What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Simbala's HJT log

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My virus scan told me i have " winrootkit" file name winik.sys. it will not let me delete/aurantine, etc. i have numerous pop-ups- problems with my mouse, and a VERY slow running computer. any help would be GREATLY appreciated!

thanks you



Logfile of HijackThis v1.99.1
Scan saved at 5:49:47 PM, on 10/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\WINDOWS\system32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Kim Hamerly\Local Settings\Temp\HijackThis.exe
c:\program files\mcafee.com\vso\mcvsmap.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [jjuqhauusoac] C:\WINDOWS\System32\rcqzpjk.exe
O4 - HKLM\..\Run: [hmvmp] C:\WINDOWS\hmvmp.exe
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Post #2
Hello simbanala, welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.
Post #3
Hello!! Here is a new log…. I am still in need of some help!! I just can't get rid of this!

Thank you so Much!!


Logfile of HijackThis v1.99.1
Scan saved at 9:39:02 PM, on 10/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Common Files\AOL\1128610856\ee\aolsoftware.exe
C:\WINDOWS\system32\mshta.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [jjuqhauusoac] C:\WINDOWS\System32\rcqzpjk.exe
O4 - HKLM\..\Run: [hmvmp] C:\WINDOWS\hmvmp.exe
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Post #4
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.
Post #5
okay- here is the hijackthis log…

Logfile of HijackThis v1.99.1
Scan saved at 2:52:38 PM, on 10/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [jjuqhauusoac] C:\WINDOWS\System32\rcqzpjk.exe
O4 - HKLM\..\Run: [hmvmp] C:\WINDOWS\hmvmp.exe
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

AND here is the other logfile…

Log of AproposFix v1

************

Running from directory:
C:\Documents and Settings\Kim Hamerly\Desktop\aproposfix

************

Registry entries found:


************

No service found!

Removing hidden folder:
No folder found!

Deleting files:


Backing up files:
Done!

Removing registry entries:

REGEDIT4


Done!

Finished!



-Kim
Post #6
Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.


Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #7
okay.. here i the new hijack this log..

Logfile of HijackThis v1.99.1
Scan saved at 4:37:41 PM, on 10/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MUSICM~1\Common\COMPON~1\MMCOMP~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [jjuqhauusoac] C:\WINDOWS\System32\rcqzpjk.exe
O4 - HKLM\..\Run: [hmvmp] C:\WINDOWS\hmvmp.exe
O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

and here is the ewido logfile

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 4:30:44 PM, 10/17/2005
+ Report-Checksum: FE5B06DA

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\WinIK -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Security -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Enum -> Spyware.CommonName : Error during cleaning
:mozilla.9:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.180:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.189:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.211:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.320:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.321:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.338:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.339:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Firefox\Profiles\d9vfs8wz.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.142:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.146:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.252:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][3].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][2].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@sento.122.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@shopathomeselect[2].txt -> Spyware.Cookie.Shopathomeselect : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Local Settings\Temp\Cookies\kim [removed][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Local Settings\Temp\Cookies\kim hamerly@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Local Settings\Temp\Cookies\kim [removed][1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.7:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.16:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.22:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.29:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Atdmt : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Bfast : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.53:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.54:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.55:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.56:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.61:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Centrport : Error during cleaning
:mozilla.63:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.68:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.69:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.70:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.71:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.72:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.73:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.75:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.76:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.77:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.120:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Coremetrics : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Mediaplex : Error during cleaning
:mozilla.143:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.145:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.146:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.147:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.148:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.149:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.197:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.218:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.219:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.239:C:\Program Files\support.com\backup\co&
Post #8
I suggest you do this:


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Use Add/Remove Programs and remove: If listed.
Viewpoint Manager


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [jjuqhauusoac] C:\WINDOWS\System32\rcqzpjk.exe

O4 - HKLM\..\Run: [hmvmp] C:\WINDOWS\hmvmp.exe

O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe

O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.




delete these files if listed:
C:\WINDOWS\System32\rcqzpjk.exe
C:\WINDOWS\hmvmp.exe
C:\PROGRAM FILES\wpurwwvo\eAwCHgxM.exe


Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #9
hello there- here is a new log…. upon restarting my comp- mcafee found winkrootkit again- still running slow…

thanks
-kim


Logfile of HijackThis v1.99.1
Scan saved at 5:25:07 PM, on 10/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\khooker.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
c:\program files\mcafee.com\vso\mcvsmap.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sotecglobal.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Post #11
" The file C:/WINDOWS/system32/drivers/winik.sys is infected by the WinKrootkit torjan and cannot be cleaned." tried to delete/quarantine- will not// states "Satus: Cannot be deleted" Verify that the file is not write-protected and try again. "
Post #14
Download the Registry Search Tool from here:
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

Unzip to your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:
winik

Press 'OK'

The search will run for a while then alert you when it is finished.

Press 'OK' and copy the contents of the WordPad window and post in this thread.
Post #15
here is the log…. thanks for your help…. i would never be able to figure any of this out on my own!! -kim REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "winik" 10/18/2005 4:19:08 PM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control] "ActiveService"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum] "0"="Root\\LEGACY_WINIK\\0000" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control] "ActiveService"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum] "0"="Root\\LEGACY_WINIK\\0000" [HKEY_USERS\S-1-5-21-2914288250-2704639424-2437969446-1005\Software\Microsoft\Search Assistant\ACMru\5603] "000"="winik" [HKEY_USERS\S-1-5-21-2914288250-2704639424-2437969446-1005\Software\Microsoft\Search Assistant\ACMru\5603] "001"="winik.sys"

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI