Spyware / Malware / Virus Removal

ilead.itrack.it problem

28 min read

Looking for the outcome? Ask AI

Rich B. Topic Starter

Post #1February 21, 2006, 1:32 AM UTC

Hello, and thanks in advance for any help. I picked up some malware that opens internet pages, ususally from ilead.itrack.it. I ran all the suggestions listed in the forum as things to do before posting the HijackThis log.
Here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 8:19:33 PM, on 2/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
d:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\alg.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Roboform\RoboTaskBarIcon.exe
C:\Program Files\Privoxy\privoxy.exe
C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Tor\tor.exe
C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8118
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [avast!] d:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "d:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [THGuard] "D:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /M "Stylus C86" /EF "HKCU"
O4 - HKCU\..\Run: [RoboForm] "D:\Program Files\Roboform\RoboTaskBarIcon.exe"
O4 - Startup: Adobe Gamma Loader.exe
O4 - Startup: cleantemp.lnk = D:\essentials\cleantemp.bat
O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: Tor.lnk = C:\Program Files\Tor\tor.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://D:\Program Files\Roboform\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113691515
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Any help is appreciated.

LDTate

Post #2February 22, 2006, 12:25 AM UTC

Hello Rich B., welcome to the TC.

Do a file search for a file named mxtarget.dll

Let me know if you find it.

Please do not delete anything unless instructed to.

Go here and run the online scan, allow it to delete whatever it finds:

Panda ActiveScan

Once you are on the Panda site click the Scan your PC button
[*]A new window will open…click the Check Now button

[*]Enter your Country

[*]Enter your State/Province

[*]Enter your e-mail address and click send

[*]Select either Home User or Company

[*]Click the big Scan Now button

[*]If it wants to install an ActiveX component allow it

[*]It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

[*]When download is complete, click on Local Disks to start the scan

[*]When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Note any thing that can't be fixed

Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Rich B.

Post #3February 22, 2006, 4:12 AM UTC

Hello LDTate…thanks for the response.

I found no mxtarget.dll

I encountered a problem in running the Panda Scan. Error message:

<<
Not allowing the application's ActiveX control to be downloaded.

Problems with the Internet connection.

The error could be due to a download error or an installation error due to lack of hard disk space, privileges etc.,… Try again >>>

I tried rebooting, shutting off antivirus, firewall, and checked that the Panda Active X was applied…keep getting this error and the scan will not complete. Tried 5-6 times. No success.

Suggestion?

Hello Rich B., welcome to the TC.

Do a file search for a file named mxtarget.dll

Let me know if you find it.

Please do not delete anything unless instructed to.

Go here and run the online scan, allow it to delete whatever it finds:

Panda ActiveScan

Once you are on the Panda site click the Scan your PC button
[*]A new window will open…click the Check Now button

[*]Enter your Country

[*]Enter your State/Province

[*]Enter your e-mail address and click send

[*]Select either Home User or Company

[*]Click the big Scan Now button

[*]If it wants to install an ActiveX component allow it

[*]It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

[*]When download is complete, click on Local Disks to start the scan

[*]When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

LDTate

Post #4February 22, 2006, 12:35 PM UTC

This is what I suggest you do.

Please do not delete anything unless instructed to.

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Rich B.

Post #5February 23, 2006, 11:18 PM UTC

Okay, LD…here are the logs from Ewido and HijackThis max can post is 102400..current is 197323. Ewido log shortened..can send full file if you need it.. Most seem to be repeated entries of the same items. Thanks for the help! Rich >>>>>——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 5:53:58 PM, 2/23/2006 + Report-Checksum: DBFC3F74 + Scan result: :mozilla.24:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.25:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.26:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.27:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.106:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.107:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.108:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.132:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.135:C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Start Menu\Programs\Startup\Adobe Gamma Loader.exe -> Hijacker.VB.lj : Cleaned with backup :mozilla.58:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.62:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.69:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.70:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.71:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.173:C:\RECYCLER\NPROTECT\00000008.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.173:C:\RECYCLER\NPROTECT\00000009.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.173:C:\RECYCLER\NPROTECT\00000010.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.173:C:\RECYCLER\NPROTECT\00000011.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.73:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.74:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.173:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.61:C:\RECYCLER\NPROTECT\00000013.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.64:C:\RECYCLER\NPROTECT\00000013.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.65:C:\RECYCLER\NPROTECT\00000013.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.72:C:\RECYCLER\NPROTECT\00000013.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup snipped……….. :mozilla.107:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.111:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001247.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.107:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.111:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001248.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.11:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.107:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.110:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.111:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001249.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.14:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.111:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.114:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001250.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001251.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001252.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001253.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.113:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001315.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001316.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001318.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.15:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.112:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001320.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.113:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001326.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.113:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001327.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.113:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001328.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.16:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.113:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001329.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.17:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.114:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001330.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001331.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.18:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.115:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001332.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001333.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.20:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.116:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001334.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.21:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.117:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.120:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001335.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001336.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001337.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001338.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.22:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.118:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001339.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001340.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001341.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001342.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001343.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001344.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001349.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001350.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001351.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.23:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.119:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.122:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.123:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001352.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.132:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.133:C:\RECYCLER\NPROTECT\00001353.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.132:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.133:C:\RECYCLER\NPROTECT\00001354.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.25:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.121:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.132:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.133:C:\RECYCLER\NPROTECT\00001358.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001382.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001383.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001389.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001402.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001403.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001404.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001409.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001412.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001416.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001424.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001425.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001448.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001449.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001450.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.28:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.124:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.134:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001451.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.29:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.125:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.135:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001452.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001453.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001454.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001462.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001463.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001470.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001471.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001472.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.30:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.126:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.129:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001473.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001474.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001481.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001482.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001483.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001484.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001485.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001486.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001491.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.31:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Yadro : Cleaned with backup :mozilla.127:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.130:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.131:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Zedo : Cleaned with backup :mozilla.137:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.138:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.139:C:\RECYCLER\NPROTECT\00001492.MOZ -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.32:C:\RECY

Rich B.

Post #6February 23, 2006, 11:22 PM UTC

Okay, LD…here are the logs from Ewido and HijackThis
max can post is 102400..current is 197323. Ewido log shortened..can send full file if you need it..
Most seem to be repeated entries of the same items.

Thanks for the help!

Rich

hijack This:
Logfile of HijackThis v1.99.1
Scan saved at 5:58:26 PM, on 2/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
D:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
d:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Roboform\RoboTaskBarIcon.exe
C:\Program Files\Privoxy\privoxy.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Tor\tor.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8118
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - d:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [avast!] d:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "d:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [THGuard] "D:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /M "Stylus C86" /EF "HKCU"
O4 - HKCU\..\Run: [RoboForm] "D:\Program Files\Roboform\RoboTaskBarIcon.exe"
O4 - Startup: cleantemp.lnk = D:\essentials\cleantemp.bat
O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: Tor.lnk = C:\Program Files\Tor\tor.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://D:\Program Files\Roboform\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113691515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

LDTate

Post #7February 23, 2006, 11:45 PM UTC

some malware that opens internet pages, ususally from ilead.itrack.it.

You still getting this?

Rich B.

Post #8February 24, 2006, 12:11 AM UTC

Yes, still get pages from ilead..it seem to hit the first time I go on internet.

some malware that opens internet pages, ususally from ilead.itrack.it.
You still getting this?

LDTate

Post #9February 24, 2006, 12:15 AM UTC

Download this one and let me know if it finds anything.
RootkitRevealer
http://www.sysinternals.com/Utilities/RootkitRevealer.html

When it's done, go to file->save
save the logfile to the desktop, and then past the contents here.

Rich B.

Post #10February 24, 2006, 12:29 AM UTC

Log file..2 discrepancies: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed 2/23/2006 6:40 PM 4 bytes Data mismatch between Windows API and raw hive data. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesSuccessful 2/23/2006 6:40 PM 4 bytes Data mismatch between Windows API and raw hive data.

LDTate

Post #11February 24, 2006, 12:39 AM UTC

Sorry about all the downloads

Download and Save blacklight to your desktop.
F-Secure Blacklight: http://www.f-secure.com/blacklight/try.shtml
Double-click blbeta.exe then accept the agreement.
click > scan then > next,
You'll see a list of all items found.
Don't choose for rename yet! I want to see the log first, because legit items can also be present there…
There must be also a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers)
Post the contents of the log in your next reply together with a new hijackthislog.

Rich B.

Post #12February 24, 2006, 1:17 AM UTC

No prob with downloads

Log: 02/23/06 20:13:00 [Info]: BlackLight Engine 1.0.32 initialized 02/23/06 20:13:00 [Info]: OS: 5.1 build 2600 (Service Pack 2) 02/23/06 20:13:00 [Note]: 7019 4 02/23/06 20:13:00 [Note]: 7005 0 02/23/06 20:13:03 [Note]: 7006 0 02/23/06 20:13:03 [Note]: 7011 1952 02/23/06 20:13:03 [Note]: FSRAW library version 1.7.1015 02/23/06 20:13:47 [Note]: 7007 0 No probs found

Rich B.

Post #13February 24, 2006, 1:18 AM UTC

Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 8:16:32 PM, on 2/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
D:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
d:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Roboform\RoboTaskBarIcon.exe
C:\Program Files\Privoxy\privoxy.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Tor\tor.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://spearhead1944.com/shweb1.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8118
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - d:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\Program Files\Roboform\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [avast!] d:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "d:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /M "Stylus C86" /EF "HKCU"
O4 - HKCU\..\Run: [RoboForm] "D:\Program Files\Roboform\RoboTaskBarIcon.exe"
O4 - Startup: cleantemp.lnk = D:\essentials\cleantemp.bat
O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: Tor.lnk = C:\Program Files\Tor\tor.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://D:\Program Files\Roboform\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Richard J. Baier.BLUEBOMBER\Application Data\Mozilla\Firefox\Profiles\u64nicbe.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Roboform\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Roboform\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Roboform\RoboFormComShowToolbar.html
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113691515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

LDTate

Post #14February 24, 2006, 1:24 AM UTC

Then download this program.

http://downloads.subratam.org/DllCompare.exe

Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log…." button.

Post the dll compare log to this thread.

Rich B.

Post #15February 24, 2006, 1:30 AM UTC

* DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found

" ________________________________________________ 1,368 items found: 1,368 files, 0 directories. Total of file sizes: 300,934,674 bytes 286.99 M Administrator Account = True ——————–End log———————

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

ilead.itrack.it problem

✨ Ask AI

Ask AI