********
7:30 AM: | Start of Session, Friday, March 24, 2006 |
7:30 AM: Spy Sweeper started
7:30 AM: Sweep initiated using definitions version 640
7:30 AM: Starting Memory Sweep
7:30 AM: Found Adware: mirar webband
7:30 AM: Detected running threat: C:\WINDOWS\system32\WinNB57.dll (ID = 185460)
7:30 AM: Found Adware: clkoptimizer
7:30 AM: Detected running threat: C:\WINDOWS\system32\minhype.dll (ID = 268933)
7:31 AM: Detected running threat: C:\WINDOWS\system32\gbnhih.exe (ID = 268995)
7:31 AM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || fsryif (ID = 0)
7:31 AM: HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Run || cpyaj (ID = 0)
7:32 AM: Memory Sweep Complete, Elapsed Time: 00:02:19
7:32 AM: Starting Registry Sweep
7:32 AM: Found Adware: azsearch toolbar
7:32 AM: HKCR\clsid\{a19ef336-01d4-48e6-926a-fe7e1c747aed}\ (11 subtraces) (ID = 103891)
7:32 AM: HKCR\clsid\{ba048011-957f-4ba0-a804-62c28d96f878}\ (20 subtraces) (ID = 103893)
7:32 AM: HKCR\clsid\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}\ (11 subtraces) (ID = 103895)
7:32 AM: HKLM\software\classes\clsid\{a19ef336-01d4-48e6-926a-fe7e1c747aed}\ (11 subtraces) (ID = 103915)
7:32 AM: HKLM\software\classes\clsid\{ba048011-957f-4ba0-a804-62c28d96f878}\ (20 subtraces) (ID = 103917)
7:32 AM: HKLM\software\classes\clsid\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}\ (11 subtraces) (ID = 103919)
7:32 AM: HKLM\software\classes\typelib\{42fc3840-020c-4e93-a34c-4df1a6330fbb}\ (9 subtraces) (ID = 103932)
7:32 AM: HKLM\software\microsoft\internet explorer\toolbar\ || {a19ef336-01d4-48e6-926a-fe7e1c747aed} (ID = 103945)
7:32 AM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}\ (ID = 103949)
7:32 AM: HKLM\software\zsearchco\ (7 subtraces) (ID = 103954)
7:32 AM: HKCR\typelib\{42fc3840-020c-4e93-a34c-4df1a6330fbb}\ (9 subtraces) (ID = 103955)
7:32 AM: Found Adware: internetoptimizer
7:32 AM: HKCR\interface\{aa4939c3-deca-4a48-a454-97cd587c0ef5}\ (8 subtraces) (ID = 128885)
7:32 AM: HKLM\software\classes\interface\{aa4939c3-deca-4a48-a454-97cd587c0ef5}\ (8 subtraces) (ID = 128896)
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\rotue\ (ID = 128925)
7:32 AM: HKCR\clsid\{8a0dcbda-6e20-489c-9041-c1e8a0352e75}\ (11 subtraces) (ID = 135064)
7:32 AM: HKCR\clsid\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e}\ (14 subtraces) (ID = 135065)
7:32 AM: HKCR\clsid\{9a9c9b69-f908-4aab-8d0c-10ea8997f37e}\ (6 subtraces) (ID = 135066)
7:32 AM: HKCR\interface\{6e4c7afc-9915-4036-b7f9-8b3f1710788f}\ (8 subtraces) (ID = 135069)
7:32 AM: HKCR\interface\{54b287f9-fd90-4457-b65e-cb91560c021d}\ (8 subtraces) (ID = 135070)
7:32 AM: HKCR\interface\{1037b06c-84b7-4240-8d80-485810a0497d}\ (8 subtraces) (ID = 135071)
7:32 AM: HKCR\interface\{224302b0-94e9-45c2-9e5b-ba989ee556e1}\ (8 subtraces) (ID = 135072)
7:32 AM: HKCR\nn_bar_dummy.nn_bardummy.1\ (3 subtraces) (ID = 135075)
7:32 AM: HKCR\nn_bar_dummy.nn_bardummy\ (5 subtraces) (ID = 135076)
7:32 AM: HKLM\software\classes\clsid\{8a0dcbda-6e20-489c-9041-c1e8a0352e75}\ (11 subtraces) (ID = 135077)
7:32 AM: HKLM\software\classes\clsid\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e}\ (14 subtraces) (ID = 135078)
7:32 AM: HKLM\software\classes\clsid\{9a9c9b69-f908-4aab-8d0c-10ea8997f37e}\ (6 subtraces) (ID = 135079)
7:32 AM: HKLM\software\classes\interface\{6e4c7afc-9915-4036-b7f9-8b3f1710788f}\ (8 subtraces) (ID = 135082)
7:32 AM: HKLM\software\classes\interface\{54b287f9-fd90-4457-b65e-cb91560c021d}\ (8 subtraces) (ID = 135083)
7:32 AM: HKLM\software\classes\interface\{1037b06c-84b7-4240-8d80-485810a0497d}\ (8 subtraces) (ID = 135084)
7:32 AM: HKLM\software\classes\interface\{224302b0-94e9-45c2-9e5b-ba989ee556e1}\ (8 subtraces) (ID = 135085)
7:32 AM: HKLM\software\classes\nn_bar_dummy.nn_bardummy.1\ (3 subtraces) (ID = 135088)
7:32 AM: HKLM\software\classes\nn_bar_dummy.nn_bardummy\ (5 subtraces) (ID = 135089)
7:32 AM: HKLM\software\classes\nn_bar_dummy.nn_bardummy\clsid\ (1 subtraces) (ID = 135090)
7:32 AM: HKLM\software\classes\nn_bar_dummy.nn_bardummy\curver\ (1 subtraces) (ID = 135091)
7:32 AM: HKLM\software\classes\typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49}\ (9 subtraces) (ID = 135092)
7:32 AM: HKLM\software\classes\typelib\{f8310e7d-4c4d-46a4-a068-b5bb99411cc7}\ (9 subtraces) (ID = 135093)
7:32 AM: HKLM\software\microsoft\internet explorer\toolbar\ || {9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (ID = 135098)
7:32 AM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{9a9c9b69-f908-4aab-8d0c-10ea8997f37e}\ (1 subtraces) (ID = 135105)
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\{8a0dcbda-6e20-489c-9041-c1e8a0352e75}\ (2 subtraces) (ID = 135119)
7:32 AM: HKCR\typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49}\ (9 subtraces) (ID = 135121)
7:32 AM: HKCR\typelib\{f8310e7d-4c4d-46a4-a068-b5bb99411cc7}\ (9 subtraces) (ID = 135122)
7:32 AM: Found Adware: moneytree
7:32 AM: HKCR\interface\{eee4a2e5-9f56-432f-a6ed-f6f625b551e0}\ (8 subtraces) (ID = 135185)
7:32 AM: Found Adware: ist yoursitebar
7:32 AM: HKCR\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (8 subtraces) (ID = 147829)
7:32 AM: HKLM\software\classes\ysbactivex.installer\ (3 subtraces) (ID = 147849)
7:32 AM: Found Adware: ist software
7:32 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/ysbactivex.dll\ (2 subtraces) (ID = 147854)
7:32 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\ysbactivex.dll (ID = 147857)
7:32 AM: HKCR\ysbactivex.installer\ (3 subtraces) (ID = 147869)
7:32 AM: Found Adware: zenosearchassistant
7:32 AM: HKLM\software\microsoft\windows\currentversion\app management\arpcache\enhanced ads by zeno\ (2 subtraces) (ID = 147931)
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\enhanced ads by zeno\ (2 subtraces) (ID = 147934)
7:32 AM: Found Adware: quicklink search toolbar
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
7:32 AM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
7:32 AM: HKLM\software\qstat\ (5 subtraces) (ID = 769771)
7:32 AM: Found Adware: psguard
7:32 AM: HKLM\software\psguard.com\psguard\ || installdir (ID = 849757)
7:32 AM: HKLM\software\qstat\ || brr (ID = 877670)
7:32 AM: HKLM\software\classes\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (8 subtraces) (ID = 920458)
7:32 AM: Found Adware: elitemediagroup-pop64
7:32 AM: HKCR\clsid\{9ac54695-69a4-46f1-be10-10c74f9520d5}\ (6 subtraces) (ID = 967504)
7:32 AM: HKCR\interface\{b216c7fc-397c-45f0-adfc-907df3c87339}\ (8 subtraces) (ID = 967532)
7:32 AM: HKCR\interface\{efdfe6ee-8888-422e-ab3c-b48589338ae3}\ (8 subtraces) (ID = 967541)
7:32 AM: HKCR\typelib\{5bec549d-581b-4636-ae75-28645e8cddc1}\ (9 subtraces) (ID = 967550)
7:32 AM: HKLM\software\classes\clsid\{9ac54695-69a4-46f1-be10-10c74f9520d5}\ (6 subtraces) (ID = 967564)
7:32 AM: HKLM\software\classes\interface\{b216c7fc-397c-45f0-adfc-907df3c87339}\ (8 subtraces) (ID = 967592)
7:32 AM: HKLM\software\classes\interface\{efdfe6ee-8888-422e-ab3c-b48589338ae3}\ (8 subtraces) (ID = 967601)
7:32 AM: HKLM\software\classes\typelib\{5bec549d-581b-4636-ae75-28645e8cddc1}\ (9 subtraces) (ID = 967610)
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\webnexus\ (2 subtraces) (ID = 1006191)
7:32 AM: HKCR\mirar_dummy_ats.mirar_dummy_ats1\ (5 subtraces) (ID = 1055242)
7:32 AM: HKCR\mirar_dummy_ats.mirar_dummy_ats1.1\ (3 subtraces) (ID = 1055248)
7:32 AM: HKCR\mirar_dummy_ats.mirar_dummy_ats1.1\clsid\ (1 subtraces) (ID = 1055250)
7:32 AM: HKCR\clsid\{8a0dcbdb-6e20-489c-9041-c1e8a0352e75}\ (11 subtraces) (ID = 1055256)
7:32 AM: HKCR\typelib\{34568171-e2ca-4fcd-a99f-43771f766b8a}\ (9 subtraces) (ID = 1055268)
7:32 AM: HKLM\software\classes\mirar_dummy_ats.mirar_dummy_ats1\ (5 subtraces) (ID = 1055285)
7:32 AM: HKLM\software\classes\mirar_dummy_ats.mirar_dummy_ats1.1\ (3 subtraces) (ID = 1055291)
7:32 AM: HKLM\software\classes\mirar_dummy_ats.mirar_dummy_ats1.1\clsid\ (1 subtraces) (ID = 1055293)
7:32 AM: HKLM\software\classes\clsid\{8a0dcbdb-6e20-489c-9041-c1e8a0352e75}\ (11 subtraces) (ID = 1055311)
7:32 AM: HKLM\software\classes\typelib\{34568171-e2ca-4fcd-a99f-43771f766b8a}\ (9 subtraces) (ID = 1055323)
7:32 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\system32\winats.dll (ID = 1055333)
7:32 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/system32/winats.dll\ (2 subtraces) (ID = 1066860)
7:32 AM: Found Adware: purityscan
7:32 AM: HKLM\software\microsoft\windows\currentversion\uninstall\elitemediagroupoin\ (2 subtraces) (ID = 1070163)
7:32 AM: HKLM\software\microsoft\windows\currentversion\run\ || browserupdatesched (ID = 1075246)
7:32 AM: HKLM\software\microsoft\code store database\distribution units\{9ac54695-69a4-46f1-be10-10c74f9520d5}\ (12 subtraces) (ID = 1122691)
7:32 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/elite.ocx\ (2 subtraces) (ID = 1137453)
7:32 AM: Found Adware: ezula ilookup
7:32 AM: HKLM\software\microsoft\bit1ocker\ (1 subtraces) (ID = 1157705)
7:32 AM: HKCR\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212644)
7:32 AM: HKLM\software\classes\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212651)
7:32 AM: HKLM\software\microsoft\internet explorer\extensions\{4abf810a-f11d-4169-9d5f-7d274f2270a1}\ (2 subtraces) (ID = 1212690)
7:32 AM: HKU\S-1-5-21-4151388396-867582294-2632940306-1003\software\microsoft\internet explorer\toolbar\webbrowser\ || {9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (ID = 135102)
7:32 AM: Found Adware: ist sidefind
7:32 AM: HKU\S-1-5-21-4151388396-867582294-2632940306-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778)
7:32 AM: Registry Sweep Complete, Elapsed Time:00:00:18
7:32 AM: Starting Cookie Sweep
7:32 AM: Found Spy Cookie: sandboxer cookie
7:32 AM: owner@0[1].txt (ID = 3282)
7:32 AM: Found Spy Cookie: primaryads cookie
7:32 AM: owner@1.primaryads[2].txt (ID = 3190)
7:32 AM: Found Spy Cookie: 247realmedia cookie
7:32 AM: owner@247realmedia[1].txt (ID = 1953)
7:32 AM: Found Spy Cookie: 2o7.net cookie
7:32 AM: owner@2o7[2].txt (ID = 1957)
7:32 AM: Found Spy Cookie: 888 cookie
7:32 AM: owner@888[1].txt (ID = 2019)
7:32 AM: Found Spy Cookie: websponsors cookie
7:32 AM: owner@a.websponsors[1].txt (ID = 3665)
7:32 AM: Found Spy Cookie: go.com cookie
7:32 AM: owner@abc.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: about cookie
7:32 AM: owner@about[1].txt (ID = 2037)
7:32 AM: Found Spy Cookie: yieldmanager cookie
7:32 AM: owner@ad.yieldmanager[1].txt (ID = 3751)
7:32 AM: Found Spy Cookie: adecn cookie
7:32 AM: owner@adecn[1].txt (ID = 2063)
7:32 AM: owner@adisney.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: adknowledge cookie
7:32 AM: owner@adknowledge[2].txt (ID = 2072)
7:32 AM: Found Spy Cookie: hbmediapro cookie
7:32 AM: owner@adopt.hbmediapro[2].txt (ID = 2768)
7:32 AM: Found Spy Cookie: specificclick.com cookie
7:32 AM: owner@adopt.specificclick[2].txt (ID = 3400)
7:32 AM: Found Spy Cookie: adrevolver cookie
7:32 AM: owner@adrevolver[1].txt (ID = 2088)
7:32 AM: owner@adrevolver[2].txt (ID = 2088)
7:32 AM: Found Spy Cookie: addynamix cookie
7:32 AM: owner@ads.addynamix[2].txt (ID = 2062)
7:32 AM: Found Spy Cookie: ads.adsag cookie
7:32 AM: owner@ads.adsag[1].txt (ID = 2108)
7:32 AM: Found Spy Cookie: cc214142 cookie
7:32 AM: owner@ads.cc214142[2].txt (ID = 2367)
7:32 AM: Found Spy Cookie: pointroll cookie
7:32 AM: owner@ads.pointroll[2].txt (ID = 3148)
7:32 AM: Found Spy Cookie: advertising cookie
7:32 AM: owner@advertising[1].txt (ID = 2175)
7:32 AM: owner@ahollywoodrecords.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: apmebf cookie
7:32 AM: owner@apmebf[1].txt (ID = 2229)
7:32 AM: Found Spy Cookie: falkag cookie
7:32 AM: owner@as-eu.falkag[1].txt (ID = 2650)
7:32 AM: owner@as-us.falkag[1].txt (ID = 2650)
7:32 AM: owner@as1.falkag[2].txt (ID = 2650)
7:32 AM: Found Spy Cookie: ask cookie
7:32 AM: owner@ask[1].txt (ID = 2245)
7:32 AM: Found Spy Cookie: atlas dmt cookie
7:32 AM: owner@atdmt[2].txt (ID = 2253)
7:32 AM: Found Spy Cookie: atwola cookie
7:32 AM: owner@atwola[1].txt (ID = 2255)
7:32 AM: Found Spy Cookie: azjmp cookie
7:32 AM: owner@azjmp[2].txt (ID = 2270)
7:32 AM: Found Spy Cookie: goldenpalace cookie
7:32 AM: owner@banner.goldenpalace[2].txt (ID = 2735)
7:32 AM: Found Spy Cookie: bannerspace cookie
7:32 AM: owner@bannerspace[2].txt (ID = 2284)
7:32 AM: Found Spy Cookie: banner cookie
7:32 AM: owner@banner[1].txt (ID = 2276)
7:32 AM: Found Spy Cookie: belnk cookie
7:32 AM: owner@belnk[1].txt (ID = 2292)
7:32 AM: Found Spy Cookie: bizrate cookie
7:32 AM: owner@bizrate[1].txt (ID = 2308)
7:32 AM: Found Spy Cookie: bluestreak cookie
7:32 AM: owner@bluestreak[2].txt (ID = 2314)
7:32 AM: owner@bookspan.122.2o7[1].txt (ID = 1958)
7:32 AM: Found Spy Cookie: bravenet cookie
7:32 AM: owner@bravenet[1].txt (ID = 2322)
7:32 AM: Found Spy Cookie: bs.serving-sys cookie
7:32 AM: owner@bs.serving-sys[1].txt (ID = 2330)
7:32 AM: owner@buenavistarecords.go[1].txt (ID = 2729)
7:32 AM: owner@buildabear.122.2o7[1].txt (ID = 1958)
7:32 AM: Found Spy Cookie: burstnet cookie
7:32 AM: owner@burstnet[2].txt (ID = 2336)
7:32 AM: Found Spy Cookie: enhance cookie
7:32 AM: owner@c.enhance[1].txt (ID = 2614)
7:32 AM: Found Spy Cookie: goclick cookie
7:32 AM: owner@c.goclick[2].txt (ID = 2733)
7:32 AM: Found Spy Cookie: casalemedia cookie
7:32 AM: owner@casalemedia[1].txt (ID = 2354)
7:32 AM: Found Spy Cookie: ccbill cookie
7:32 AM: owner@ccbill[1].txt (ID = 2369)
7:32 AM: Found Spy Cookie: centrport net cookie
7:32 AM: owner@centrport[2].txt (ID = 2374)
7:32 AM: Found Spy Cookie: classmates cookie
7:32 AM: owner@classmates[2].txt (ID = 2384)
7:32 AM: Found Spy Cookie: clickbank cookie
7:32 AM: owner@clickbank[2].txt (ID = 2398)
7:32 AM: Found Spy Cookie: coolsavings cookie
7:32 AM: owner@coolsavings[2].txt (ID = 2465)
7:32 AM: Found Spy Cookie: sextracker cookie
7:32 AM: owner@counter7.sextracker[2].txt (ID = 3362)
7:32 AM: Found Spy Cookie: clickzs cookie
7:32 AM: owner@cz4.clickzs[1].txt (ID = 2413)
7:32 AM: Found Spy Cookie: overture cookie
7:32 AM: owner@data1.perf.overture[1].txt (ID = 3106)
7:32 AM: owner@data3.perf.overture[1].txt (ID = 3106)
7:32 AM: owner@data4.perf.overture[1].txt (ID = 3106)
7:32 AM: Found Spy Cookie: did-it cookie
7:32 AM: owner@did-it[1].txt (ID = 2523)
7:32 AM: owner@disney.go[1].txt (ID = 2729)
7:32 AM: owner@disneyshopping.go[2].txt (ID = 2729)
7:32 AM: owner@dist.belnk[2].txt (ID = 2293)
7:32 AM: Found Spy Cookie: ru4 cookie
7:32 AM: owner@edge.ru4[2].txt (ID = 3269)
7:32 AM: Found Spy Cookie: engage cookie
7:32 AM: owner@engage.everyone[1].txt (ID = 2611)
7:32 AM: owner@entrepreneur.122.2o7[1].txt (ID = 1958)
7:32 AM: Found Spy Cookie: exitexchange cookie
7:32 AM: owner@exitexchange[2].txt (ID = 2633)
7:32 AM: owner@falkag[1].txt (ID = 2649)
7:32 AM: Found Spy Cookie: fastclick cookie
7:32 AM: owner@fastclick[2].txt (ID = 2651)
7:32 AM: Found Spy Cookie: gamespy cookie
7:32 AM: owner@gamespy[1].txt (ID = 2719)
7:32 AM: owner@global.go[1].txt (ID = 2729)
7:32 AM: owner@goldenpalace[1].txt (ID = 2734)
7:32 AM: owner@go[1].txt (ID = 2728)
7:32 AM: Found Spy Cookie: humanclick cookie
7:32 AM: owner@hc2.humanclick[1].txt (ID = 2810)
7:32 AM: Found Spy Cookie: herfirstanalsex cookie
7:32 AM: owner@herfirstanalsex[1].txt (ID = 2769)
7:32 AM: Found Spy Cookie: clickandtrack cookie
7:32 AM: owner@hits.clickandtrack[2].txt (ID = 2397)
7:32 AM: owner@hollywoodrecords.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: hypertracker.com cookie
7:32 AM: owner@hypertracker[1].txt (ID = 2817)
7:32 AM: Found Spy Cookie: screensavers.com cookie
7:32 AM: owner@i.screensavers[2].txt (ID = 3298)
7:32 AM: Found Spy Cookie: ic-live cookie
7:32 AM: owner@ic-live[1].txt (ID = 2821)
7:32 AM: Found Spy Cookie: maxserving cookie
7:32 AM: owner@maxserving[1].txt (ID = 2966)
7:32 AM: owner@media.fastclick[2].txt (ID = 2652)
7:32 AM: Found Spy Cookie: top-banners cookie
7:32 AM: owner@media.top-banners[1].txt (ID = 3548)
7:32 AM: Found Spy Cookie: mediaplex cookie
7:32 AM: owner@mediaplex[1].txt (ID = 6442)
7:32 AM: Found Spy Cookie: mp3downloadhq cookie
7:32 AM: owner@member.mp3downloadhq[1].txt (ID = 3015)
7:32 AM: owner@mercury.bravenet[2].txt (ID = 2323)
7:32 AM: owner@microsofteup.112.2o7[1].txt (ID = 1958)
7:32 AM: owner@microsoftwga.112.2o7[1].txt (ID = 1958)
7:32 AM: Found Spy Cookie: military cookie
7:32 AM: owner@military[2].txt (ID = 2996)
7:32 AM: owner@mp3downloadhq[1].txt (ID = 3014)
7:32 AM: Found Spy Cookie: aptimus cookie
7:32 AM: owner@network.aptimus[1].txt (ID = 2235)
7:32 AM: Found Spy Cookie: nextag cookie
7:32 AM: owner@nextag[1].txt (ID = 5014)
7:32 AM: owner@overture[2].txt (ID = 3105)
7:32 AM: Found Spy Cookie: partypoker cookie
7:32 AM: owner@partypoker[1].txt (ID = 3111)
7:32 AM: Found Spy Cookie: paycounter cookie
7:32 AM: owner@paycounter[2].txt (ID = 3115)
7:32 AM: Found Spy Cookie: paypopup cookie
7:32 AM: owner@paypopup[2].txt (ID = 3119)
7:32 AM: Found Spy Cookie: freestats.net cookie
7:32 AM: owner@pennypincher.freestats[2].txt (ID = 2705)
7:32 AM: owner@perf.overture[1].txt (ID = 3106)
7:32 AM: Found Spy Cookie: stamps.com cookie
7:32 AM: owner@photo.stamps[1].txt (ID = 3438)
7:32 AM: owner@playhouse.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: pricegrabber cookie
7:32 AM: owner@pricegrabber[1].txt (ID = 3185)
7:32 AM: Found Spy Cookie: pro-market cookie
7:32 AM: owner@pro-market[2].txt (ID = 3197)
7:32 AM: owner@psc.disney.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: qksrv cookie
7:32 AM: owner@qksrv[1].txt (ID = 3213)
7:32 AM: Found Spy Cookie: questionmarket cookie
7:32 AM: owner@questionmarket[1].txt (ID = 3217)
7:32 AM: owner@quiz.disney.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: affiliatefuel.com cookie
7:32 AM: owner@r1.affiliatefuel[2].txt (ID = 2202)
7:32 AM: owner@radio.disney.go[2].txt (ID = 2729)
7:32 AM: Found Spy Cookie: realmedia cookie
7:32 AM: owner@realmedia[2].txt (ID = 3235)
7:32 AM: Found Spy Cookie: valuead cookie
7:32 AM: owner@reduxads.valuead[1].txt (ID = 3627)
7:32 AM: owner@register.go[2].txt (ID = 2729)
7:32 AM: Found Spy Cookie: revenue.net cookie
7:32 AM: owner@revenue[2].txt (ID = 3257)
7:32 AM: Found Spy Cookie: adjuggler cookie
7:32 AM: owner@rotator.adjuggler[2].txt (ID = 2071)
7:32 AM: Found Spy Cookie: adbureau cookie
7:32 AM: owner@sbuilder-s.adbureau[2].txt (ID = 2060)
7:32 AM: owner@sel.as-us.falkag[2].txt (ID = 2650)
7:32 AM: Found Spy Cookie: servedby advertising cookie
7:32 AM: owner@servedby.advertising[1].txt (ID = 3335)
7:32 AM: Found Spy Cookie: server.iad.liveperson cookie
7:32 AM: owner@server.iad.liveperson[1].txt (ID = 3341)
7:32 AM: Found Spy Cookie: serving-sys cookie
7:32 AM: owner@serving-sys[2].txt (ID = 3343)
7:32 AM: owner@sextracker[2].txt (ID = 3361)
7:32 AM: owner@shoplocl.adbureau[2].txt (ID = 2060)
7:32 AM: Found Spy Cookie: spywarestormer cookie
7:32 AM: owner@spywarestormer[1].txt (ID = 3417)
7:32 AM: owner@stamps[2].txt (ID = 3437)
7:32 AM: Found Spy Cookie: dealtime cookie
7:32 AM: owner@stat.dealtime[2].txt (ID = 2506)
7:32 AM: Found Spy Cookie: statcounter cookie
7:32 AM: owner@statcounter[2].txt (ID = 3447)
7:32 AM: Found Spy Cookie: reliablestats cookie
7:32 AM: owner@stats1.reliablestats[1].txt (ID = 3254)
7:32 AM: Found Spy Cookie: stlyrics cookie
7:32 AM: owner@stlyrics[1].txt (ID = 3461)
7:32 AM: Found Spy Cookie: tacoda cookie
7:32 AM: owner@tacoda[1].txt (ID = 6444)
7:32 AM: Found Spy Cookie: tickle cookie
7:32 AM: owner@tickle[1].txt (ID = 3529)
7:32 AM: owner@tokenzone.go[1].txt (ID = 2729)
7:32 AM: Found Spy Cookie: sexsearch cookie
7:32 AM: owner@tour.splash.sexsearch[1].txt (ID = 3358)
7:32 AM: Found Spy Cookie: tradedoubler cookie
7:32 AM: owner@tradedoubler[2].txt (ID = 3575)
7:32 AM: Found Spy Cookie: trafficmp cookie
7:32 AM: owner@trafficmp[2].txt (ID = 3581)
7:32 AM: Found Spy Cookie: tribalfusion cookie
7:32 AM: owner@tribalfusion[1].txt (ID = 3589)
7:32 AM: Found Spy Cookie: tripod cookie
7:32 AM: owner@tripod[1].txt (ID = 3591)
7:32 AM: Found Spy Cookie: videodome cookie
7:32 AM: owner@videodome[1].txt (ID = 3638)
7:32 AM: Found Spy Cookie: realtracker cookie
7:32 AM: owner@web4.realtracker[2].txt (ID = 3242)
7:32 AM: Found Spy Cookie: webpower cookie
7:32 AM: owner@webpower[2].txt (ID = 3660)
7:32 AM: owner@www.888[1].txt (ID = 2020)
7:32 AM: Found Spy Cookie: burstbeacon cookie
7:32 AM: owner@www.burstbeacon[2].txt (ID = 2335)
7:32 AM: owner@www.falkag[2].txt (ID = 2650)
7:32 AM: owner@www.goldenpalace[1].txt (ID = 2735)
7:32 AM: Found Spy Cookie: mp3s hits cookie
7:32 AM: owner@www.mp3shits[1].txt (ID = 3019)
7:32 AM: Found Spy Cookie: myaffiliateprogram.com cookie
7:32 AM: owner@www.myaffiliateprogram[1].txt (ID = 3032)
7:32 AM: Found Spy Cookie: redzip cookie
7:32 AM: owner@www.redzip[1].txt (ID = 3250)
7:32 AM: owner@www.screensavers[2].txt (ID = 3298)
7:32 AM: owner@www.stamps[1].txt (ID = 3438)
7:32 AM: owner@www.stlyrics[1].txt (ID = 3462)
7:32 AM: Found Spy Cookie: upspiral cookie
7:32 AM: owner@www.upspiral[1].txt (ID = 3615)
7:32 AM: Found Spy Cookie: wirefly cookie
7:32 AM: owner@www.wirefly[2].txt (ID = 3694)
7:32 AM: owner@yieldmanager[2].txt (ID = 3749)
7:32 AM: Found Spy Cookie: adserver cookie
7:32 AM: owner@z1.adserver[1].txt (ID = 2142)
7:32 AM: Found Spy Cookie: zenotecnico cookie
7:32 AM: owner@zenotecnico[2].txt (ID = 3858)
7:32 AM: Cookie Sweep Complete, Elapsed Time: 00:00:06
7:32 AM: Starting File Sweep
7:32 AM: Found Adware: apropos
7:32 AM: c:\documents and settings\owner\local settings\temp\~compoundinst0 (1 subtraces) (ID = -2147481413)
7:32 AM: c:\documents and settings\owner\application data\psguard.com (11 subtraces) (ID = -2147480442)
7:32 AM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
7:35 AM: uninst.exe (ID = 73428)
7:35 AM: preuninstallql.exe (ID = 131326)
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:37 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:38 AM: ag[1].exe (ID = 254879)
7:40 AM: e9b15.tmp (ID = 153752)
7:41 AM: wkfli.exe (ID = 268934)
7:41 AM: qrdsregj.exe (ID = 293)
7:41 AM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || {74-48-88-80-ZN} (ID = 0)
7:41 AM: dwdsregt.exe (ID = 235995)
7:41 AM: mediaview[1].cab (ID = 187158)
7:41 AM: elite.ocx (ID = 187157)
7:41 AM: elite.inf (ID = 187156)
7:41 AM: justin2[1].exe (ID = 247604)
7:41 AM: justin2.exe (ID = 247604)
7:41 AM: gbnhih.exe (ID = 268995)
7:41 AM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || fsryif (ID = 0)
7:41 AM: HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Run || cpyaj (ID = 0)
7:41 AM: yjaio.exe (ID = 268995)
7:41 AM: lydkt.dat (ID = 268995)
7:41 AM: hglpsms.exe (ID = 268932)
7:41 AM: minhype.dll (ID = 268933)
7:41 AM: zifi002[1].exe (ID = 235993)
7:41 AM: unwn.exe (ID = 268798)
7:41 AM: 876057[1].exe (ID = 185463)
7:41 AM: 876057.exe (ID = 185463)
7:41 AM: winnb57.dll (ID = 185460)
7:41 AM: windmy.dll (ID = 70014)
7:41 AM: yoinsi[1].exe (ID = 213483)
7:41 AM: yoinsi.exe (ID = 213483)
7:41 AM: eliteunstall[1].exe (ID = 244416)
7:41 AM: eliteunstall.exe (ID = 244416)
7:41 AM: elitemediagroupoinuninstaller.exe (ID = 213484)
7:41 AM: winats[1].cab (ID = 208237)
7:41 AM: winats.dll (ID = 208226)
7:41 AM: yjaio.execommon startup (ID = 268995)
7:41 AM: wkfli.exe.tmp (ID = 268934)
7:41 AM: nt68rrtc12.sys (ID = 220230)
7:43 AM: msnav32.ax (ID = 220229)
7:43 AM: zeno.lnk (ID = 146127)
7:43 AM: winats.inf (ID = 208224)
7:44 AM: File Sweep Complete, Elapsed Time: 00:11:49
7:44 AM: Full Sweep has completed. Elapsed time 00:14:39
7:44 AM: Traces Found: 805
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:45 AM: Removal process initiated
7:46 AM: Quarantining All Traces: clkoptimizer
7:46 AM: clkoptimizer is in use. It will be removed on reboot.
7:46 AM: gbnhih.exe is in use. It will be removed on reboot.
7:46 AM: yjaio.exe is in use. It will be removed on reboot.
7:46 AM: minhype.dll is in use. It will be removed on reboot.
7:46 AM: C:\WINDOWS\system32\minhype.dll is in use. It will be removed on reboot.
7:46 AM: C:\WINDOWS\system32\gbnhih.exe is in use. It will be removed on reboot.
7:46 AM: Quarantining All Traces: purityscan
7:46 AM: Quarantining All Traces: apropos
7:46 AM: Quarantining All Traces: azsearch toolbar
7:46 AM: Quarantining All Traces: internetoptimizer
7:46 AM: Quarantining All Traces: quicklink search toolbar
7:46 AM: Quarantining All Traces: elitemediagroup-pop64
7:46 AM: Quarantining All Traces: ezula ilookup
7:46 AM: Quarantining All Traces: ist sidefind
7:46 AM: Quarantining All Traces: ist software
7:46 AM: Quarantining All Traces: ist yoursitebar
7:46 AM: Quarantining All Traces: mirar webband
7:46 AM: mirar webband is in use. It will be removed on reboot.
7:46 AM: winnb57.dll is in use. It will be removed on reboot.
7:46 AM: Quarantining All Traces: moneytree
7:46 AM: Quarantining All Traces: psguard
7:46 AM: Quarantining All Traces: zenosearchassistant
7:46 AM: zenosearchassistant is in use. It will be removed on reboot.
7:46 AM: qrdsregj.exe is in use. It will be removed on reboot.
7:46 AM: Quarantining All Traces: 247realmedia cookie
7:46 AM: Quarantining All Traces: 2o7.net cookie
7:46 AM: Quarantining All Traces: 888 cookie
7:46 AM: Quarantining All Traces: about cookie
7:46 AM: Quarantining All Traces: adbureau cookie
7:46 AM: Quarantining All Traces: addynamix cookie
7:46 AM: Quarantining All Traces: adecn cookie
7:46 AM: Quarantining All Traces: adjuggler cookie
7:46 AM: Quarantining All Traces: adknowledge cookie
7:46 AM: Quarantining All Traces: adrevolver cookie
7:46 AM: Quarantining All Traces: ads.adsag cookie
7:46 AM: Quarantining All Traces: adserver cookie
7:46 AM: Quarantining All Traces: advertising cookie
7:46 AM: Quarantining All Traces: affiliatefuel.com cookie
7:46 AM: Quarantining All Traces: apmebf cookie
7:46 AM: Quarantining All Traces: aptimus cookie
7:46 AM: Quarantining All Traces: ask cookie
7:46 AM: Quarantining All Traces: atlas dmt cookie
7:46 AM: Quarantining All Traces: atwola cookie
7:46 AM: Quarantining All Traces: azjmp cookie
7:46 AM: Quarantining All Traces: banner cookie
7:46 AM: Quarantining All Traces: bannerspace cookie
7:46 AM: Quarantining All Traces: belnk cookie
7:46 AM: Quarantining All Traces: bizrate cookie
7:46 AM: Quarantining All Traces: bluestreak cookie
7:46 AM: Quarantining All Traces: bravenet cookie
7:46 AM: Quarantining All Traces: bs.serving-sys cookie
7:46 AM: Quarantining All Traces: burstbeacon cookie
7:46 AM: Quarantining All Traces: burstnet cookie
7:46 AM: Quarantining All Traces: casalemedia cookie
7:46 AM: Quarantining All Traces: cc214142 cookie
7:46 AM: Quarantining All Traces: ccbill cookie
7:46 AM: Quarantining All Traces: centrport net cookie
7:46 AM: Quarantining All Traces: classmates cookie
7:46 AM: Quarantining All Traces: clickandtrack cookie
7:46 AM: Quarantining All Traces: clickbank cookie
7:46 AM: Quarantining All Traces: clickzs cookie
7:46 AM: Quarantining All Traces: coolsavings cookie
7:46 AM: Quarantining All Traces: dealtime cookie
7:46 AM: Quarantining All Traces: did-it cookie
7:46 AM: Quarantining All Traces: engage cookie
7:46 AM: Quarantining All Traces: enhance cookie
7:46 AM: Quarantining All Traces: exitexchange cookie
7:46 AM: Quarantining All Traces: falkag cookie
7:46 AM: Quarantining All Traces: fastclick cookie
7:46 AM: Quarantining All Traces: freestats.net cookie
7:46 AM: Quarantining All Traces: gamespy cookie
7:46 AM: Quarantining All Traces: go.com cookie
7:46 AM: Quarantining All Traces: goclick cookie
7:46 AM: Quarantining All Traces: goldenpalace cookie
7:46 AM: Quarantining All Traces: hbmediapro cookie
7:46 AM: Quarantining All Traces: herfirstanalsex cookie
7:46 AM: Quarantining All Traces: humanclick cookie
7:46 AM: Quarantining All Traces: hypertracker.com cookie
7:46 AM: Quarantining All Traces: ic-live cookie
7:46 AM: Quarantining All Traces: maxserving cookie
7:46 AM: Quarantining All Traces: mediaplex cookie
7:46 AM: Quarantining All Traces: military cookie
7:46 AM: Quarantining All Traces: mp3downloadhq cookie
7:46 AM: Quarantining All Traces: mp3s hits cookie
7:46 AM: Quarantining All Traces: myaffiliateprogram.com cookie
7:46 AM: Quarantining All Traces: nextag cookie
7:46 AM: Quarantining All Traces: overture cookie
7:46 AM: Quarantining All Traces: partypoker cookie
7:46 AM: Quarantining All Traces: paycounter cookie
7:46 AM: Quarantining All Traces: paypopup cookie
7:46 AM: Quarantining All Traces: pointroll cookie
7:46 AM: Quarantining All Traces: pricegrabber cookie
7:46 AM: Quarantining All Traces: primaryads cookie
7:46 AM: Quarantining All Traces: pro-market cookie
7:46 AM: Quarantining All Traces: qksrv cookie
7:46 AM: Quarantining All Traces: questionmarket cookie
7:46 AM: Quarantining All Traces: realmedia cookie
7:46 AM: Quarantining All Traces: realtracker cookie
7:46 AM: Quarantining All Traces: redzip cookie
7:46 AM: Quarantining All Traces: reliablestats cookie
7:46 AM: Quarantining All Traces: revenue.net cookie
7:46 AM: Quarantining All Traces: ru4 cookie
7:46 AM: Quarantining All Traces: sandboxer cookie
7:46 AM: Quarantining All Traces: screensavers.com cookie
7:46 AM: Quarantining All Traces: servedby advertising cookie
7:46 AM: Quarantining All Traces: server.iad.liveperson cookie
7:46 AM: Quarantining All Traces: serving-sys cookie
7:46 AM: Quarantining All Traces: sexsearch cookie
7:46 AM: Quarantining All Traces: sextracker cookie
7:46 AM: Quarantining All Traces: specificclick.com cookie
7:46 AM: Quarantining All Traces: spywarestormer cookie
7:46 AM: Quarantining All Traces: stamps.com cookie
7:46 AM: Quarantining All Traces: statcounter cookie
7:46 AM: Quarantining All Traces: stlyrics cookie
7:46 AM: Quarantining All Traces: tacoda cookie
7:46 AM: Quarantining All Traces: tickle cookie
7:46 AM: Quarantining All Traces: top-banners cookie
7:46 AM: Quarantining All Traces: tradedoubler cookie
7:46 AM: Quarantining All Traces: trafficmp cookie
7:46 AM: Quarantining All Traces: tribalfusion cookie
7:46 AM: Quarantining All Traces: tripod cookie
7:46 AM: Quarantining All Traces: upspiral cookie
7:46 AM: Quarantining All Traces: valuead cookie
7:46 AM: Quarantining All Traces: videodome cookie
7:46 AM: Quarantining All Traces: webpower cookie
7:46 AM: Quarantining All Traces: websponsors cookie
7:46 AM: Quarantining All Traces: wirefly cookie
7:46 AM: Quarantining All Traces: yieldmanager cookie
7:46 AM: Quarantining All Traces: zenotecnico cookie
7:47 AM: Preparing to restart your computer. Please wait...
7:47 AM: Removal process completed. Elapsed time 00:01:32
********
7:26 AM: | Start of Session, Friday, March 24, 2006 |
7:26 AM: Spy Sweeper started
7:27 AM: Your spyware definitions have been updated.
7:29 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:29 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:29 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:29 AM: The Spy Communication shield has blocked access to: dl.web-nexus.net
7:30 AM: | End of Session, Friday, March 24, 2006 |
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 8:31:18 AM, 3/24/2006
+ Report-Checksum: 7897FEF3
+ Scan result:
HKLM\SOFTWARE\PSGuard.com -> Adware.PSGuard : Error during cleaning
HKLM\SOFTWARE\PSGuard.com\PSGuard -> Adware.PSGuard : Error during cleaning
HKLM\SOFTWARE\PSGuard.com\PSGuard\P.S.Guard -> Adware.PSGuard : Error during cleaning
HKLM\SOFTWARE\PSGuard.com\PSGuard\P.S.Guard\License -> Adware.PSGuard : Cleaned with backup
HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01EB5130-FC0C-4D75-B9CE-4801B1B854F5} -> Adware.Begin2Search : Cleaned with backup
HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} -> Adware.LinkMaker : Cleaned with backup
HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A19EF336-01D4-48E6-926A-FE7E1C747AED} -> Adware.MWSearch : Cleaned with backup
HKU\S-1-5-21-4151388396-867582294-2632940306-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DA7FF3F8-08BE-4CAC-BC00-94D91C6AE7F4} -> Adware.MWSearch : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@citi.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@cs.sexcounter[1].txt -> TrackingCookie.Sexcounter : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfk4olazekq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfk4qgdpiho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfk4ulc5kho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkicjazcep.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkiggdpago.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkikhajcfp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkogldjcap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkoqkdjmfq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkospajsfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkoujajggo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkoujc5kfo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkounczgko.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkygncjsgq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkykmcjshp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkyokazefp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkyonazwgo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfkyujajwfp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfl4chajwkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfl4oicjakq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfl4uiazskp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfligpd5aho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wflikhajmlp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wflispdpeko.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfliwhd5ico.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfliwnazcgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfliwoc5meq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wflykldjcbo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmianc5kgq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmisldjego.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmismczcbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmygocjoeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmykldjkbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmyqmdpmhp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wfmyslcjceo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgkikpcjmhp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgkowhdjghp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgkyamdzsdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgkygiajcbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgkykgdzwao.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgl4unajslo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wgmyahdjcdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjk4cld5kao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjk4gkdzkkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjk4gnczsep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkoagazilp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkoalczoko.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkocgcjiko.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkoklcpmbq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkoopazsao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkoslajsdo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkosncjmkq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkychdpkap.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkyekcjsfp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkyknc5wdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkyoiazibp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjkyoicjilo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4kgajskp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4qmczcdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4skcjmgp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4soc5mfo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4spazsho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjl4umd5oco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjliencjmgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjligkdzoap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlioidpcko.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlioldzkeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlionazafo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlocidpkbq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlocpc5ibo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloejcjobp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloekdzggp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloemcpgao.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlogkazaap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlookcpcco.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloomcjebp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloqidjcdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjloqpc5gep.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlosgdjelp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlyeoazwgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlyklc5mao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlykodpmap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlyolazkkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlysgdjkho.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjlysmdpgaq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmiemd5glo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmigoczeho.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmikkdzsgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmyancjkgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmycgdjchp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmygmd5gao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmygmd5seo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjmywgc5wdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjny-1jc5id.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjny-1kajak.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjny-1mazil.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjny-1nc5sk.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjny-1odjwa.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnycld5ico.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnycndzoho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyelazoeq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyeld5gbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnygjczalo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnygldpikp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnygnczsdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyohazgbp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyoiazelp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyoodpsfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyqidjgeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnysgajiho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnysid5ikp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnysldjmlq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@e-2dj6wjnyuhdpkfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ehg-attworldnet.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@eztracks.aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@sec1.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@www.directnetadvertising[2].txt -> TrackingCookie.Directnetadvertising : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\G1IN4TUF\bu7dyo4f[1].exe -> Downloader.Small.afi : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OPYBCDI3\installer_2512[1].exe -> Downloader.Qoologic.at : Cleaned with backup
C:\WINDOWS\bu7dyo4f.exe -> Downloader.Small.afi : Cleaned with backup
C:\WINDOWS\system32\kzvegfyn.kkn -> Hijacker.Small.js : Cleaned with backup
C:\WINDOWS\system32\lwinsrag.exe -> Adware.ZenoSearch : Cleaned with backup
::Report EndLogfile of HijackThis v1.99.1
Scan saved at 8:34:05 AM, on 3/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\SPYWARE\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Owner\My Documents\SPYWARE\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://dslstart.verizon.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.att.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,hglpsms.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: web compressor - {23FB5ADD-DA37-4a40-9FC0-B0E2384CDE92} - C:\WINDOWS\system32\nst10.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared