What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

new log

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.97.7
Scan saved at 2:10:23 AM, on 10/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Documents and Settings\Emily Winton\Local Settings\Temporary Internet Files\Content.IE5\TBNF6FWT\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usf.edu/students.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R3 - URLSearchHook: (no name) - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 6.0\Reader\AdobeUpdateManager.exe Reader6 -reboot 1
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub/shock…ector/swdir.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls…/20/SassCln.CAB
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://helpdesk.acomp.usf.edu/rnt/rnl/java/RntX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{495786E9-4B83-46AA-864A-E8778766B64B}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\..\{495786E9-4B83-46AA-864A-E8778766B64B}: NameServer = 205.188.146.145
Post #2
Hi Emily and welcome to the forum. You do have some junk that needs to go, including a nasty adult content dialer: http://castlecops.com/startuplist-10724.html I suggest you keep this computer offline as much as possible until we get you cleaned up. Here are the problems standing in the way.

1) You are running HJT from a Temporary Internet File and we need a permanent folder where logs and backups for safety can be stored. I suggest: C:\HJT\HijackThis.exe. If you need additional instructions use this link: http://russelltexas.com/malware/createhjtfolder.htm

2) You version of HJT is very outdated. I need to see a log with the latest version which is 1.99.1. You can download the new version here: http://www.malwareremoval.com/downloads.html

3) With that dialer on your machine, I would get this done as soon as possible and as I said, stay offline until it is gone. I will post back to you as soon as possible after you complete the above instructions.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #3
thank you for all of your help, i really appreciate it. I believe I did everything you asked, and I am trying to keep my computer offline. Do you know exactly what that file will do to my computer? thanks again and here is my new logfile.

Logfile of HijackThis v1.99.1
Scan saved at 10:21:28 AM, on 10/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usf.edu/students.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R3 - URLSearchHook: (no name) - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 6.0\Reader\AdobeUpdateManager.exe Reader6 -reboot 1
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://helpdesk.acomp.usf.edu/rnt/rnl/java/RntX.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #4
Hi Emily, CastleCops provides this link: http://www.symantec.com/avcenter/venc/data…thbeachtel.html To my knowledge a dialer is trying to add $$'s to your phone bill, you might want to check that out. The information Symantic provides is in the link. I don't think it does any damange other than to your wallet. Please review all of the information in the links I provided, because of this: May be installed when certain Web pages are visited. The user must agree to the installation.If this dialer has been downloaded on purpose and you are aware of it, you may not want to remove it?? I will schedule removal and you should not follow these directions if the above information applies.

Please do this:
1) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp and please do not run it until I ask you to.

2) Download, update, configure and run these two programs: http://tomcoyote.org/aawsb.php
The newest version of Ad-aware is 1.06 and Spybot 1.04. Even if you have these programs, use the link to get the newest version, update and configure them as in the link. Run Spybot first, reboot then run Ad-aware. Both programs back up what they remove so delete anything the programs say should be removed.

Ad-Watch by Lavasoft will likely block the fix, I suggest you turn it off while you use HJT then back on when you finish:
In the Ad-Watch window have them check the Active option instead of Automatic and it will stop undoing your fix.
1. Right-click on Ad-watch icon in the System Tray.
2.Go to Ad-Watch Settings and uncheck Load Ad-Watch on Windows start up
3. Again in Ad-Watch Settings Select Unload Ad-watch.


3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R3 - URLSearchHook: (no name) - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
does not identify
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
MyWebSearch adware
O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
Incredifind/Keenvalue
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
MyWebSearch parasite
O4 - HKLM\..\Run: [updmgr] updmgr.exe
premium rate adult content dialer
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe
MyWebSearch parasite

Close all programs but HJT and all browser windows, then click on "Fix Checked"

4) SHOW HIDDEN FILES: Follow the instructions in the link to enable hidden files for your operating system.
You may wish to reverse this process if you have any concern about anyone getting into these hidden system files.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\PROGRA~1\MyWay\ >>> folder

C:\Program Files\Common files\updmgr\ >>> folder

C:\Windows\Prefetch: Locate this folder and delete all of the contents (NOT THE FOLDER) This information will tell you more about Prefetch:
http://www.windowsnetworking.com/articles_…refetch-XP.html

5) Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do. Then restart the computer and post a new HJT log in this same thread along with any feedback you have.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #5
i think i got everything, though i did have a point were my computer was continuously opening folders on my desk top- that would be the worm i think i have…is that the same thing we aretrying to get rid of? ok well here is my new post, thanks again for all of your help. lets kill this thing please!!!


Logfile of HijackThis v1.99.1
Scan saved at 5:16:04 PM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usf.edu/students.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://helpdesk.acomp.usf.edu/rnt/rnl/java/RntX.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #6
OK Emily, the bad stuff looks to be gone, just a little clutter to remove. Let me know how you are running now.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(These two R1 lines are clutter, click the links to see where they go. If you don't use them check and remove them)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
(next two are orphans, doing nothing but using disk space)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

You will probably need to turn of Adwatch again to remove that stuff. I see know other issues and you should be in good shape.
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.
Post #7
thank you so much, it appears to be doing better but i am still getting pop=ups from ad-aware on whether i should allow things to be changed or not and i honestly dont know whether its me doing stuff to the items or something on my computer…is there a way to tell? ok well thanks again for all of your help and here is my last log hopefully.
emily


Logfile of HijackThis v1.99.1
Scan saved at 7:38:38 PM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usf.edu/students.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://helpdesk.acomp.usf.edu/rnt/rnl/java/RntX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #9
Emily, If you are not sure it is on, on the Google Toolbar line, all the way to the right look for Options, might be a little drop down menu. Check to be sure your popup blocker has a check in the box.

Let's run one more Scan to make sure nothing bad is hiding. Ewido is a free two week trial, after two weeks the realtime protection goes away and you can still keep and update the scanner if you wish. Follow these directions, when Ewido finds something have it delete it unless you know it is not bad. It will find a lot of bad cookies and let's hope it finds what is making you have popups.

Ewido scan:
Please download Ewido Security Suite it is a trial version of the program.
  • Install ewido security suite
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

Make sure you save that log, I need to see it. After you have run ewico, then scan and also post a new HJT log. Let's see what that does. Ewido generally takes close to an hour the first time it is run.

Thanks…Phil
Post #10
ok as far as the google toolbar goes. i have been trying to use mozilla instead of my internet explorer so i dont even have a goodle toolbar in use right now. and i believe that the one on my internet explorer has been turned on for some time now. i couldnt find a way to turn on the pop up blocker for mozilla- maybe it doesnt have one? ok well here is my scan from hjt first….

Logfile of HijackThis v1.99.1
Scan saved at 12:42:15 PM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usf.edu/students.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://helpdesk.acomp.usf.edu/rnt/rnl/java/RntX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #11
and this is the scan from theewido program… ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 6:24:55 AM, 10/10/2005 + Report-Checksum: 8C198CD6 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{8940E505-72C6-44DE-BE85-1D746780EFBF} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{8940E505-72C6-44DE-BE85-1D746780EFBF}\TypeLib\\ -> Spyware.VirtualBouncer : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{508EBE65-E39D-4363-8041-E647B4F6F4E1}\TypeLib\\ -> Spyware.NavExcel : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273}\TypeLib\\ -> Spyware.VirtualBouncer : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C}\Forward\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\SWRT01.RT -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\SWRT01.RT\Clsid -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\SWRT01.RT\Clsid\\ -> Spyware.SecondThought : Cleaned with backup HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup HKLM\SOFTWARE\PerfectNav -> Spyware.KeenValue : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0199DF25-9820-4BD5-9FEE-5A765AB4371E} -> Spyware.KeenValue : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5AA06644-BC46-4220-A460-47A6EB47C96D} -> Spyware.NavExcel : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup HKU\S-1-5-21-544633366-949427011-3163653540-1007\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} -> Spyware.MyWay : Cleaned with backup HKU\S-1-5-21-544633366-949427011-3163653540-1007\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-544633366-949427011-3163653540-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0199DF25-9820-4BD5-9FEE-5A765AB4371E} -> Spyware.KeenValue : Cleaned with backup HKU\S-1-5-21-544633366-949427011-3163653540-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0199DF25-9820-4BD5-9FEE-5A765AB4371E} -> Spyware.KeenValue : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5AA06644-BC46-4220-A460-47A6EB47C96D} -> Spyware.NavExcel : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup :mozilla.6:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.10:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup :mozilla.11:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.12:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.13:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.14:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.15:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.16:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\0w8j7mkw.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\Documents and Settings\Guest\Cookies\[removed][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.36:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.38:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.53:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.55:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.56:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.57:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.58:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.59:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.89:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.90:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.91:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.92:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.94:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.95:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.96:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.97:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.98:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.100:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.106:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.107:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.109:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.132:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.133:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.140:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.141:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.142:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.143:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.149:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.155:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.156:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.157:C:\RECYCLER\NPROTECT\00241126.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.37:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.39:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.40:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.41:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.63:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.66:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.68:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.69:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.76:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.77:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.78:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.95:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.96:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.97:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.104:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00241127.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.37:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.39:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.40:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.41:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.63:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.66:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.68:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.69:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.76:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.77:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.78:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.95:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.96:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.97:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.104:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00241128.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.34:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.46:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.48:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.50:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.83:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.90:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.109:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00241129.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.34:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.46:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.48:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.50:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.83:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.90:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.109:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00241130.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.34:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.46:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.48:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.50:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.83:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.90:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.109:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00241131.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.29:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.32:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.39:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.51:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.53:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.54:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.55:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.75:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.83:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.84:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.90:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.102:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.109:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00241132.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.29:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.37:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.51:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.52:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.53:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.71:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.79:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.80:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.88:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.100:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.103:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.106:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.107:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.108:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.114:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00241133.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.7:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.35:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.47:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.50:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.51:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.68:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.69:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.71:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.77:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.78:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.79:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.80:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.86:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.97:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.98:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.104:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.106:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00241137.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.12:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.13:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.35:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.47:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.49:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.50:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.51:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.68:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.69:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.71:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.77:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.78:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.79:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.80:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.86:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.97:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.98:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.99:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.101:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.104:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.105:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.106:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00241141.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.6:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.8:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.9:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.10:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.19:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.24:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Excite : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.26:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.27:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.29:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.32:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.33:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.34:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.35:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.42:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.54:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.56:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.57:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.58:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.80:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.81:C:\RECYCLER\NPROTECT\00241142.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.82:C:\RECYCLER
Post #12
Emily, If you are talking about Firefox: http://www.mozilla.org/products/firefox/
click on Tools > Options > Web Features then make sure the "Block Popup Windows" box is checked at least.

Ewido cleaned out a hugh amount of junk, look at the log to see where that stuff is hiding, if this is Firefox, you can address the cookie issue here:
Tools > Options > Privacy > Open Cookies and set to block, then use exceptions to allow the cookies you need to have.

Please see this information: http://www.liutilities.com/products/wintas…brary/nprotect/ I should also say I do not see Symantec running but rather McAfee. I do see Symantec in a DPF 016 line. Be careful these two antivirus programs are not running at the same time.
Because ewido found so much junk, you may want to run it again, it would be a good thing to run it in safe mode: http://www.bleepingcomputer.com/forums/tutorial61.html


Logfile of HijackThis v1.99.1 Scan saved at 12:42:15 PM, on 10/10/2005

Your HJT log is clean except for this one line of clutter
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

You may do as you wish, but I do not suggest running CCleaner on automatic
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO

This line appears to have to with the Apple iPod and it is supposed to be safe. Here's hoping they are not using it do offer you popups.
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

That's about all I see…Thanks, Phil :wavey:
Post #13
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI