7 replies to this topic

[jedodes]

Hi guys,

I'm having three main problems:

1) On startup, it takes several minutes to be able to start opening applications.
2) Outlook takes especially long to fully launch and send/receive--often several minutes.
3) When using IE (which I try not to do anymore), I'm getting all sort of random popups saying things like "Your computer has been infected with the BLACKWORM [or other names] virus," and then an Explorer window for a spyware website, often with the "do you give permission to download" or whatever box.

Please can someone help??!

Thanks,
Josh

Logfile of HijackThis v1.99.1
Scan saved at 7:19:24 PM, on 4/13/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\windows\System32\DeltTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\windows\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\EarthLink\spamBlocker\ELSBLaunch.exe
C:\Program Files\Handspring\HOTSYNC.EXE
C:\windows\System32\devldr32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\System32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Documents and Settings\Josh Dodes\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O1 - Hosts: 17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A} - blank (file missing)
O2 - BHO: IeCaptureBho Object - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: WTLHelper Object - {BD6CD737-34E1-4864-8697-83EC081F1989} - C:\windows\System32\pmnlj.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: CBHO Object - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Program Files\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Program Files\CoreStreet\SpoofStick\SpoofStick.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [qs3h36j] lfw8dmoe.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
O4 - HKCU\..\Run: [Cydoor] CD_Load.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Microsoft Works Update Detection] \WkDetect.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: ELSBLaunch.lnk = C:\Program Files\EarthLink\spamBlocker\ELSBLaunch.exe
O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {97AFC0D9-660E-4ACE-B025-46FD64AE335A} (EmailImport.EmailImportControl) - http://www.friendste...emailimport.cab
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.c...ient402/kdx.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: pmkjj - C:\windows\
O20 - Winlogon Notify: pmnlj - C:\windows\System32\pmnlj.dll
O20 - Winlogon Notify: utilmain - C:\windows\
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[LDTate]

Hello jedodes, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[jedodes]

Thanks so much for your advice--I truly appreciate it. I downloaded Spybot, followed all instructions, etc., no problem. However, after I downloaded and configured Ad-Aware and actually got to the part where I ran the scan, the scan itself started and after 4-5 seconds, it crashed my computer completely. This happened three separate times, even when no other windows were open, etc. Do you have any idea why that might happen and whether there is some other sort of solution? Alas, Spybot does not appear to have significantly affected my issues by itself. Thanks, Josh

[LDTate]

It appears your system is badly infected. Move on and do the Spy Sweeper scan.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[jedodes]

Okay, here's the SpySweeper session log, followed by the new Hijack This log. I really appreciate your help. ******** 12:07 PM: | Start of Session, Friday, April 14, 2006 | 12:07 PM: Spy Sweeper started 12:07 PM: Sweep initiated using definitions version 657 12:07 PM: Found Adware: virtumonde 12:07 PM: HKCR\clsid\{bd6cd737-34e1-4864-8697-83ec081f1989}\inprocserver32\ (2 subtraces) (ID = 1224043) 12:07 PM: pmnlj.dll (ID = 1224043) 12:07 PM: Starting Memory Sweep 12:09 PM: Detected running threat: C:\WINDOWS\system32\pmnlj.dll (ID = 77) 12:11 PM: Memory Sweep Complete, Elapsed Time: 00:03:21 12:11 PM: Starting Registry Sweep 12:11 PM: Found Adware: alfa cleaner 12:11 PM: HKLM\software\microsoft\windows\currentversion\run\ || alfacleaner (ID = 1141312) 12:11 PM: HKCR\wtlhelper.wtlhelper\ (5 subtraces) (ID = 1188431) 12:11 PM: HKCR\wtlhelper.wtlhelper.1\ (3 subtraces) (ID = 1188437) 12:11 PM: HKLM\software\classes\wtlhelper.wtlhelper\ (5 subtraces) (ID = 1188454) 12:11 PM: HKLM\software\classes\wtlhelper.wtlhelper.1\ (3 subtraces) (ID = 1188460) 12:11 PM: HKCR\clsid\{bd6cd737-34e1-4864-8697-83ec081f1989}\ (12 subtraces) (ID = 1218921) 12:11 PM: HKLM\software\classes\clsid\{bd6cd737-34e1-4864-8697-83ec081f1989}\ (12 subtraces) (ID = 1218934) 12:11 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{bd6cd737-34e1-4864-8697-83ec081f1989}\ (ID = 1224044) 12:11 PM: Registry Sweep Complete, Elapsed Time:00:00:21 12:11 PM: Starting Cookie Sweep 12:11 PM: Found Spy Cookie: atlas dmt cookie 12:11 PM: donna freitas@atdmt[1].txt (ID = 2253) 12:11 PM: Found Spy Cookie: 2o7.net cookie 12:11 PM: donna freitas@msnportal.112.2o7[1].txt (ID = 1958) 12:11 PM: donna freitas@2o7[1].txt (ID = 1957) 12:11 PM: Found Spy Cookie: atwola cookie 12:11 PM: donna freitas@atwola[1].txt (ID = 2255) 12:11 PM: Found Spy Cookie: reliablestats cookie 12:11 PM: donna freitas@stats1.reliablestats[2].txt (ID = 3254) 12:11 PM: Found Spy Cookie: adultfriendfinder cookie 12:11 PM: donna freitas@adultfriendfinder[2].txt (ID = 2165) 12:11 PM: Found Spy Cookie: burstbeacon cookie 12:11 PM: donna freitas@www.burstbeacon[2].txt (ID = 2335) 12:11 PM: Found Spy Cookie: nextag cookie 12:11 PM: donna freitas@nextag[1].txt (ID = 5014) 12:11 PM: Found Spy Cookie: banners cookie 12:11 PM: josh dodes@banners[2].txt (ID = 2282) 12:11 PM: josh dodes@nextag[1].txt (ID = 5014) 12:11 PM: Found Spy Cookie: partypoker cookie 12:11 PM: josh dodes@partypoker[2].txt (ID = 3111) 12:11 PM: Found Spy Cookie: rambler cookie 12:11 PM: josh dodes@rambler[1].txt (ID = 3225) 12:11 PM: josh dodes@2o7[1].txt (ID = 1957) 12:11 PM: Found Spy Cookie: eadexchange cookie 12:11 PM: josh dodes@www.eadexchange[2].txt (ID = 2556) 12:11 PM: Found Spy Cookie: stlyrics cookie 12:11 PM: josh dodes@stlyrics[1].txt (ID = 3461) 12:11 PM: josh dodes@nextag[2].txt (ID = 5014) 12:11 PM: josh dodes@www.stlyrics[1].txt (ID = 3462) 12:11 PM: josh dodes@cnn.122.2o7[1].txt (ID = 1958) 12:11 PM: Found Spy Cookie: banner cookie 12:11 PM: josh dodes@banner[2].txt (ID = 2276) 12:11 PM: Found Spy Cookie: passion cookie 12:11 PM: josh dodes@passion[1].txt (ID = 3113) 12:11 PM: Found Spy Cookie: apmebf cookie 12:11 PM: josh dodes@apmebf[2].txt (ID = 2229) 12:11 PM: Found Spy Cookie: infospace cookie 12:11 PM: josh dodes@infospace[2].txt (ID = 2865) 12:11 PM: Found Spy Cookie: did-it cookie 12:11 PM: josh dodes@did-it[2].txt (ID = 2523) 12:11 PM: Found Spy Cookie: cc214142 cookie 12:11 PM: josh dodes@ads.cc214142[2].txt (ID = 2367) 12:11 PM: Found Spy Cookie: servlet cookie 12:11 PM: josh dodes@servlet[1].txt (ID = 3345) 12:11 PM: Found Spy Cookie: pub cookie 12:11 PM: josh dodes@pub[1].txt (ID = 3205) 12:11 PM: josh dodes@nextag[4].txt (ID = 5014) 12:11 PM: Found Spy Cookie: touchclarity cookie 12:11 PM: josh dodes@partypoker.touchclarity[2].txt (ID = 3567) 12:11 PM: josh dodes@www.burstbeacon[2].txt (ID = 2335) 12:11 PM: Found Spy Cookie: belnk cookie 12:11 PM: josh dodes@ath.belnk[1].txt (ID = 2293) 12:11 PM: Found Spy Cookie: customer cookie 12:11 PM: josh dodes@customer[1].txt (ID = 2481) 12:11 PM: Found Spy Cookie: yieldmanager cookie 12:11 PM: josh dodes@ad.yieldmanager[2].txt (ID = 3751) 12:11 PM: Found Spy Cookie: adjuggler cookie 12:11 PM: josh dodes@rotator.adjuggler[2].txt (ID = 2071) 12:11 PM: Found Spy Cookie: websponsors cookie 12:11 PM: josh dodes@a.websponsors[2].txt (ID = 3665) 12:11 PM: Found Spy Cookie: kmpads cookie 12:11 PM: josh dodes@kmpads[2].txt (ID = 2909) 12:11 PM: Found Spy Cookie: enhance cookie 12:11 PM: josh dodes@c.enhance[2].txt (ID = 2614) 12:11 PM: josh dodes@stats1.reliablestats[4].txt (ID = 3254) 12:11 PM: Found Spy Cookie: tacoda cookie 12:11 PM: josh dodes@tacoda[2].txt (ID = 6444) 12:11 PM: Found Spy Cookie: azjmp cookie 12:11 PM: josh dodes@azjmp[2].txt (ID = 2270) 12:11 PM: Found Spy Cookie: web-stat cookie 12:11 PM: josh dodes@www.web-stat[1].txt (ID = 3649) 12:11 PM: Found Spy Cookie: starpulse cookie 12:11 PM: josh dodes@www.starpulse[2].txt (ID = 3440) 12:11 PM: josh dodes@stats1.reliablestats[1].txt (ID = 3254) 12:11 PM: josh dodes@belnk[1].txt (ID = 2292) 12:11 PM: josh dodes@dist.belnk[1].txt (ID = 2293) 12:11 PM: Found Spy Cookie: trafficmp cookie 12:11 PM: josh dodes@trafficmp[1].txt (ID = 3581) 12:11 PM: josh dodes@apmebf[3].txt (ID = 2229) 12:11 PM: josh dodes@adultfriendfinder[1].txt (ID = 2165) 12:11 PM: Found Spy Cookie: fastclick cookie 12:11 PM: josh dodes@fastclick[2].txt (ID = 2651) 12:11 PM: josh dodes@infospace[3].txt (ID = 2865) 12:11 PM: Found Spy Cookie: 360i cookie 12:11 PM: josh dodes@ct.360i[1].txt (ID = 1962) 12:11 PM: Found Spy Cookie: xiti cookie 12:11 PM: josh dodes@xiti[1].txt (ID = 3717) 12:11 PM: josh dodes@customer[2].txt (ID = 2481) 12:11 PM: Found Spy Cookie: 888 cookie 12:11 PM: josh dodes@www.888[1].txt (ID = 2020) 12:11 PM: josh dodes@888[2].txt (ID = 2019) 12:11 PM: josh dodes@888[1].txt (ID = 2019) 12:11 PM: josh dodes@belnk[3].txt (ID = 2292) 12:11 PM: Found Spy Cookie: cassava cookie 12:11 PM: josh dodes@cassava[1].txt (ID = 2362) 12:11 PM: Found Spy Cookie: go.com cookie 12:11 PM: josh dodes@espn.go[1].txt (ID = 2729) 12:11 PM: josh dodes@partypoker[1].txt (ID = 3111) 12:11 PM: Found Spy Cookie: videodome cookie 12:11 PM: josh dodes@videodome[1].txt (ID = 3638) 12:11 PM: josh dodes@go[2].txt (ID = 2728) 12:11 PM: josh dodes@partygaming.122.2o7[1].txt (ID = 1958) 12:11 PM: josh dodes@rsi.espn.go[1].txt (ID = 2729) 12:11 PM: josh dodes@ath.belnk[3].txt (ID = 2293) 12:11 PM: josh dodes@server3.web-stat[2].txt (ID = 3649) 12:11 PM: Found Spy Cookie: advertising cookie 12:11 PM: josh dodes@advertising[1].txt (ID = 2175) 12:11 PM: josh dodes@sports.espn.go[2].txt (ID = 2729) 12:11 PM: Found Spy Cookie: bravenet cookie 12:11 PM: josh dodes@bravenet[1].txt (ID = 2322) 12:11 PM: Found Spy Cookie: adrevolver cookie 12:11 PM: josh dodes@adrevolver[2].txt (ID = 2088) 12:11 PM: josh dodes@adrevolver[3].txt (ID = 2088) 12:11 PM: Found Spy Cookie: revenue.net cookie 12:11 PM: josh dodes@revenue[1].txt (ID = 3257) 12:11 PM: josh dodes@banners[1].txt (ID = 2282) 12:11 PM: Found Spy Cookie: bannerspace cookie 12:11 PM: josh dodes@bannerspace[1].txt (ID = 2284) 12:11 PM: Found Spy Cookie: adreactor cookie 12:11 PM: josh dodes@adserver.adreactor[1].txt (ID = 2087) 12:11 PM: Found Spy Cookie: realmedia cookie 12:11 PM: josh dodes@realmedia[2].txt (ID = 3235) 12:11 PM: josh dodes@2o7[2].txt (ID = 1957) 12:11 PM: Found Spy Cookie: falkag cookie 12:11 PM: josh dodes@as-us.falkag[1].txt (ID = 2650) 12:11 PM: Found Spy Cookie: adtech cookie 12:11 PM: josh dodes@adtech[2].txt (ID = 2155) 12:11 PM: josh dodes@stats1.reliablestats[3].txt (ID = 3254) 12:11 PM: Found Spy Cookie: adserver cookie 12:11 PM: josh dodes@z1.adserver[1].txt (ID = 2142) 12:11 PM: Found Spy Cookie: hermoment.com cookie 12:11 PM: josh dodes@www.hermoment[1].txt (ID = 2774) 12:11 PM: josh dodes@atwola[1].txt (ID = 2255) 12:11 PM: Found Spy Cookie: directtrack cookie 12:11 PM: josh dodes@sideshow.directtrack[1].txt (ID = 2528) 12:11 PM: Found Spy Cookie: ru4 cookie 12:11 PM: josh dodes@edge.ru4[2].txt (ID = 3269) 12:11 PM: josh dodes@adrevolver[1].txt (ID = 2088) 12:11 PM: josh dodes@ad.yieldmanager[1].txt (ID = 3751) 12:11 PM: josh dodes@a.websponsors[3].txt (ID = 3665) 12:11 PM: josh dodes@ford.touchclarity[1].txt (ID = 3566) 12:11 PM: josh dodes@directtrack[1].txt (ID = 2527) 12:11 PM: josh dodes@tacoda[3].txt (ID = 6444) 12:11 PM: Found Spy Cookie: a cookie 12:11 PM: josh dodes@a[1].txt (ID = 2027) 12:11 PM: Found Spy Cookie: zedo cookie 12:11 PM: josh dodes@zedo[2].txt (ID = 3762) 12:11 PM: josh dodes@rotator.adjuggler[1].txt (ID = 2071) 12:11 PM: josh dodes@ads.cc214142[3].txt (ID = 2367) 12:11 PM: josh dodes@yieldmanager[2].txt (ID = 3749) 12:11 PM: josh dodes@msnportal.112.2o7[1].txt (ID = 1958) 12:11 PM: Found Spy Cookie: webpower cookie 12:11 PM: josh dodes@webpower[1].txt (ID = 3660) 12:11 PM: Found Spy Cookie: questionmarket cookie 12:11 PM: josh dodes@questionmarket[1].txt (ID = 3217) 12:11 PM: Found Spy Cookie: wegcash cookie 12:11 PM: josh dodes@clickthrough.wegcash[2].txt (ID = 3682) 12:11 PM: josh dodes@advertising[2].txt (ID = 2175) 12:11 PM: josh dodes@free.wegcash[1].txt (ID = 3682) 12:11 PM: Found Spy Cookie: ic-live cookie 12:11 PM: josh dodes@ic-live[1].txt (ID = 2821) 12:11 PM: Found Spy Cookie: specificclick.com cookie 12:11 PM: josh dodes@adopt.specificclick[2].txt (ID = 3400) 12:11 PM: josh dodes@banner[3].txt (ID = 2276) 12:11 PM: Found Spy Cookie: serving-sys cookie 12:11 PM: josh dodes@serving-sys[2].txt (ID = 3343) 12:11 PM: josh dodes@trafficmp[2].txt (ID = 3581) 12:11 PM: josh dodes@tacoda[1].txt (ID = 6444) 12:11 PM: Found Spy Cookie: overture cookie 12:11 PM: josh dodes@perf.overture[1].txt (ID = 3106) 12:11 PM: Found Spy Cookie: adecn cookie 12:11 PM: josh dodes@adecn[2].txt (ID = 2063) 12:11 PM: Found Spy Cookie: casalemedia cookie 12:11 PM: josh dodes@casalemedia[1].txt (ID = 2354) 12:11 PM: Found Spy Cookie: tribalfusion cookie 12:11 PM: josh dodes@tribalfusion[1].txt (ID = 3589) 12:11 PM: Found Spy Cookie: pointroll cookie 12:11 PM: josh dodes@ads.pointroll[2].txt (ID = 3148) 12:11 PM: josh dodes@dist.belnk[2].txt (ID = 2293) 12:11 PM: josh dodes@revenuegateway.directtrack[2].txt (ID = 2528) 12:11 PM: Found Spy Cookie: primaryads cookie 12:11 PM: josh dodes@aff.primaryads[2].txt (ID = 3190) 12:11 PM: Found Spy Cookie: winantiviruspro cookie 12:11 PM: josh dodes@www.winantiviruspro[2].txt (ID = 3690) 12:11 PM: Found Spy Cookie: clickandtrack cookie 12:11 PM: josh dodes@hits.clickandtrack[2].txt (ID = 2397) 12:11 PM: josh dodes@adultfriendfinder[3].txt (ID = 2165) 12:11 PM: Found Spy Cookie: addynamix cookie 12:11 PM: josh dodes@ads.addynamix[2].txt (ID = 2062) 12:11 PM: Found Spy Cookie: coolsavings cookie 12:11 PM: josh dodes@coolsavings[1].txt (ID = 2465) 12:11 PM: josh dodes@adultfriendfinder[4].txt (ID = 2165) 12:11 PM: josh dodes@kmpads[3].txt (ID = 2909) 12:11 PM: josh dodes@tribalfusion[2].txt (ID = 3589) 12:11 PM: Found Spy Cookie: maxserving cookie 12:11 PM: josh dodes@maxserving[1].txt (ID = 2966) 12:11 PM: josh dodes@as-us.falkag[2].txt (ID = 2650) 12:11 PM: josh dodes@ad.yieldmanager[4].txt (ID = 3751) 12:11 PM: josh dodes@as.casalemedia[1].txt (ID = 2355) 12:11 PM: Found Spy Cookie: askmen cookie 12:11 PM: josh dodes@askmen[2].txt (ID = 2247) 12:11 PM: josh dodes@did-it[3].txt (ID = 2523) 12:11 PM: josh dodes@ads.addynamix[3].txt (ID = 2062) 12:11 PM: josh dodes@c5.zedo[1].txt (ID = 3763) 12:11 PM: Found Spy Cookie: angelfire cookie 12:11 PM: josh dodes@www.angelfire[1].txt (ID = 2222) 12:11 PM: josh dodes@network.realmedia[1].txt (ID = 3236) 12:11 PM: Found Spy Cookie: ask cookie 12:11 PM: josh dodes@ask[2].txt (ID = 2245) 12:11 PM: josh dodes@revenue[2].txt (ID = 3257) 12:11 PM: josh dodes@adrevolver[4].txt (ID = 2088) 12:11 PM: josh dodes@questionmarket[3].txt (ID = 3217) 12:11 PM: josh dodes@zedo[3].txt (ID = 3762) 12:11 PM: josh dodes@adopt.specificclick[1].txt (ID = 3400) 12:11 PM: josh dodes@edge.ru4[1].txt (ID = 3269) 12:11 PM: Found Spy Cookie: statcounter cookie 12:11 PM: josh dodes@statcounter[1].txt (ID = 3447) 12:11 PM: Found Spy Cookie: tripod cookie 12:11 PM: josh dodes@tripod[1].txt (ID = 3591) 12:11 PM: josh dodes@ads.pointroll[1].txt (ID = 3148) 12:11 PM: josh dodes@serving-sys[3].txt (ID = 3343) 12:11 PM: josh dodes@partypoker[4].txt (ID = 3111) 12:11 PM: Found Spy Cookie: adknowledge cookie 12:11 PM: josh dodes@adknowledge[2].txt (ID = 2072) 12:11 PM: Found Spy Cookie: exitexchange cookie 12:11 PM: josh dodes@exitexchange[1].txt (ID = 2633) 12:11 PM: josh dodes@nextag[3].txt (ID = 5014) 12:11 PM: josh dodes@realmedia[1].txt (ID = 3235) 12:11 PM: josh dodes@sel.as-us.falkag[1].txt (ID = 2650) 12:11 PM: Found Spy Cookie: inet-traffic.com cookie 12:11 PM: josh dodes@banner3.inet-traffic[1].txt (ID = 2856) 12:11 PM: josh dodes@inet-traffic[2].txt (ID = 2855) 12:11 PM: josh dodes@casalemedia[3].txt (ID = 2354) 12:11 PM: Found Spy Cookie: bluestreak cookie 12:11 PM: josh dodes@bluestreak[1].txt (ID = 2314) 12:11 PM: josh dodes@www.winantiviruspro[1].txt (ID = 3690) 12:11 PM: josh dodes@bannerspace[3].txt (ID = 2284) 12:11 PM: josh dodes@z1.adserver[3].txt (ID = 2142) 12:11 PM: Cookie Sweep Complete, Elapsed Time: 00:00:06 12:11 PM: Starting File Sweep 12:11 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied 12:11 PM: Warning: Failed to open file "c:\hiberfil.sys". Access is denied 12:14 PM: Found Adware: shopathomeselect 12:14 PM: nir12iop.dat (ID = 75801) 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\system.log". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\software.log". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\default.log". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\security". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\sam". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\sam.log". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\security.log". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\system". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\software". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\config\default". The process cannot access the file because it is being used by another process 12:15 PM: Warning: Failed to open file "c:\windows\system32\drivers\idechndr.sys". The process cannot access the file because it is being used by another process 12:23 PM: Warning: Failed to open file "c:\windows\softwaredistribution\eventcache\{6ae870a5-edc2-478d-81f8-67fb8b419aa8}.bin". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb1c5506f-bba0-4c6b-86f3-6f11ece17cf7.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs983c76a7-13dd-4aec-8442-8491e1dc5c44.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs137b298f-4c21-470a-be37-0995004430c1.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs894e9ee8-ecb8-4244-bd4a-17ed1ff5299d.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5073fe2b-e55f-411c-a5fb-cff71779abf4.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8133fc02-7e34-41f5-ad49-c91cf228cd54.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscc7b4668-94d0-4b7d-9366-e82e5cfbeec4.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs67c8660d-24c1-4395-9801-b563df4ccc3c.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs07743442-da1f-4678-933b-2fca25fb996a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6731baea-3ca8-4f8c-8acf-8fb1e0be84df.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfe9440ca-3c38-4843-81df-47d7bd6845c9.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7824e6d9-e2ec-4da8-b4a2-abbd52be5356.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs70767085-854c-4276-b26f-decc499c8154.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4a157b1d-b084-4730-abf9-5f7920e47717.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs10bd6d29-6eaa-48d3-9eec-bc983a2d0f4e.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs939beba6-d961-4b25-94e2-20f9429de7cc.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf627230e-d678-49fe-99e7-5df8fa3c5795.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs894204d1-f7b3-4f2a-b27a-390b23cb1717.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7e4b5c7e-5c2d-43b6-8952-5c0f11252cfc.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs38f0c382-58e8-4287-a9bf-257ca6841629.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf662a8e0-4d54-4308-8ca7-a21e74307ae8.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsadcc0349-0deb-494c-ad50-6cef9f88fb94.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsef15fcd3-dcfe-426a-bf6b-dc7224495adc.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa6d4f625-2d85-4f15-9b95-7e8221e3843f.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs886da1ec-2f2b-41b5-9a2d-06968b09f3ef.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8b0597e1-1057-4238-ada2-2651d6024ba2.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd80dc5c8-255a-4a5c-9705-472856708981.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7bd02c7a-8119-45a0-a537-e36c1d325432.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc42a90f9-89b4-463d-a672-ee68d9d27e58.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs75a84805-a88f-4df9-b519-26d5837d901b.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4aaa1e22-d38c-4fa4-b235-c36627cdfe3c.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsec0d8752-fe91-4337-8959-ee09220f72a0.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf836bd97-6e13-4258-bac0-c0053e28ed83.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdfe356f3-1ea0-44bc-be20-5197b2fe0d8a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8f86fdde-58ce-42fe-94a4-aa05d4fa5fac.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6404f44f-ee22-49c9-8bbf-68a6f82fe2e7.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4b610d62-d177-4989-bd1e-651f378b4f78.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1e268782-555e-4437-86b8-c44701c71a5a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc938e760-3ea8-4113-a112-e331582a97c8.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8126ae97-1980-4300-8ef0-ca0db89db10b.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd8bf1962-6a88-4b68-a592-41e254152398.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7af3c2ab-c94f-48e6-b545-6c31c78b9322.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs35cf32f3-cc42-49ab-911b-6acb8eb3bb36.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6ddd9885-34fd-48bb-9a53-9259bc6d01b4.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8064677b-7673-4769-8ad2-cf92b28ed33d.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs974bc521-f51b-403b-b6c5-a5b47be1076b.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs34b2da31-d0e9-42aa-b67c-57bd68143a41.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb8f52001-25fa-4114-9446-53f32dc5087a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc39edaba-ef26-400f-9bd5-d8ba9ece3e42.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs33ca1a69-8b5a-4365-a440-bc6c590359e3.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3d4826e0-7a14-4461-ae59-fea81b1b31f6.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc466105d-df36-4973-a632-45d7b89e8191.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfd350f40-8e06-4797-88a9-86422c1db09c.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0505dfe3-3528-4f50-8d2b-1d270f4043b7.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa04fc33e-cc90-48c5-9064-12bd7b0cfe93.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb17e302b-ad2d-4dd0-b056-e5153c74ad49.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc9edcd2e-8082-448f-96f5-b3802168f94a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc1bde372-4bd8-4246-95f9-b599b1f4faf9.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb1b3a294-a442-475b-8df5-e7bb6a16585a.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfc0c7e96-e22f-4330-bdd8-90268a59189d.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs204202fb-e865-42fd-8055-56e26297c220.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs833a43e4-0f87-4d49-b85d-67fe6b4a02f8.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb0a6df92-4c48-4c61-b147-e4f15ff60a59.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd7a10ab2-56bb-46de-85fb-d44662aac912.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse4b49fd8-1e91-4186-85f4-7942467adabe.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa3f74b19-9572-491a-b76b-a8de6a93c32b.tmp". The process cannot access the file because it is being used by another process 12:27 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd37b55b2-8abe-43fd-8a6e-7fff2d6f16b4.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc1427d2f-6130-4b66-9e91-057c4c759d48.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb07e6619-690d-437d-a3e9-2156758d4ad2.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs77a010f6-2786-4e2d-b290-25dcf690cb93.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc83be016-2f11-4783-8d39-730b06cc1320.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4c99a010-867b-4b43-8fed-7ff8a7cc2c61.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs41418bbb-defd-493c-9855-4d6205740ced.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs59978760-d56f-4a9e-8060-d9119fea2f94.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb0f73a27-321c-45bc-bd44-d498d979ad14.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc76424e1-6a7d-4688-a02b-dfdee0b0a96d.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsca943e19-ce17-47ea-94d2-7baf1286626b.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs54205eb0-5fd9-4780-8cc0-7a262b7cbd03.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb3d37738-c470-475c-9a82-308a63ff47aa.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa791ff13-38a6-415b-ad2e-2c10ef467c3b.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfe540f78-372b-44e1-bfc2-ae58c9e929a4.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs67ebcd3d-d9eb-4eeb-a2f0-71ddf9105f54.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs021af41e-88ec-4be0-a0f6-efae2125cd87.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs961a19dd-8ba3-4cdc-a251-8e30aa90f450.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs942d6c2b-53d8-4e6a-b5c9-f9cb1d10fca9.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs33352c5f-cc5a-4014-9409-feeab63c62ef.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs580b9a82-bdd5-484f-b22a-febea8987776.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4ba7ba0b-e86b-460f-9d13-5708ee2464fb.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs85f5b804-c7fd-4cf7-a4a3-e3306da0d8e7.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5cd6fea7-b1ba-4752-8d4f-6871f689457a.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsedbe61e9-b1b8-41ed-aad8-87c4de6d4bde.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc9272112-676a-4234-9224-1b3643d10623.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfd055be4-3208-4b5c-a91f-7afb5b26a3d1.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc911b997-8ec5-4730-9819-7878942cb42d.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs74b9b349-ce14-4cd7-a0d6-d3b5b7855339.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa846fd9c-45e7-447d-a1e1-3d76010bb035.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc150aa15-6b97-4933-a474-818d1524c239.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsced6f4f0-6fb8-42a5-bf2a-fa071c980ef2.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsef7b333d-6949-486e-9b84-7aba434b9d45.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5a6fa924-2f2d-40fe-81a0-757387112b37.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdb7dcdc9-eb47-473c-ba7b-14272bf1bed3.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9fe19519-d769-4953-a5d8-13dc4fb134df.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5ff3aa87-1a9e-4751-ab28-753374dfa39e.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9d6e5b7e-684c-4c56-9819-345b4e490d03.tmp". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\ntuser.dat". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\ntuser.dat.log". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbeam". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbeao". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbdam". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbdao". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbu2dm.cf1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbc2emh.ht1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbc2em.cf1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbvmh.ht1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbvm.cf1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbm". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\fii.cf1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\rpm.cf1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\fiih.ht1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\rpmh.ht1". The process cannot access the file because it is being used by another process 12:28 PM: Warning: Failed to open file "c:\documents and settings\josh dodes\local settings\application data\google\google desktop search\dbu2dmh.ht1". The process cannot access the file because it is being used by another process 12:32 PM: Found Adware: apropos 12:32 PM: c:\documents and settings\donna freitas\local settings\temp\autoupdate0 (ID = -2147481415) 12:36 PM: Warning: Failed to open file "c:\program files\common files\symantec shared\ccpd-lc\symlcrst.dll". The process cannot access the file because it is being used by another process 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:49 PM: Warning: Unhandled Archive Type 12:50 PM: Warning: Unhandled Archive Type 12:51 PM: File Sweep Complete, Elapsed Time: 00:39:41 12:51 PM: Full Sweep has completed. Elapsed time 00:43:33 12:51 PM: Traces Found: 212 12:53 PM: Removal process initiated 12:54 PM: Quarantining All Traces: virtumonde 12:54 PM: virtumonde is in use. It will be removed on reboot. 12:54 PM: pmnlj.dll is in use. It will be removed on reboot. 12:54 PM: C:\WINDOWS\system32\pmnlj.dll is in use. It will be removed on reboot. 12:54 PM: Quarantining All Traces: apropos 12:54 PM: Quarantining All Traces: alfa cleaner 12:54 PM: Quarantining All Traces: shopathomeselect 12:54 PM: Quarantining All Traces: 2o7.net cookie 12:54 PM: Quarantining All Traces: 360i cookie 12:54 PM: Quarantining All Traces: 888 cookie 12:54 PM: Quarantining All Traces: a cookie 12:54 PM: Quarantining All Traces: addynamix cookie 12:54 PM: Quarantining All Traces: adecn cookie 12:54 PM: Quarantining All Traces: adjuggler cookie 12:54 PM: Quarantining All Traces: adknowledge cookie 12:54 PM: Quarantining All Traces: adreactor cookie 12:54 PM: Quarantining All Traces: adrevolver cookie 12:54 PM: Quarantining All Traces: adserver cookie 12:54 PM: Quarantining All Traces: adtech cookie 12:54 PM: Quarantining All Traces: adultfriendfinder cookie 12:54 PM: Quarantining All Traces: advertising cookie 12:54 PM: Quarantining All Traces: angelfire cookie 12:54 PM: Quarantining All Traces: apmebf cookie 12:54 PM: Quarantining All Traces: ask cookie 12:54 PM: Quarantining All Traces: askmen cookie 12:54 PM: Quarantining All Traces: atlas dmt cookie 12:54 PM: Quarantining All Traces: atwola cookie 12:54 PM: Quarantining All Traces: azjmp cookie 12:54 PM: Quarantining All Traces: banner cookie 12:54 PM: Quarantining All Traces: banners cookie 12:54 PM: Quarantining All Traces: bannerspace cookie 12:54 PM: Quarantining All Traces: belnk cookie 12:54 PM: Quarantining All Traces: bluestreak cookie 12:54 PM: Quarantining All Traces: bravenet cookie 12:54 PM: Quarantining All Traces: burstbeacon cookie 12:54 PM: Quarantining All Traces: casalemedia cookie 12:54 PM: Quarantining All Traces: cassava cookie 12:54 PM: Quarantining All Traces: cc214142 cookie 12:54 PM: Quarantining All Traces: clickandtrack cookie 12:54 PM: Quarantining All Traces: coolsavings cookie 12:54 PM: Quarantining All Traces: customer cookie 12:54 PM: Quarantining All Traces: did-it cookie 12:54 PM: Quarantining All Traces: directtrack cookie 12:54 PM: Quarantining All Traces: eadexchange cookie 12:54 PM: Quarantining All Traces: enhance cookie 12:54 PM: Quarantining All Traces: exitexchange cookie 12:54 PM: Quarantining All Traces: falkag cookie 12:54 PM: Quarantining All Traces: fastclick cookie 12:54 PM: Quarantining All Traces: go.com cookie 12:54 PM: Quarantining All Traces: hermoment.com cookie 12:54 PM: Quarantining All Traces: ic-live cookie 12:54 PM: Quarantining All Traces: inet-traffic.com cookie 12:54 PM: Quarantining All Traces: infospace cookie 12:54 PM: Quarantining All Traces: kmpads cookie 12:54 PM: Quarantining All Traces: maxserving cookie 12:54 PM: Quarantining All Traces: nextag cookie 12:54 PM: Quarantining All Traces: overture cookie 12:54 PM: Quarantining All Traces: partypoker cookie 12:54 PM: Quarantining All Traces: passion cookie 12:54 PM: Quarantining All Traces: pointroll cookie 12:54 PM: Quarantining All Traces: primaryads cookie 12:54 PM: Quarantining All Traces: pub cookie 12:54 PM: Quarantining All Traces: questionmarket cookie 12:54 PM: Quarantining All Traces: rambler cookie 12:54 PM: Quarantining All Traces: realmedia cookie 12:54 PM: Quarantining All Traces: reliablestats cookie 12:54 PM: Quarantining All Traces: revenue.net cookie 12:54 PM: Quarantining All Traces: ru4 cookie 12:54 PM: Quarantining All Traces: serving-sys cookie 12:54 PM: Quarantining All Traces: servlet cookie 12:54 PM: Quarantining All Traces: specificclick.com cookie 12:54 PM: Quarantining All Traces: starpulse cookie 12:54 PM: Quarantining All Traces: statcounter cookie 12:54 PM: Quarantining All Traces: stlyrics cookie 12:54 PM: Quarantining All Traces: tacoda cookie 12:54 PM: Quarantining All Traces: touchclarity cookie 12:54 PM: Quarantining All Traces: trafficmp cookie 12:54 PM: Quarantining All Traces: tribalfusion cookie 12:54 PM: Quarantining All Traces: tripod cookie 12:54 PM: Quarantining All Traces: videodome cookie 12:54 PM: Quarantining All Traces: webpower cookie 12:54 PM: Quarantining All Traces: websponsors cookie 12:54 PM: Quarantining All Traces: web-stat cookie 12:54 PM: Quarantining All Traces: wegcash cookie 12:54 PM: Quarantining All Traces: winantiviruspro cookie 12:54 PM: Quarantining All Traces: xiti cookie 12:54 PM: Quarantining All Traces: yieldmanager cookie 12:54 PM: Quarantining All Traces: zedo cookie 12:54 PM: Warning: Launched explorer.exe 12:54 PM: Warning: Quarantine process could not restart Explorer. 12:54 PM: Preparing to restart your computer. Please wait... 12:54 PM: Removal process completed. Elapsed time 00:01:15 ******** 12:04 PM: | Start of Session, Friday, April 14, 2006 | 12:04 PM: Spy Sweeper started 12:05 PM: Messenger service has been disabled. 12:05 PM: Deleted error log without sending: C:\Documents and Settings\Josh Dodes\Application Data\Webroot\Spy Sweeper\Logs\bugreport.txt 12:06 PM: Updating spyware definitions 12:06 PM: Your spyware definitions have been updated. 12:07 PM: | End of Session, Friday, April 14, 2006 | ----------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 12:59:37 PM, on 4/14/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE C:\windows\System32\DeltTray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\EarthLink\spamBlocker\ELSBLaunch.exe C:\Program Files\Handspring\HOTSYNC.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\windows\System32\devldr32.exe C:\Program Files\Norton AntiVirus\navapsvc.exe

[LDTate]

You need to update both Windows XP and Internet Explorere as they are both well behind in updates. They are both missing Service Pack 1 which is leaving you open to all kinds of problems.


Service Pack 1 for XP

http://www.microsoft...p1/default.mspx

Service Pack 1 for Internet Explorer.

http://www.microsoft...p1/default.mspx

Install then Reboot and "copy/paste" a new log file into this thread.

[LDTate]

How are you doing with the fix?

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php