————— ————– Locate.com Results ————— C:\WINDOWS\SYSTEM32\ vsconfig.xml Mon Dec 20 2004 9:36:58p A..H. 890 0.87 K zllictbl.dat Mon Dec 20 2004 9:37:20p …H. 4,212 4.11 K 2 items found: 2 files, 0 directories. Total of file sizes: 5,102 bytes 4.98 K 

Recycle bin does ask me if i really want to delete before moving the file to the recycle bin. I check yes…. it goes to the bin and then I empty the bin. It seems to work just fine.