Going absolutely out of my mind!

OK I finally got SP2 installed on my computer. But I am still having all of the other problems. Any tips or ideas?

I am also having an insane amount of pop-ups that I can not stop. I have the SP2 pop-up blocker running and the google pop-up blocker bar, but it still does not get these other pop-ups. It opens dozens at a time, even if I am not browning the internet. Can someone please help me, my computer is getting REALLY screwy!

Hello Nightshade Divine, welcome to the TC.

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

Spy Sweeper results: ******** 8:14 PM: | Start of Session, Wednesday, November 09, 2005 | 8:14 PM: Spy Sweeper started 8:14 PM: Sweep initiated using definitions version 569 8:14 PM: Starting Memory Sweep 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: Found Adware: icannnews 8:16 PM: Detected running threat: C:\WINDOWS\system32\irl2l53o1.dll (ID = 83) 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: Detected running threat: C:\WINDOWS\system32\rqbdyctl.dll (ID = 83) 8:18 PM: Found Adware: tubby toolbar 8:18 PM: Detected running threat: C:\WINDOWS\system32\tdte.dll (ID = 81565) 8:18 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:20 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:21 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: Memory Sweep Complete, Elapsed Time: 00:06:49 8:21 PM: Starting Registry Sweep 8:21 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: Found Adware: media-motor 8:21 PM: HKLM\software\mm\ (1 subtraces) (ID = 140211) 8:21 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:21 PM: Found Adware: quicklink search toolbar 8:21 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458) 8:21 PM: Found Trojan Horse: berbew trojan 8:21 PM: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || mtklef (ID = 837545) 8:21 PM: HKCR\qlink.qlfilter\ (3 subtraces) (ID = 890588) 8:21 PM: HKCR\qlink.qlfilter.1\ (3 subtraces) (ID = 890592) 8:21 PM: HKCR\qlink.qlhelper\ (3 subtraces) (ID = 890596) 8:21 PM: HKCR\qlink.qlhelper.1\ (3 subtraces) (ID = 890600) 8:21 PM: HKCR\clsid\{aa3c0ffe-758e-4c41-b1b9-2d711915a938}\ (8 subtraces) (ID = 890604) 8:21 PM: HKCR\clsid\{e225ab73-4d7e-45f7-9425-47d2f7c7a8ab}\ (10 subtraces) (ID = 890613) 8:21 PM: HKCR\typelib\{090712ed-1622-4227-94d3-f573a9c2577f}\ (9 subtraces) (ID = 890624) 8:21 PM: HKLM\software\classes\qlink.qlfilter\ (3 subtraces) (ID = 890661) 8:21 PM: HKLM\software\classes\qlink.qlfilter.1\ (3 subtraces) (ID = 890665) 8:21 PM: HKLM\software\classes\qlink.qlhelper\ (3 subtraces) (ID = 890669) 8:21 PM: HKLM\software\classes\qlink.qlhelper.1\ (3 subtraces) (ID = 890673) 8:21 PM: HKLM\software\classes\clsid\{aa3c0ffe-758e-4c41-b1b9-2d711915a938}\ (8 subtraces) (ID = 890677) 8:21 PM: HKLM\software\classes\clsid\{e225ab73-4d7e-45f7-9425-47d2f7c7a8ab}\ (10 subtraces) (ID = 890686) 8:21 PM: Found Adware: instant access 8:21 PM: HKLM\software\classes\clsid\{e225ab73-4d7e-45f7-9425-47d2f7c7a8ab}\progid\ (1 subtraces) (ID = 890691) 8:21 PM: HKLM\software\classes\typelib\{090712ed-1622-4227-94d3-f573a9c2577f}\ (9 subtraces) (ID = 890697) 8:21 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser qlhelper objects\{aa3c0ffe-758e-4c41-b1b9-2d711915a938}\ (ID = 909564) 8:21 PM: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || mtkle (ID = 910516) 8:21 PM: Found Trojan Horse: trojan downloader popuppers 8:21 PM: HKCR\clsid\{62fba4e7-bd9e-4d8d-8fbb-3c32999cb7fc}\ (23 subtraces) (ID = 960709) 8:21 PM: HKCR\clsid\{a03323d3-f649-4f16-a6e4-4fc53f917a83}\ (10 subtraces) (ID = 960733) 8:21 PM: HKCR\typelib\{1942bebe-dce5-4148-868e-1250a2218b4c}\ (9 subtraces) (ID = 960748) 8:21 PM: HKLM\software\classes\clsid\{62fba4e7-bd9e-4d8d-8fbb-3c32999cb7fc}\ (23 subtraces) (ID = 960771) 8:21 PM: HKLM\software\classes\clsid\{a03323d3-f649-4f16-a6e4-4fc53f917a83}\ (10 subtraces) (ID = 960795) 8:21 PM: HKLM\software\classes\typelib\{1942bebe-dce5-4148-868e-1250a2218b4c}\ (9 subtraces) (ID = 960810) 8:21 PM: Found Adware: yoursearch.ws hijack 8:21 PM: HKU\S-1-5-21-861567501-2111687655-1060284298-1004\software\microsoft\internet explorer\ || searchurl (ID = 147820) 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:22 PM: Registry Sweep Complete, Elapsed Time:00:00:49 8:22 PM: Starting Cookie Sweep 8:22 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01 8:22 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:22 PM: Starting File Sweep 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:22 PM: Found Adware: bullguard popup ad 8:22 PM: c:\windows\temp\bullguard (1 subtraces) (ID = -2147476409) 8:22 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:22 PM: c:\program files\quick links (1 subtraces) (ID = -2147478145) 8:22 PM: c:\program files\quicklinks (1 subtraces) (ID = -2147468660) 8:22 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:23 PM: iemonitor.ocx (ID = 186211) 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:23 PM: qlutility.exe (ID = 168232) 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:24 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:25 PM: Found Trojan Horse: trojan-downloader-nextern 8:25 PM: d8dc.tmp (ID = 168162) 8:25 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:26 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:27 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:27 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:28 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:29 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:30 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:30 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:30 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:30 PM: Found Adware: targetsaver 8:30 PM: glf13glf13.exe (ID = 166444) 8:31 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:31 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: Found Adware: surf accuracy 8:31 PM: 773dc860-48ae-44ae-864e-78080a (ID = 180136) 8:31 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:32 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:32 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:33 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:33 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:33 PM: bulldownload.exe (ID = 52017) 8:34 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:34 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:35 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:35 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:35 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:36 PM: tdte.dll (ID = 81565) 8:36 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:37 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: Found Adware: internetoptimizer 8:37 PM: cfin (ID = 184697) 8:37 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:37 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:38 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:38 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:39 PM: cfout.txt (ID = 184695) 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:40 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:40 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:40 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:40 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:41 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: qllib.dll (ID = 168233) 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:42 PM: 113_dollarrevenue_4_0_3_9.exe (ID = 166444) 8:42 PM: Found Adware: apropos 8:42 PM: contextplus.exe (ID = 185940) 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:42 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:43 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:43 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:44 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:45 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:45 PM: class-barrel (ID = 78229) 8:45 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:46 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:46 PM: d1e24.tmp (ID = 153752) 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:47 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: vocabulary (ID = 78283) 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:47 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:47 PM: Found Adware: powerscan 8:47 PM: power scan.lnk (ID = 72676) 8:48 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:48 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:49 PM: File Sweep Complete, Elapsed Time: 00:27:00 8:49 PM: Full Sweep has completed. Elapsed time 00:35:02 8:49 PM: Traces Found: 220 8:49 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:49 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:50 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:51 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:51 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:52 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: Removal process initiated 8:52 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:52 PM: Quarantining All Traces: icannnews 8:53 PM: icannnews is in use. It will be removed on reboot. 8:53 PM: C:\WINDOWS\system32\irl2l53o1.dll is in use. It will be removed on reboot. 8:53 PM: C:\WINDOWS\system32\rqbdyctl.dll is in use. It will be removed on reboot. 8:53 PM: Quarantining All Traces: apropos 8:53 PM: Quarantining All Traces: berbew trojan 8:53 PM: Quarantining All Traces: internetoptimizer 8:53 PM: Quarantining All Traces: trojan downloader popuppers 8:53 PM: Quarantining All Traces: trojan-downloader-nextern 8:53 PM: Quarantining All Traces: bullguard popup ad 8:53 PM: Quarantining All Traces: instant access 8:53 PM: Quarantining All Traces: media-motor 8:53 PM: Quarantining All Traces: powerscan 8:53 PM: Quarantining All Traces: quicklink search toolbar 8:53 PM: Quarantining All Traces: surf accuracy 8:53 PM: Quarantining All Traces: targetsaver 8:53 PM: Quarantining All Traces: yoursearch.ws hijack 8:53 PM: Warning: Timed out waiting for explorer.exe 8:53 PM: Warning: Timed out waiting for explorer.exe 8:53 PM: Warning: Timed out waiting for explorer.exe 8:53 PM: Warning: Quarantine process could not restart Explorer. 8:54 PM: Quarantining All Traces: tubby toolbar 8:54 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:54 PM: tubby toolbar is in use. It will be removed on reboot. 8:54 PM: Preparing to restart your computer. Please wait… 8:54 PM: Removal process completed. Elapsed time 00:02:26 ******** 7:40 PM: | Start of Session, Wednesday, November 09, 2005 | 7:40 PM: Spy Sweeper started 7:54 PM: Your spyware definitions have been updated. 8:03 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: ActiveX Shield: found: Adware: tubby toolbar, version 1.0.0.0 – Installation denied 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:12 PM: Your definitions are up to date. 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: | End of Session, Wednesday, November 09, 2005 |

McAfee VirusScan detects a NTRootKit-J trojan

Do it show the location of the file?

I suggest you do this:


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

We need To disable SpySweeper: Until your PC is clean.

Open it click >Options over to the left then >program options >Uncheck "load at windows startup".
Over to the left click "shields" and uncheck all there.
Uncheck "home page shield".
Uncheck 'automaticly restore default without notifiction".
Use Add/Remove Programs and remove: If listed.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [WINP] C:\WINDOWS\winmic.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
If you don't use webshots, fix also.

O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: khfgh - khfgh.dll (file missing)

O21 - SSODL: rpUofyNfB - {80BFDA24-2A15-708E-322D-398889F5EFE4} - (no file)

O23 - Service: change me please (virus) - Unknown owner - C:\WINDOWS\sysdat.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"





Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.




delete these files if listed:
C:\WINDOWS\winmic.exe
C:\WINDOWS\sysdat.exe



Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Backup your Registry…
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



click Start>Run and type regedit tap enter key.


Regedit will open. At the top of the window click edit> Find> then copy and paste the following into the window.

sysdat.exe

Then click find now.
When you find the entry right click on it and select delete, answer ok at the prompt.
Next, press "F3" to continue searching, if another instance is found, repeat the above steps, until you see the "completed searching" message.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O23 - Service: change me please (virus) - Unknown owner - C:\WINDOWS\sysdat.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Run HiJackThis then:

1. Click "Config…"
2. Click "Misc Tools"
3. Click "Delete a NT Service"

-

In the Delete window, enter, change me please (virus) and press OK. OK any prompts,

close HijackThis, and restart your computer to reset the registry.



Run Hijack This again and put a check by these.

O23 - Service: change me please (virus) - Unknown owner - C:\WINDOWS\sysdat.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"



Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

This is a real nasty that doesn't want to die.

Close all windows and browsers.
Open HijackThis

Click on Open Misc Tools
Click on Delete a File On Reboot
Click once on the file below to select it:
C:\WINDOWS\sysdat.exe



Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.

O23 - Service: change me please (virus) - Unknown owner - C:\WINDOWS\sysdat.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and see if it's gone now.