WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93101 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

HijackThis Log

Started by imoFLUX , Apr 18 2006 07:08 AM

This topic is locked

21 replies to this topic

#1 imoFLUX

New Member

Authentic Member
14 posts

Posted 18 April 2006 - 07:08 AM

HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 5:47:04 AM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\WINDOWS\CheckS02.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\PROGRA~1\AIM95\aim.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Documents and Settings\Christopher Ulep\Local Settings\Temp\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://216.130.185.122/sidesearch.html
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsof...arch/search.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsof...obby/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchcust.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsof...search.asp?p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\jvjof.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,urqsppy.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\CheckS02.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://free.aol.com
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.msn.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {26098EA2-C95D-48EA-89B4-63C5A63BD42F} - http://www.pacimedia...ll/pcs_0031.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1130234580109
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} (AIM UPF Control) - http://pictures06.ai...AIM.9.5.1.8.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {C62DFDC7-2EEC-4C2C-827A-BC0BFB4260B3} (IMViewerControl Class) - http://companion.log...1/bin/imvid.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon....es/vzWebIns.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://aceshigh.mic...igh/FlashAX.cab
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.log...3/bin/imvid.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.14...geWell-ipix.cab
O20 - AppInit_DLLs: iniwin32.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\m0pola731d.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Advertisements

Register to Remove

#2 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 20 April 2006 - 05:12 PM

Hello imoFLUX, welcome to the forum.

Important: Do this before any fix.

Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.

The reason we do this is Hijackthis creates backup files just in case you'd need to restore one and we'll be cleaning out the temp files.

After the above:

This is what I suggest you do.

Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#3 imoFLUX

New Member

Authentic Member
14 posts

Posted 21 April 2006 - 12:21 AM

New HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 11:09:04 PM, on 4/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\PROGRA~1\AIM95\aim.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Christopher Ulep\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ie.search.msn...st/srchasst.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsof...arch/search.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsof...obby/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsof...search.asp?p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\jvjof.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,urqsppy.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://free.aol.com
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.msn.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {26098EA2-C95D-48EA-89B4-63C5A63BD42F} - http://www.pacimedia...ll/pcs_0031.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1130234580109
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} (AIM UPF Control) - http://pictures06.ai...AIM.9.5.1.8.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {C62DFDC7-2EEC-4C2C-827A-BC0BFB4260B3} (IMViewerControl Class) - http://companion.log...1/bin/imvid.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon....es/vzWebIns.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://aceshigh.mic...igh/FlashAX.cab
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.log...3/bin/imvid.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.14...geWell-ipix.cab
O20 - AppInit_DLLs: iniwin32.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\en84l1lq1.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#4 imoFLUX

New Member

Authentic Member
14 posts

Posted 21 April 2006 - 12:26 AM

Spy Sweeper Session Log ******** 9:31 PM: | Start of Session, Thursday, April 20, 2006 | 9:31 PM: Spy Sweeper started 9:31 PM: Sweep initiated using definitions version 662 9:31 PM: Starting Memory Sweep 9:31 PM: Found Adware: e2g 9:31 PM: Detected running threat: C:\Program Files\E2G\IeBHOs.dll (ID = 214221) 9:34 PM: Memory Sweep Complete, Elapsed Time: 00:03:08 9:34 PM: Starting Registry Sweep 9:34 PM: HKCR\appid\iebhos.dll\ (1 subtraces) (ID = 125406) 9:34 PM: HKCR\appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (1 subtraces) (ID = 125407) 9:34 PM: HKCR\clsid\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (14 subtraces) (ID = 125441) 9:34 PM: HKCR\iebhos.control.1\ (3 subtraces) (ID = 125444) 9:34 PM: HKCR\iebhos.control\ (5 subtraces) (ID = 125445) 9:34 PM: HKLM\software\classes\appid\iebhos.dll\ (1 subtraces) (ID = 125446) 9:34 PM: HKLM\software\classes\appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (1 subtraces) (ID = 125447) 9:34 PM: HKLM\software\classes\clsid\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (14 subtraces) (ID = 125481) 9:34 PM: HKLM\software\classes\iebhos.control.1\ (3 subtraces) (ID = 125482) 9:34 PM: HKLM\software\classes\iebhos.control\ (5 subtraces) (ID = 125483) 9:34 PM: HKLM\software\classes\typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (9 subtraces) (ID = 125484) 9:34 PM: HKLM\software\e2g\ (5 subtraces) (ID = 125485) 9:34 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (ID = 125492) 9:34 PM: HKCR\typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (9 subtraces) (ID = 125529) 9:35 PM: Registry Sweep Complete, Elapsed Time:00:00:22 9:35 PM: Starting Cookie Sweep 9:36 PM: Cookie Sweep Complete, Elapsed Time: 00:00:34 9:36 PM: Starting File Sweep 9:36 PM: c:\program files\e2g (2 subtraces) (ID = -2147481074) 9:48 PM: Warning: Failed to open file "c:\recycler\\info2". The system cannot find the file specified 10:13 PM: iebhos.dll (ID = 214221) 10:47 PM: File Sweep Complete, Elapsed Time: 01:11:30 10:47 PM: Full Sweep has completed. Elapsed time 01:15:56 10:47 PM: Traces Found: 90 10:54 PM: Removal process initiated 10:55 PM: Quarantining All Traces: e2g 10:55 PM: e2g is in use. It will be removed on reboot. 10:55 PM: iebhos.dll is in use. It will be removed on reboot. 10:56 PM: BHO Shield: found: -- BHO installation denied at user request 10:56 PM: Preparing to restart your computer. Please wait... 10:56 PM: Removal process completed. Elapsed time 00:01:37 ******** 9:30 PM: | Start of Session, Thursday, April 20, 2006 | 9:30 PM: Spy Sweeper started 9:30 PM: Sweep initiated using definitions version 662 9:30 PM: Starting Memory Sweep 9:30 PM: Found Adware: e2g 9:30 PM: Detected running threat: C:\Program Files\E2G\IeBHOs.dll (ID = 214221) 9:31 PM: Sweep Canceled 9:31 PM: Memory Sweep Complete, Elapsed Time: 00:00:30 9:31 PM: Traces Found: 1 9:31 PM: | End of Session, Thursday, April 20, 2006 | ******** 7:31 PM: | Start of Session, Thursday, April 20, 2006 | 7:31 PM: Spy Sweeper started 7:31 PM: Sweep initiated using definitions version 662 7:31 PM: Starting Memory Sweep 7:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:32 PM: Found Adware: clkoptimizer 7:32 PM: Detected running threat: C:\WINDOWS\SYSTEM32\atslwsk.dll (ID = 268933) 7:32 PM: Detected running threat: C:\WINDOWS\SYSTEM32\jvjof.exe (ID = 268934) 7:32 PM: Detected running threat: C:\WINDOWS\SYSTEM32\jvjof.exe (ID = 268934) 7:32 PM: Detected running threat: C:\WINDOWS\SYSTEM32\jvjof.exe (ID = 268934) 7:32 PM: Detected running threat: C:\WINDOWS\SYSTEM32\tmskfj.exe (ID = 268995) 7:32 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || sewcfi (ID = 0) 7:32 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 7:32 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1007\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 7:32 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 7:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:33 PM: Detected running threat: C:\WINDOWS\SYSTEM32\dmonwv.dll (ID = 268799) 7:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:34 PM: Found Adware: enbrowser 7:34 PM: Detected running threat: C:\WINDOWS\CheckS02.exe (ID = 251279) 7:34 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || TheMonitor (ID = 0) 7:35 PM: Memory Sweep Complete, Elapsed Time: 00:03:31 7:35 PM: Starting Registry Sweep 7:35 PM: Found Adware: e2g 7:35 PM: HKCR\appid\iebhos.dll\ (1 subtraces) (ID = 125406) 7:35 PM: HKCR\appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (1 subtraces) (ID = 125407) 7:35 PM: HKCR\clsid\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (14 subtraces) (ID = 125441) 7:35 PM: HKCR\iebhos.control.1\ (3 subtraces) (ID = 125444) 7:35 PM: HKCR\iebhos.control\ (5 subtraces) (ID = 125445) 7:35 PM: HKLM\software\classes\appid\iebhos.dll\ (1 subtraces) (ID = 125446) 7:35 PM: HKLM\software\classes\appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (1 subtraces) (ID = 125447) 7:35 PM: HKLM\software\classes\clsid\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (14 subtraces) (ID = 125481) 7:35 PM: HKLM\software\classes\iebhos.control.1\ (3 subtraces) (ID = 125482) 7:35 PM: HKLM\software\classes\iebhos.control\ (5 subtraces) (ID = 125483) 7:35 PM: HKLM\software\classes\typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (9 subtraces) (ID = 125484) 7:35 PM: HKLM\software\e2g\ (1 subtraces) (ID = 125485) 7:35 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{3643abc2-21bf-46b9-b230-f247db0c6fd6}\ (ID = 125492) 7:35 PM: HKCR\typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e}\ (9 subtraces) (ID = 125529) 7:35 PM: Found Adware: ieplugin 7:35 PM: HKLM\software\classes\typelib\{074a9743-0517-454c-b2f4-ff964de43e4c}\ (9 subtraces) (ID = 128168) 7:35 PM: HKLM\software\microsoft\windows\currentversion\uninstall\enhsrch\ (2 subtraces) (ID = 128198) 7:35 PM: HKCR\typelib\{074a9743-0517-454c-b2f4-ff964de43e4c}\ (9 subtraces) (ID = 128200) 7:35 PM: Found Adware: isearch desktop search 7:35 PM: HKLM\software\system updater\ (ID = 129016) 7:35 PM: Found Adware: isearch toolbar 7:35 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/system32/version.txt\ (2 subtraces) (ID = 129037) 7:35 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\system32\version.txt (ID = 129041) 7:35 PM: Found Adware: command 7:35 PM: HKLM\system\currentcontrolset\services\cmdservice\ (5 subtraces) (ID = 958670) 7:35 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\0000\ (6 subtraces) (ID = 1016064) 7:35 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\ (8 subtraces) (ID = 1016072) 7:35 PM: HKLM\software\microsoft\windows\currentversion\run\ || themonitor (ID = 1028873) 7:35 PM: Found Adware: spyaxe fakealert 7:35 PM: HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler\ || {c1a8b6a1-2c81-1c3d-a3c6-a1ccdb10b47f} (ID = 1066891) 7:35 PM: HKCR\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212644) 7:35 PM: HKLM\software\classes\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212651) 7:35 PM: HKCR\folder\shellex\columnhandlers\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (1 subtraces) (ID = 1212684) 7:35 PM: HKLM\software\classes\folder\shellex\columnhandlers\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (1 subtraces) (ID = 1212686) 7:35 PM: HKLM\software\microsoft\internet explorer\extensions\{4abf810a-f11d-4169-9d5f-7d274f2270a1}\ (2 subtraces) (ID = 1212690) 7:35 PM: Found Adware: ezula ilookup 7:35 PM: HKCR\da.bomb\ (5 subtraces) (ID = 1221354) 7:35 PM: HKCR\da.bomb.1\ (3 subtraces) (ID = 1221359) 7:35 PM: HKCR\onone.theimp\ (5 subtraces) (ID = 1221362) 7:35 PM: HKCR\onone.theimp.1\ (3 subtraces) (ID = 1221367) 7:35 PM: HKLM\software\classes\da.bomb\ (5 subtraces) (ID = 1221507) 7:35 PM: HKLM\software\classes\da.bomb.1\ (3 subtraces) (ID = 1221512) 7:35 PM: HKLM\software\classes\onone.theimp\ (5 subtraces) (ID = 1221515) 7:35 PM: HKLM\software\classes\onone.theimp.1\ (3 subtraces) (ID = 1221523) 7:35 PM: Found Adware: sysprotect 7:35 PM: HKCR\checkprod.checkproduct\ (5 subtraces) (ID = 1249116) 7:35 PM: HKCR\comcleancore.appcleaner\ (5 subtraces) (ID = 1249126) 7:35 PM: HKCR\comcleancore.ccquickscan\ (5 subtraces) (ID = 1249136) 7:35 PM: HKCR\comcleancore.filecleaner\ (5 subtraces) (ID = 1249146) 7:35 PM: HKCR\comcleancore.inetcleaner\ (5 subtraces) (ID = 1249156) 7:35 PM: HKCR\comcleancore.regcleaner\ (5 subtraces) (ID = 1249166) 7:35 PM: HKCR\comcleancore.systemcleaner\ (5 subtraces) (ID = 1249176) 7:35 PM: HKCR\df_fixr.fixer\ (5 subtraces) (ID = 1249186) 7:35 PM: HKCR\df_prxy.drivermanipulate\ (5 subtraces) (ID = 1249196) 7:35 PM: HKCR\ffwraper.ffenginwrapr\ (5 subtraces) (ID = 1249206) 7:35 PM: HKCR\fixcor.mmfixcore\ (5 subtraces) (ID = 1249216) 7:35 PM: HKCR\flfxr10.flfixer10\ (3 subtraces) (ID = 1249226) 7:35 PM: HKCR\mmfixctrl.cofixengin2\ (5 subtraces) (ID = 1249230) 7:35 PM: HKCR\appid\checkproduct2_1.dll\ (1 subtraces) (ID = 1249240) 7:35 PM: HKCR\appid\fxcore.dll\ (1 subtraces) (ID = 1249244) 7:35 PM: HKCR\appid\mmfxctrl.dll\ (1 subtraces) (ID = 1249246) 7:35 PM: HKCR\appid\{1c02ce6b-cc12-4ea1-b2d8-113f611f25c2}\ (1 subtraces) (ID = 1249248) 7:35 PM: HKCR\appid\{4f5e5d72-c915-4f3b-908b-527d064b0faa}\ (1 subtraces) (ID = 1249250) 7:35 PM: HKCR\appid\{8a1e94da-725d-4f64-b110-db3f73adb6f7}\ (1 subtraces) (ID = 1249252) 7:35 PM: HKCR\appid\{e7e155ee-eef2-46af-99b7-65f1269dc3cf}\ (1 subtraces) (ID = 1249254) 7:35 PM: HKCR\appid\{ee10a303-0c60-4acb-a033-95a790fa4dcd}\ (1 subtraces) (ID = 1249256) 7:35 PM: HKCR\clsid\{5d178dbe-c867-417f-8a4e-d5defa4cd4e7}\ (12 subtraces) (ID = 1249258) 7:35 PM: HKCR\clsid\{6c8416a2-2408-4f4d-8d26-ec9a07e8dc98}\ (12 subtraces) (ID = 1249271) 7:35 PM: HKCR\clsid\{9c102b96-4845-4756-991e-4f9294965536}\ (12 subtraces) (ID = 1249284) 7:35 PM: HKCR\clsid\{9cb12dad-32c7-4f34-9758-c9fdd26d4d22}\ (21 subtraces) (ID = 1249297) 7:35 PM: HKCR\clsid\{c1ea2421-bc9a-4546-943c-126f9d818efb}\ (4 subtraces) (ID = 1249319) 7:35 PM: HKCR\clsid\{c3896a1e-8ecd-490b-8a1c-39fe9f7d64a1}\ (4 subtraces) (ID = 1249324) 7:35 PM: HKCR\clsid\{c3e2988e-1433-469d-bfc1-4080d131fe1a}\ (12 subtraces) (ID = 1249329) 7:35 PM: HKCR\clsid\{cf080118-cda5-429d-a8bd-ec7eca74663f}\ (12 subtraces) (ID = 1249342) 7:35 PM: HKCR\clsid\{d3377825-230d-4a12-805c-132557fa1a8b}\ (12 subtraces) (ID = 1249355) 7:35 PM: HKCR\clsid\{d7136b99-fc27-4dc1-8497-5444d49b426a}\ (4 subtraces) (ID = 1249368) 7:35 PM: HKCR\clsid\{d7d85b02-fa7c-437d-93c5-b8fba2ba11ed}\ (12 subtraces) (ID = 1249373) 7:35 PM: HKCR\clsid\{e4a3f67d-5237-43fa-b3f2-41c37c1204b9}\ (12 subtraces) (ID = 1249397) 7:35 PM: HKCR\clsid\{e78ea05b-b6a7-4dc4-879d-444dcd224cb4}\ (12 subtraces) (ID = 1249410) 7:35 PM: HKCR\clsid\{ef130e77-0a34-4365-bfb7-218fd3ddcd5f}\ (15 subtraces) (ID = 1249423) 7:35 PM: HKCR\clsid\{fda9bfc7-4ecd-43a0-ac1e-2e7dde0c81b0}\ (21 subtraces) (ID = 1249439) 7:35 PM: HKCR\typelib\{03a78dbd-aa12-4db4-ab2c-564460d385dc}\ (9 subtraces) (ID = 1249676) 7:35 PM: HKCR\typelib\{09af1cf9-825c-4017-a7dc-088c68770f31}\ (9 subtraces) (ID = 1249686) 7:35 PM: HKCR\typelib\{223cedca-738b-4c4d-b8ae-c68b68c90a4a}\ (9 subtraces) (ID = 1249696) 7:35 PM: HKCR\typelib\{5940ca88-8f1a-4a74-89e4-b3407e5e7348}\ (9 subtraces) (ID = 1249706) 7:35 PM: HKCR\typelib\{61c1fc79-7120-4824-a563-d4d11d80bafb}\ (9 subtraces) (ID = 1249716) 7:35 PM: HKCR\typelib\{7eacf70b-302f-4049-ac68-2d62eb43e473}\ (9 subtraces) (ID = 1249726) 7:35 PM: HKCR\typelib\{a8c9ad38-7708-4beb-a20c-b79614b4f120}\ (9 subtraces) (ID = 1249736) 7:35 PM: HKLM\software\classes\comcleancore.appcleaner\ (5 subtraces) (ID = 1249776) 7:35 PM: HKLM\software\classes\comcleancore.ccquickscan\ (5 subtraces) (ID = 1249786) 7:35 PM: HKLM\software\classes\comcleancore.filecleaner\ (5 subtraces) (ID = 1249796) 7:35 PM: HKLM\software\classes\checkprod.checkproduct\ (5 subtraces) (ID = 1249805) 7:35 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\program files\common files\sysprotect\pcheck.dll (ID = 1249815) 7:35 PM: HKLM\software\classes\comcleancore.inetcleaner\ (5 subtraces) (ID = 1249838) 7:35 PM: HKLM\software\classes\comcleancore.regcleaner\ (5 subtraces) (ID = 1249848) 7:35 PM: HKLM\software\classes\comcleancore.systemcleaner\ (5 subtraces) (ID = 1249858) 7:35 PM: HKLM\software\classes\df_fixr.fixer\ (5 subtraces) (ID = 1249868) 7:35 PM: HKLM\software\classes\df_prxy.drivermanipulate\ (5 subtraces) (ID = 1249878) 7:35 PM: HKLM\software\classes\ffwraper.ffenginwrapr\ (5 subtraces) (ID = 1249888) 7:35 PM: HKLM\software\classes\fixcor.mmfixcore\ (5 subtraces) (ID = 1249898) 7:35 PM: HKLM\software\classes\flfxr10.flfixer10\ (3 subtraces) (ID = 1249908) 7:35 PM: HKLM\software\classes\mmfixctrl.cofixengin2\ (5 subtraces) (ID = 1249912) 7:35 PM: HKLM\software\classes\appid\checkproduct2_1.dll\ (1 subtraces) (ID = 1249922) 7:35 PM: HKLM\software\classes\appid\fxcore.dll\ (1 subtraces) (ID = 1249926) 7:35 PM: HKLM\software\classes\appid\mmfxctrl.dll\ (1 subtraces) (ID = 1249928) 7:35 PM: HKLM\software\classes\appid\{1c02ce6b-cc12-4ea1-b2d8-113f611f25c2}\ (1 subtraces) (ID = 1249930) 7:35 PM: HKLM\software\classes\appid\{4f5e5d72-c915-4f3b-908b-527d064b0faa}\ (1 subtraces) (ID = 1249932) 7:35 PM: HKLM\software\classes\appid\{8a1e94da-725d-4f64-b110-db3f73adb6f7}\ (1 subtraces) (ID = 1249934) 7:35 PM: HKLM\software\classes\appid\{e7e155ee-eef2-46af-99b7-65f1269dc3cf}\ (1 subtraces) (ID = 1249936) 7:35 PM: HKLM\software\classes\appid\{ee10a303-0c60-4acb-a033-95a790fa4dcd}\ (1 subtraces) (ID = 1249938) 7:35 PM: HKLM\software\classes\clsid\{5d178dbe-c867-417f-8a4e-d5defa4cd4e7}\ (12 subtraces) (ID = 1249940) 7:35 PM: HKLM\software\classes\clsid\{6c8416a2-2408-4f4d-8d26-ec9a07e8dc98}\ (12 subtraces) (ID = 1249953) 7:35 PM: HKLM\software\classes\clsid\{9c102b96-4845-4756-991e-4f9294965536}\ (12 subtraces) (ID = 1249966) 7:35 PM: HKLM\software\classes\clsid\{9cb12dad-32c7-4f34-9758-c9fdd26d4d22}\ (21 subtraces) (ID = 1249979) 7:35 PM: HKLM\software\classes\clsid\{c1ea2421-bc9a-4546-943c-126f9d818efb}\ (4 subtraces) (ID = 1250001) 7:35 PM: HKLM\software\classes\clsid\{c3896a1e-8ecd-490b-8a1c-39fe9f7d64a1}\ (4 subtraces) (ID = 1250006) 7:35 PM: HKLM\software\classes\clsid\{c3e2988e-1433-469d-bfc1-4080d131fe1a}\ (12 subtraces) (ID = 1250011) 7:35 PM: HKLM\software\classes\clsid\{cf080118-cda5-429d-a8bd-ec7eca74663f}\ (12 subtraces) (ID = 1250024) 7:35 PM: HKLM\software\classes\clsid\{d3377825-230d-4a12-805c-132557fa1a8b}\ (12 subtraces) (ID = 1250037) 7:35 PM: HKLM\software\classes\clsid\{d7136b99-fc27-4dc1-8497-5444d49b426a}\ (4 subtraces) (ID = 1250050) 7:35 PM: HKLM\software\classes\clsid\{d7d85b02-fa7c-437d-93c5-b8fba2ba11ed}\ (12 subtraces) (ID = 1250055) 7:35 PM: HKLM\software\classes\clsid\{e4a3f67d-5237-43fa-b3f2-41c37c1204b9}\ (12 subtraces) (ID = 1250079) 7:35 PM: HKLM\software\classes\clsid\{e78ea05b-b6a7-4dc4-879d-444dcd224cb4}\ (12 subtraces) (ID = 1250092) 7:35 PM: HKLM\software\classes\clsid\{ef130e77-0a34-4365-bfb7-218fd3ddcd5f}\ (15 subtraces) (ID = 1250105) 7:35 PM: HKLM\software\classes\clsid\{fda9bfc7-4ecd-43a0-ac1e-2e7dde0c81b0}\ (21 subtraces) (ID = 1250121) 7:35 PM: HKLM\software\classes\typelib\{03a78dbd-aa12-4db4-ab2c-564460d385dc}\ (9 subtraces) (ID = 1250143) 7:35 PM: HKLM\software\classes\typelib\{09af1cf9-825c-4017-a7dc-088c68770f31}\ (9 subtraces) (ID = 1250153) 7:35 PM: HKLM\software\classes\typelib\{223cedca-738b-4c4d-b8ae-c68b68c90a4a}\ (9 subtraces) (ID = 1250163) 7:35 PM: HKLM\software\classes\typelib\{5940ca88-8f1a-4a74-89e4-b3407e5e7348}\ (9 subtraces) (ID = 1250173) 7:35 PM: HKLM\software\classes\typelib\{61c1fc79-7120-4824-a563-d4d11d80bafb}\ (9 subtraces) (ID = 1250183) 7:35 PM: HKLM\software\classes\typelib\{7eacf70b-302f-4049-ac68-2d62eb43e473}\ (9 subtraces) (ID = 1250193) 7:35 PM: HKLM\software\classes\typelib\{a8c9ad38-7708-4beb-a20c-b79614b4f120}\ (9 subtraces) (ID = 1250203) 7:35 PM: Found Adware: clientman 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\windows\currentversion\run\ || svc (ID = 105915) 7:35 PM: Found Adware: coolwebsearch (cws) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\windows\currentversion\run\ || svc (ID = 105915) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\winshow\ (7 subtraces) (ID = 112497) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\enhsrch\ (7 subtraces) (ID = 128172) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\intexp\ (9 subtraces) (ID = 128173) 7:35 PM: Found Adware: drsnsrch.com hijack 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\isearch\ (41 subtraces) (ID = 129026) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\internet explorer\menuext\&isearch the web\ (2 subtraces) (ID = 129031) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\internet explorer\toolbar\webbrowser\ || {1c78ab3f-a857-482e-80c0-3a1e5238a565} (ID = 129033) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\internet explorer\urlsearchhooks\ || {1c78ab3f-a857-482e-80c0-3a1e5238a565} (ID = 129034) 7:35 PM: Found Adware: lopdotcom 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\windows\currentversion\run\ || aida (ID = 130496) 7:35 PM: Found Adware: purityscan 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\windows\currentversion\run\ || wint (ID = 138916) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\purityscan\ (2 subtraces) (ID = 139084) 7:35 PM: Found Adware: shopnav.com hijack 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\microsoft\internet explorer\searchurl\ (ID = 142268) 7:35 PM: Found Adware: directrevenue-abetterinternet 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-501\software\dlmax\ (29 subtraces) (ID = 145916) 7:35 PM: Found Adware: begin2search 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\internet_connection_2\ (21 subtraces) (ID = 104068) 7:35 PM: Found Adware: 216.130.185.122 hijack 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\microsoft\internet explorer\ || searchurl (ID = 104269) 7:35 PM: Found Adware: desktoptraffic 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\eeennn\ (277 subtraces) (ID = 124993) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\ptech\ (1 subtraces) (ID = 125528) 7:35 PM: Found Adware: ebates money maker 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\microsoft\internet explorer\extensions\cmdmapping\ || {6685509e-b47b-4f47-8e16-9a5f3a62f683} (ID = 125587) 7:35 PM: Found Adware: webrebates 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\microsoft\internet explorer\extensions\{6685509e-b47b-4f47-8e16-9a5f3a62f683}\ (6 subtraces) (ID = 125589) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\microsoft\internet explorer\extensions\{6685509e-b47b-4f47-8e16-9a5f3a62f683}\ (6 subtraces) (ID = 125589) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\enhsrch\ (38 subtraces) (ID = 128172) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\system\sysuid\ (1 subtraces) (ID = 731748) 7:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\software\sysprotect\ (14 subtraces) (ID = 1249756) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1007\software\enhsrch\ (7 subtraces) (ID = 128172) 7:35 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1007\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\microsoft\internet explorer\ || searchurl (ID = 104269) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {6685509e-b47b-4f47-8e16-9a5f3a62f683} (ID = 125587) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\enhsrch\ (79 subtraces) (ID = 128172) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {1ae2f26c-8e23-4930-a68d-9e681a764001} (ID = 129029) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\system\sysuid\ (1 subtraces) (ID = 731748) 7:35 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\software\sysprotect\ (ID = 1249756) 7:35 PM: Registry Sweep Complete, Elapsed Time:00:00:28 7:36 PM: Starting Cookie Sweep 7:36 PM: Found Spy Cookie: 2o7.net cookie 7:36 PM: guest@112.2o7[2].txt (ID = 1958) 7:36 PM: Found Spy Cookie: 203.199.200 cookie 7:36 PM: guest@203.199.200[1].txt (ID = 1941) 7:36 PM: guest@2o7[2].txt (ID = 1957) 7:36 PM: Found Spy Cookie: 412 cookie 7:36 PM: guest@412[2].txt (ID = 1969) 7:36 PM: Found Spy Cookie: 64.62.232 cookie 7:36 PM: guest@64.62.232[2].txt (ID = 1987) 7:36 PM: guest@64.62.232[3].txt (ID = 1987) 7:36 PM: Found Spy Cookie: 888 cookie 7:36 PM: guest@888[2].txt (ID = 2019) 7:36 PM: Found Spy Cookie: aa cookie 7:36 PM: guest@aa[2].txt (ID = 2029) 7:36 PM: Found Spy Cookie: go.com cookie 7:36 PM: guest@abc.go[2].txt (ID = 2729) 7:36 PM: guest@abcfamily.go[1].txt (ID = 2729) 7:36 PM: guest@abclocal.go[1].txt (ID = 2729) 7:36 PM: guest@abcnews.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: abetterinternet cookie 7:36 PM: guest@abetterinternet[1].txt (ID = 2035) 7:36 PM: Found Spy Cookie: about cookie 7:36 PM: guest@about[2].txt (ID = 2037) 7:36 PM: Found Spy Cookie: ad-rotator cookie 7:36 PM: guest@ad-rotator[1].txt (ID = 2051) 7:36 PM: Found Spy Cookie: yieldmanager cookie 7:36 PM: guest@ad.yieldmanager[2].txt (ID = 3751) 7:36 PM: Found Spy Cookie: adknowledge cookie 7:36 PM: guest@adknowledge[2].txt (ID = 2072) 7:36 PM: Found Spy Cookie: adlegend cookie 7:36 PM: guest@adlegend[1].txt (ID = 2074) 7:36 PM: Found Spy Cookie: specificclick.com cookie 7:36 PM: guest@adopt.specificclick[2].txt (ID = 3400) 7:36 PM: Found Spy Cookie: adorigin cookie 7:36 PM: guest@adorigin[2].txt (ID = 2082) 7:36 PM: Found Spy Cookie: adrevservice cookie 7:36 PM: guest@adrevservice[1].txt (ID = 2091) 7:36 PM: guest@ads.adorigin[1].txt (ID = 2083) 7:36 PM: Found Spy Cookie: cardomain cookie 7:36 PM: guest@ads.cardomain[1].txt (ID = 2351) 7:36 PM: Found Spy Cookie: euniverseads cookie 7:36 PM: guest@ads.euniverseads[2].txt (ID = 2630) 7:36 PM: Found Spy Cookie: gorillanation cookie 7:36 PM: guest@ads.gorillanation[1].txt (ID = 2744) 7:36 PM: guest@ads.specificclick[1].txt (ID = 3400) 7:36 PM: Found Spy Cookie: advertising cookie 7:36 PM: guest@advertising[2].txt (ID = 2175) 7:36 PM: Found Spy Cookie: affiliate cookie 7:36 PM: guest@affiliate[1].txt (ID = 2199) 7:36 PM: guest@architecture.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: askmen cookie 7:36 PM: guest@askmen[1].txt (ID = 2247) 7:36 PM: Found Spy Cookie: ask cookie 7:36 PM: guest@ask[2].txt (ID = 2245) 7:36 PM: Found Spy Cookie: belnk cookie 7:36 PM: guest@ath.belnk[2].txt (ID = 2293) 7:36 PM: Found Spy Cookie: atwola cookie 7:36 PM: guest@atwola[1].txt (ID = 2255) 7:36 PM: guest@autobuy.about[2].txt (ID = 2038) 7:36 PM: Found Spy Cookie: a cookie 7:36 PM: guest@a[1].txt (ID = 2027) 7:36 PM: guest@a[3].txt (ID = 2027) 7:36 PM: Found Spy Cookie: megago cookie 7:36 PM: guest@bambergvr6.freeservers[2].txt (ID = 2983) 7:36 PM: Found Spy Cookie: inet-traffic.com cookie 7:36 PM: guest@banner1.inet-traffic[2].txt (ID = 2856) 7:36 PM: guest@banner2.inet-traffic[2].txt (ID = 2856) 7:36 PM: Found Spy Cookie: banner cookie 7:36 PM: guest@banner[1].txt (ID = 2276) 7:36 PM: guest@belnk[1].txt (ID = 2292) 7:36 PM: Found Spy Cookie: bestmovies cookie 7:36 PM: guest@bestmovies[1].txt (ID = 2298) 7:36 PM: Found Spy Cookie: bizrate cookie 7:36 PM: guest@bizrate[1].txt (ID = 2308) 7:36 PM: Found Spy Cookie: enhance cookie 7:36 PM: guest@c.enhance[1].txt (ID = 2614) 7:36 PM: Found Spy Cookie: barelylegal cookie 7:36 PM: guest@c.fsx[1].txt (ID = 2286) 7:36 PM: Found Spy Cookie: gostats cookie 7:36 PM: guest@c1.gostats[2].txt (ID = 2748) 7:36 PM: guest@c2.gostats[2].txt (ID = 2748) 7:36 PM: guest@cardomain[1].txt (ID = 2350) 7:36 PM: Found Spy Cookie: ccbill cookie 7:36 PM: guest@ccbill[2].txt (ID = 2369) 7:36 PM: Found Spy Cookie: cgi-win cookie 7:36 PM: guest@cgi-win[1].txt (ID = 2376) 7:36 PM: Found Spy Cookie: commission junction cookie 7:36 PM: guest@cj[2].txt (ID = 2453) 7:36 PM: Found Spy Cookie: classmates cookie 7:36 PM: guest@classmates[1].txt (ID = 2384) 7:36 PM: Found Spy Cookie: cliks cookie 7:36 PM: guest@cliks[1].txt (ID = 2414) 7:36 PM: Found Spy Cookie: counter cookie 7:36 PM: guest@counter[1].txt (ID = 2477) 7:36 PM: Found Spy Cookie: customer cookie 7:36 PM: guest@customer[1].txt (ID = 2481) 7:36 PM: guest@customer[2].txt (ID = 2481) 7:36 PM: Found Spy Cookie: clickzs cookie 7:36 PM: guest@cz3.clickzs[1].txt (ID = 2413) 7:36 PM: guest@cz4.clickzs[2].txt (ID = 2413) 7:36 PM: guest@cz6.clickzs[2].txt (ID = 2413) 7:36 PM: guest@cz7.clickzs[1].txt (ID = 2413) 7:36 PM: Found Spy Cookie: webtrendslive cookie 7:36 PM: guest@dcs8ir0f010000oyioyaka1kl_8j7n[1].txt (ID = 3673) 7:36 PM: Found Spy Cookie: dealtime cookie 7:36 PM: guest@dealtime[2].txt (ID = 2505) 7:36 PM: guest@delivery.inet-traffic[2].txt (ID = 2856) 7:36 PM: guest@disney.go[2].txt (ID = 2729) 7:36 PM: guest@disney.store.go[2].txt (ID = 2729) 7:36 PM: guest@disneyland.disney.go[1].txt (ID = 2729) 7:36 PM: guest@dist.belnk[1].txt (ID = 2293) 7:36 PM: Found Spy Cookie: dlmax cookie 7:36 PM: guest@dlm.dlmax[2].txt (ID = 2532) 7:36 PM: Found Spy Cookie: dl cookie 7:36 PM: guest@dl[1].txt (ID = 2529) 7:36 PM: Found Spy Cookie: rn11 cookie 7:36 PM: guest@e.rn11[2].txt (ID = 3262) 7:36 PM: Found Spy Cookie: howstuffworks cookie 7:36 PM: guest@electronics.howstuffworks[1].txt (ID = 2806) 7:36 PM: guest@espn.go[2].txt (ID = 2729) 7:36 PM: Found Spy Cookie: exitexchange cookie 7:36 PM: guest@exitexchange[1].txt (ID = 2633) 7:36 PM: Found Spy Cookie: exitfuel cookie 7:36 PM: guest@exitfuel[2].txt (ID = 2635) 7:36 PM: Found Spy Cookie: expage cookie 7:36 PM: guest@expage[1].txt (ID = 2637) 7:36 PM: Found Spy Cookie: wegcash cookie 7:36 PM: guest@free.wegcash[2].txt (ID = 3682) 7:36 PM: guest@games.espn.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: gangbangsquad cookie 7:36 PM: guest@gangbangsquad[1].txt (ID = 2720) 7:36 PM: Found Spy Cookie: gator cookie 7:36 PM: guest@gator[2].txt (ID = 2722) 7:36 PM: guest@geography.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: touchclarity cookie 7:36 PM: guest@gm.touchclarity[1].txt (ID = 3566) 7:36 PM: Found Spy Cookie: go2net.com cookie 7:36 PM: guest@go2net[1].txt (ID = 2730) 7:36 PM: guest@gojapan.about[2].txt (ID = 2038) 7:36 PM: guest@gostats[2].txt (ID = 2747) 7:36 PM: Found Spy Cookie: gotoast cookie 7:36 PM: guest@gotoast[2].txt (ID = 2751) 7:36 PM: guest@go[1].txt (ID = 2728) 7:36 PM: Found Spy Cookie: herfirstlesbiansex cookie 7:36 PM: guest@herfirstlesbiansex[1].txt (ID = 2771) 7:36 PM: Found Spy Cookie: dbbsrv cookie 7:36 PM: guest@hotbabes.com.19522.fb.dbbsrv[1].txt (ID = 2500) 7:36 PM: Found Spy Cookie: hotbar cookie 7:36 PM: guest@hotbar[2].txt (ID = 2797) 7:36 PM: guest@howstuffworks[2].txt (ID = 2805) 7:36 PM: Found Spy Cookie: hypertracker.com cookie 7:36 PM: guest@hypertracker[2].txt (ID = 2817) 7:36 PM: Found Spy Cookie: ic-live cookie 7:36 PM: guest@ic-live[1].txt (ID = 2821) 7:36 PM: Found Spy Cookie: infospace cookie 7:36 PM: guest@infospace[2].txt (ID = 2865) 7:36 PM: guest@insider.espn.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: kinghost cookie 7:36 PM: guest@kinghost[2].txt (ID = 2903) 7:36 PM: Found Spy Cookie: kount cookie 7:36 PM: guest@kount[2].txt (ID = 2911) 7:36 PM: Found Spy Cookie: l2m.net cookie 7:36 PM: guest@l2m[1].txt (ID = 2913) 7:36 PM: guest@lifeaquatic.movies.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: livestat cookie 7:36 PM: guest@livestat[1].txt (ID = 2930) 7:36 PM: Found Spy Cookie: ugo cookie 7:36 PM: guest@mediamgr.ugo[2].txt (ID = 3609) 7:36 PM: Found Spy Cookie: mensniche cookie 7:36 PM: guest@mensniche[1].txt (ID = 2986) 7:36 PM: Found Spy Cookie: metareward.com cookie 7:36 PM: guest@metareward[2].txt (ID = 2990) 7:36 PM: Found Spy Cookie: military cookie 7:36 PM: guest@military[2].txt (ID = 2996) 7:36 PM: guest@movies.go[2].txt (ID = 2729) 7:36 PM: Found Spy Cookie: mp3downloadhq cookie 7:36 PM: guest@mp3downloadhq[2].txt (ID = 3014) 7:36 PM: Found Spy Cookie: mrskin cookie 7:36 PM: guest@mrskin[2].txt (ID = 3020) 7:36 PM: guest@msn.espn.go[1].txt (ID = 2729) 7:36 PM: guest@msn.sports.espn.go[2].txt (ID = 2729) 7:36 PM: guest@msnportal.112.2o7[1].txt (ID = 1958) 7:36 PM: Found Spy Cookie: nextag cookie 7:36 PM: guest@nextag[2].txt (ID = 5014) 7:36 PM: Found Spy Cookie: nuker cookie 7:36 PM: guest@nuker[2].txt (ID = 3085) 7:36 PM: Found Spy Cookie: offeroptimizer cookie 7:36 PM: guest@offeroptimizer[1].txt (ID = 3087) 7:36 PM: Found Spy Cookie: outster cookie 7:36 PM: guest@outster[2].txt (ID = 3103) 7:36 PM: guest@pictures.ask[2].txt (ID = 2246) 7:36 PM: guest@pittsburgh.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: mircx cookie 7:36 PM: guest@pop.mircx[1].txt (ID = 2998) 7:36 PM: Found Spy Cookie: pricegrabber cookie 7:36 PM: guest@pricegrabber[1].txt (ID = 3185) 7:36 PM: guest@programs.wegcash[2].txt (ID = 3682) 7:36 PM: Found Spy Cookie: pub cookie 7:36 PM: guest@pub[2].txt (ID = 3205) 7:36 PM: Found Spy Cookie: rc cookie 7:36 PM: guest@rc[1].txt (ID = 3231) 7:36 PM: guest@register.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: rightmedia cookie 7:36 PM: guest@rightmedia[1].txt (ID = 3259) 7:36 PM: Found Spy Cookie: adjuggler cookie 7:36 PM: guest@rotator.adjuggler[2].txt (ID = 2071) 7:36 PM: guest@rsi.espn.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: tvguide cookie 7:36 PM: guest@rsi.tvguide[1].txt (ID = 3600) 7:36 PM: guest@search.abc.go[1].txt (ID = 2729) 7:36 PM: Found Spy Cookie: search123 cookie 7:36 PM: guest@search123[1].txt (ID = 3305) 7:36 PM: Found Spy Cookie: adscpm cookie 7:36 PM: guest@servedby.adscpm[1].txt (ID = 2137) 7:36 PM: Found Spy Cookie: web-stat cookie 7:36 PM: guest@server3.web-stat[2].txt (ID = 3649) 7:36 PM: Found Spy Cookie: serving-sys cookie 7:36 PM: guest@serving-sys[1].txt (ID = 3343) 7:36 PM: Found Spy Cookie: servlet cookie 7:36 PM: guest@servlet[1].txt (ID = 3345) 7:36 PM: guest@servlet[2].txt (ID = 3345) 7:36 PM: guest@servlet[3].txt (ID = 3345) 7:36 PM: Found Spy Cookie: sexsearch cookie 7:36 PM: guest@sexsearch[1].txt (ID = 3357) 7:36 PM: Found Spy Cookie: smni cookie 7:36 PM: guest@smni[1].txt (ID = 3389) 7:36 PM: Found Spy Cookie: socalcoeds.com cookie 7:36 PM: guest@socalcoeds[2].txt (ID = 3393) 7:36 PM: Found Spy Cookie: specificpop cookie 7:36 PM: guest@specificpop[2].txt (ID = 3401) 7:36 PM: guest@sports-att.espn.go[2].txt (ID = 2729) 7:36 PM: guest@sports.espn.go[2].txt (ID = 2729) 7:36 PM: Found Spy Cookie: starpulse cookie 7:36 PM: guest@starpulse[1].txt (ID = 3439) 7:36 PM: guest@stat.dealtime[1].txt (ID = 2506) 7:36 PM: Found Spy Cookie: stats.klsoft.com cookie 7:36 PM: guest@stats.klsoft[1].txt (ID = 3451) 7:36 PM: Found Spy Cookie: clicktracks cookie 7:36 PM: guest@stats2.clicktracks[2].txt (ID = 2407) 7:36 PM: Found Spy Cookie: teensforcash cookie 7:36 PM: guest@teensforcash[1].txt (ID = 3509) 7:36 PM: guest@teentvmovies.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: toplist cookie 7:36 PM: guest@toplist[1].txt (ID = 3557) 7:36 PM: guest@toplist[2].txt (ID = 3557) 7:36 PM: guest@toplist[4].txt (ID = 3557) 7:36 PM: guest@toplist[5].txt (ID = 3557) 7:36 PM: Found Spy Cookie: tracking cookie 7:36 PM: guest@tracking[2].txt (ID = 3571) 7:36 PM: guest@tracking[3].txt (ID = 3571) 7:36 PM: Found Spy Cookie: trb.com cookie 7:36 PM: guest@trb[1].txt (ID = 3587) 7:36 PM: guest@trucks.about[1].txt (ID = 2038) 7:36 PM: guest@tvguide[2].txt (ID = 3599) 7:36 PM: guest@vip.clickzs[2].txt (ID = 2413) 7:36 PM: guest@web.ask[2].txt (ID = 2246) 7:36 PM: Found Spy Cookie: tickle cookie 7:36 PM: guest@web.tickle[1].txt (ID = 3530) 7:36 PM: Found Spy Cookie: webpower cookie 7:36 PM: guest@webpower[2].txt (ID = 3660) 7:36 PM: Found Spy Cookie: webservicehosts cookie 7:36 PM: guest@webservicehosts[1].txt (ID = 3662) 7:36 PM: Found Spy Cookie: wirefly cookie 7:36 PM: guest@wirefly[1].txt (ID = 3693) 7:36 PM: Found Spy Cookie: adminder cookie 7:36 PM: guest@www.adminder[2].txt (ID = 2079) 7:36 PM: Found Spy Cookie: adshooter cookie 7:36 PM: guest@www.adshooter[1].txt (ID = 2150) 7:36 PM: Found Spy Cookie: adultxxxpornstars cookie 7:36 PM: guest@www.adultxxxpornstars[1].txt (ID = 2170) 7:36 PM: Found Spy Cookie: affiliatefuel.com cookie 7:36 PM: guest@www.affiliatefuel[1].txt (ID = 2202) 7:36 PM: Found Spy Cookie: burstbeacon cookie 7:36 PM: guest@www.burstbeacon[1].txt (ID = 2335) 7:36 PM: guest@www.cardomain[2].txt (ID = 2351) 7:36 PM: Found Spy Cookie: epilot cookie 7:36 PM: guest@www.epilot[1].txt (ID = 2622) 7:36 PM: Found Spy Cookie: esurance cookie 7:36 PM: guest@www.esurance[1].txt (ID = 2626) 7:36 PM: guest@www.expage[1].txt (ID = 2638) 7:36 PM: Found Spy Cookie: eyeblaster cookie 7:36 PM: guest@www.eyeblaster-ds[1].txt (ID = 2644) 7:36 PM: Found Spy Cookie: freemoviesanddownloads cookie 7:36 PM: guest@www.freemoviesanddownloads[2].txt (ID = 2701) 7:36 PM: guest@www.gangbangsquad[1].txt (ID = 2721) 7:36 PM: guest@www.herfirstlesbiansex[1].txt (ID = 2772) 7:36 PM: guest@www.howstuffworks[1].txt (ID = 2806) 7:36 PM: guest@www.military[2].txt (ID = 2997) 7:36 PM: guest@www.mrskin[2].txt (ID = 3021) 7:36 PM: Found Spy Cookie: myaffiliateprogram.com cookie 7:36 PM: guest@www.myaffiliateprogram[1].txt (ID = 3032) 7:36 PM: Found Spy Cookie: naughtyplayer cookie 7:36 PM: guest@www.naughtyplayer[2].txt (ID = 3058) 7:36 PM: guest@www.nextag[1].txt (ID = 5015) 7:36 PM: Found Spy Cookie: rednova cookie 7:36 PM: guest@www.rednova[2].txt (ID = 3246) 7:36 PM: Found Spy Cookie: screensavers.com cookie 7:36 PM: guest@www.screensavers[1].txt (ID = 3298) 7:36 PM: Found Spy Cookie: teenax cookie 7:36 PM: guest@www.teenax[1].txt (ID = 3504) 7:36 PM: guest@www.teensforcash[2].txt (ID = 3510) 7:36 PM: guest@www.tvguide[1].txt (ID = 3600) 7:36 PM: guest@www.web-stat[2].txt (ID = 3649) 7:36 PM: guest@www.wirefly[1].txt (ID = 3694) 7:36 PM: Found Spy Cookie: xxx69 cookie 7:36 PM: guest@www.xxx69[1].txt (ID = 3732) 7:36 PM: Found Spy Cookie: xzoomy cookie 7:36 PM: guest@www.xzoomy[1].txt (ID = 3742) 7:36 PM: guest@www1.adultxxxpornstars[2].txt (ID = 2170) 7:36 PM: guest@www3.nextag[1].txt (ID = 5015) 7:36 PM: Found Spy Cookie: xiti cookie 7:36 PM: guest@xiti[2].txt (ID = 3717) 7:36 PM: Found Spy Cookie: yadro cookie 7:36 PM: guest@yadro[1].txt (ID = 3743) 7:36 PM: guest@yieldmanager[2].txt (ID = 3749) 7:36 PM: dad's account@888[1].txt (ID = 2019) 7:36 PM: dad's account@888[2].txt (ID = 2019) 7:36 PM: Found Spy Cookie: websponsors cookie 7:36 PM: dad's account@a.websponsors[1].txt (ID = 3665) 7:36 PM: dad's account@about[1].txt (ID = 2037) 7:36 PM: dad's account@ad.yieldmanager[1].txt (ID = 3751) 7:36 PM: Found Spy Cookie: adecn cookie 7:36 PM: dad's account@adecn[1].txt (ID = 2063) 7:36 PM: dad's account@adknowledge[2].txt (ID = 2072) 7:36 PM: Found Spy Cookie: hbmediapro cookie 7:36 PM: dad's account@adopt.hbmediapro[2].txt (ID = 2768) 7:36 PM: dad's account@adopt.hotbar[2].txt (ID = 4207) 7:36 PM: dad's account@adopt.specificclick[2].txt (ID = 3400) 7:36 PM: Found Spy Cookie: cc214142 cookie 7:36 PM: dad's account@ads.cc214142[2].txt (ID = 2367) 7:36 PM: Found Spy Cookie: adultfriendfinder cookie 7:36 PM: dad's account@adultfriendfinder[1].txt (ID = 2165) 7:36 PM: Found Spy Cookie: tacoda cookie 7:36 PM: dad's account@anat.tacoda[1].txt (ID = 6445) 7:36 PM: dad's account@askmen[2].txt (ID = 2247) 7:36 PM: dad's account@ask[1].txt (ID = 2245) 7:36 PM: dad's account@atwola[2].txt (ID = 2255) 7:36 PM: Found Spy Cookie: azjmp cookie 7:36 PM: dad's account@azjmp[1].txt (ID = 2270) 7:36 PM: dad's account@a[1].txt (ID = 2027) 7:36 PM: dad's account@belnk[1].txt (ID = 2292) 7:36 PM: dad's account@bizrate[1].txt (ID = 2308) 7:36 PM: dad's account@brt.trb[1].txt (ID = 3588) 7:36 PM: Found Spy Cookie: burstnet cookie 7:36 PM: dad's account@burstnet[2].txt (ID = 2336) 7:36 PM: dad's account@c.enhance[1].txt (ID = 2614) 7:36 PM: Found Spy Cookie: goclick cookie 7:36 PM: dad's account@c.goclick[2].txt (ID = 2733) 7:36 PM: dad's account@cardomain[1].txt (ID = 2350) 7:36 PM: Found Spy Cookie: cassava cookie 7:36 PM: dad's account@cassava[1].txt (ID = 2362) 7:36 PM: dad's account@ccbill[1].txt (ID = 2369) 7:36 PM: dad's account@clubmom.122.2o7[1].txt (ID = 1958) 7:36 PM: dad's account@cnn.122.2o7[1].txt (ID = 1958) 7:36 PM: dad's account@customer[1].txt (ID = 2481) 7:36 PM: dad's account@customer[2].txt (ID = 2481) 7:36 PM: dad's account@cz3.clickzs[2].txt (ID = 2413) 7:36 PM: dad's account@cz4.clickzs[2].txt (ID = 2413) 7:36 PM: dad's account@cz7.clickzs[2].txt (ID = 2413) 7:36 PM: Found Spy Cookie: danni cookie 7:36 PM: dad's account@danni[1].txt (ID = 2493) 7:36 PM: Found Spy Cookie: overture cookie 7:36 PM: dad's account@data1.perf.overture[2].txt (ID = 3106) 7:36 PM: dad's account@data2.perf.overture[1].txt (ID = 3106) 7:36 PM: dad's account@data3.perf.overture[1].txt (ID = 3106) 7:36 PM: dad's account@dealtime[2].txt (ID = 2505) 7:36 PM: Found Spy Cookie: did-it cookie 7:36 PM: dad's account@did-it[1].txt (ID = 2523) 7:36 PM: Found Spy Cookie: directtrack cookie 7:36 PM: dad's account@directtrack[1].txt (ID = 2527) 7:36 PM: dad's account@dist.belnk[2].txt (ID = 2293) 7:36 PM: dad's account@exitexchange[1].txt (ID = 2633) 7:36 PM: dad's account@goaustralia.about[1].txt (ID = 2038) 7:36 PM: dad's account@go[1].txt (ID = 2728) 7:36 PM: Found Spy Cookie: starware.com cookie 7:36 PM: dad's account@h.starware[1].txt (ID = 3442) 7:36 PM: Found Spy Cookie: clickandtrack cookie 7:36 PM: dad's account@hits.clickandtrack[2].txt (ID = 2397) 7:36 PM: dad's account@hypertracker[1].txt (ID = 2817) 7:36 PM: dad's account@ic-live[1].txt (ID = 2821) 7:36 PM: dad's account@metacafe.122.2o7[1].txt (ID = 1958) 7:36 PM: dad's account@military[1].txt (ID = 2996) 7:36 PM: dad's account@mrskin[1].txt (ID = 3020) 7:36 PM: dad's account@msnportal.112.2o7[1].txt (ID = 1958) 7:36 PM: dad's account@nextag[2].txt (ID = 5014) 7:36 PM: dad's account@offeroptimizer[2].txt (ID = 3087) 7:36 PM: dad's account@partygaming.122.2o7[1].txt (ID = 1958) 7:36 PM: Found Spy Cookie: partypoker cookie 7:36 PM: dad's account@partypoker[2].txt (ID = 3111) 7:36 PM: Found Spy Cookie: passion cookie 7:36 PM: dad's account@passion[2].txt (ID = 3113) 7:36 PM: Found Spy Cookie: paypopup cookie 7:36 PM: dad's account@paypopup[2].txt (ID = 3119) 7:36 PM: dad's account@rapidresponse.directtrack[2].txt (ID = 2528) 7:36 PM: dad's account@rotator.adjuggler[2].txt (ID = 2071) 7:36 PM: Found Spy Cookie: searchadnetwork cookie 7:36 PM: dad's account@searchadnetwork[2].txt (ID = 3311) 7:36 PM: dad's account@stat.dealtime[2].txt (ID = 2506) 7:36 PM: Found Spy Cookie: reliablestats cookie 7:36 PM: dad's account@stats1.reliablestats[2].txt (ID = 3254) 7:36 PM: dad's account@tacoda[2].txt (ID = 6444) 7:36 PM: dad's account@toplist[1].txt (ID = 3557) 7:36 PM: dad's account@trb[2].txt (ID = 3587) 7:36 PM: Found Spy Cookie: upspiral cookie 7:36 PM: dad's account@upspiral[1].txt (ID = 3614) 7:36 PM: dad's account@usautoparts.122.2o7[1].txt (ID = 1958) 7:36 PM: Found Spy Cookie: videodome cookie 7:36 PM: dad's account@videodome[1].txt (ID = 3638) 7:36 PM: dad's account@volkswagen.122.2o7[1].txt (ID = 1958) 7:36 PM: dad's account@www.burstbeacon[2].txt (ID = 2335) 7:36 PM: dad's account@www.dealtime[2].txt (ID = 2506) 7:36 PM: dad's account@www.mrskin[1].txt (ID = 3021) 7:36 PM: dad's account@www.myaffiliateprogram[1].txt (ID = 3032) 7:36 PM: dad's account@www.searchadnetwork[1].txt (ID = 3312) 7:36 PM: dad's account@www.starpulse[2].txt (ID = 3440) 7:36 PM: dad's account@www.starware[1].txt (ID = 3442) 7:36 PM: dad's account@www.upspiral[2].txt (ID = 3615) 7:36 PM: dad's account@xiti[1].txt (ID = 3717) 7:36 PM: dad's account@yieldmanager[1].txt (ID = 3749) 7:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:36 PM: user1@112.2o7[1].txt (ID = 1958) 7:36 PM: Found Spy Cookie: 123count cookie 7:36 PM: user1@123count[2].txt (ID = 1927) 7:36 PM: Found Spy Cookie: 3 cookie 7:36 PM: user1@3[1].txt (ID = 1959) 7:36 PM: Found Spy Cookie: 447 cookie 7:36 PM: user1@447[2].txt (ID = 1973) 7:36 PM: Found Spy Cookie: 5 cookie 7:36 PM: user1@5[1].txt (ID = 1979) 7:36 PM: user1@64.62.232[1].txt (ID = 1987) 7:36 PM: user1@64.62.232[2].txt (ID = 1987) 7:36 PM: user1@64.62.232[3].txt (ID = 1987) 7:36 PM: user1@64.62.232[4].txt (ID = 1987) 7:36 PM: user1@64.62.232[5].txt (ID = 1987) 7:36 PM: user1@80music.about[2].txt (ID = 2038) 7:36 PM: user1@888[2].txt (ID = 2019) 7:36 PM: user1@888[3].txt (ID = 2019) 7:36 PM: user1@a.websponsors[2].txt (ID = 3665) 7:36 PM: user1@aa[2].txt (ID = 2029) 7:36 PM: user1@abc.go[2].txt (ID = 2729) 7:36 PM: user1@abetterinternet[1].txt (ID = 2035) 7:36 PM: user1@abetterinternet[2].txt (ID = 2035) 7:36 PM: user1@abetterinternet[4].txt (ID = 2035) 7:36 PM: user1@about[1].txt (ID = 2037) 7:36 PM: user1@ad-rotator[2].txt (ID = 2051) 7:36 PM: Found Spy Cookie: reunion cookie 7:36 PM: user1@ad.reunion[1].txt (ID = 3256) 7:36 PM: user1@ad.yieldmanager[2].txt (ID = 3751) 7:36 PM: user1@ad2.adecn[1].txt (ID = 2064) 7:36 PM: user1@adecn[2].txt (ID = 2063) 7:36 PM: user1@adknowledge[2].txt (ID = 2072) 7:36 PM: user1@adlegend[1].txt (ID = 2074) 7:36 PM: user1@adopt.hbmediapro[1].txt (ID = 2768) 7:36 PM: Found Spy Cookie: precisead cookie 7:36 PM: user1@adopt.precisead[2].txt (ID = 3182) 7:36 PM: user1@adopt.specificclick[1].txt (ID = 3400) 7:36 PM: Found Spy Cookie: adprofile cookie 7:36 PM: user1@adprofile[2].txt (ID = 2084) 7:36 PM: user1@ads.cc214142[2].txt (ID = 2367) 7:36 PM: user1@ads.euniverseads[1].txt (ID = 2630) 7:36 PM: user1@ads.gorillanation[1].txt (ID = 2744) 7:36 PM: Found Spy Cookie: bpath cookie 7:36 PM: user1@ads21.bpath[2].txt (ID = 2321) 7:36 PM: user1@advertising[2].txt (ID = 2175) 7:36 PM: user1@affiliate[1].txt (ID = 2199) 7:36 PM: user1@altreligion.about[1].txt (ID = 2038) 7:36 PM: user1@anat.tacoda[2].txt (ID = 6445) 7:36 PM: user1@anheuserbusch.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@ar.atwola[2].txt (ID = 2256) 7:36 PM: Found Spy Cookie: casalemedia cookie 7:36 PM: user1@as.casalemedia[1].txt (ID = 2355) 7:36 PM: user1@ask[2].txt (ID = 2245) 7:36 PM: user1@ath.belnk[1].txt (ID = 2293) 7:36 PM: user1@atwola[2].txt (ID = 2255) 7:36 PM: user1@austin.about[1].txt (ID = 2038) 7:36 PM: user1@azjmp[2].txt (ID = 2270) 7:36 PM: user1@a[1].txt (ID = 2027) 7:36 PM: user1@a[3].txt (ID = 2027) 7:36 PM: user1@a[4].txt (ID = 2027) 7:36 PM: user1@backtoschool.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: bannerspace cookie 7:36 PM: user1@bannerspace[2].txt (ID = 2284) 7:36 PM: user1@banner[1].txt (ID = 2276) 7:36 PM: user1@beauty.about[1].txt (ID = 2038) 7:36 PM: user1@belnk[2].txt (ID = 2292) 7:36 PM: user1@bizrate[2].txt (ID = 2308) 7:36 PM: user1@brt.trb[1].txt (ID = 3588) 7:36 PM: user1@bsc.cards.go[1].txt (ID = 2729) 7:36 PM: user1@buenavistarecords.go[1].txt (ID = 2729) 7:36 PM: user1@burstnet[1].txt (ID = 2336) 7:36 PM: user1@businessmajors.about[1].txt (ID = 2038) 7:36 PM: user1@buycom.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@c.enhance[1].txt (ID = 2614) 7:36 PM: user1@c2.gostats[1].txt (ID = 2748) 7:36 PM: user1@cardomain[2].txt (ID = 2350) 7:36 PM: user1@casalemedia[2].txt (ID = 2354) 7:36 PM: user1@cassava[1].txt (ID = 2362) 7:36 PM: user1@catholicism.about[1].txt (ID = 2038) 7:36 PM: user1@cbs.112.2o7[1].txt (ID = 1958) 7:36 PM: user1@ccbill[2].txt (ID = 2369) 7:36 PM: user1@cellphones.about[2].txt (ID = 2038) 7:36 PM: user1@chemistry.about[1].txt (ID = 2038) 7:36 PM: user1@christianity.about[2].txt (ID = 2038) 7:36 PM: user1@christianmusic.about[1].txt (ID = 2038) 7:36 PM: user1@classmates[2].txt (ID = 2384) 7:36 PM: user1@cliks[1].txt (ID = 2414) 7:36 PM: user1@cliks[3].txt (ID = 2414) 7:36 PM: user1@cnn.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@cookie.tickle[1].txt (ID = 3530) 7:36 PM: user1@crime.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: 360i cookie 7:36 PM: user1@ct.360i[2].txt (ID = 1962) 7:36 PM: user1@customer[1].txt (ID = 2481) 7:36 PM: user1@customer[2].txt (ID = 2481) 7:36 PM: user1@customer[3].txt (ID = 2481) 7:36 PM: user1@customer[4].txt (ID = 2481) 7:36 PM: user1@cz3.clickzs[1].txt (ID = 2413) 7:36 PM: user1@cz6.clickzs[1].txt (ID = 2413) 7:36 PM: user1@data1.perf.overture[2].txt (ID = 3106) 7:36 PM: user1@data3.perf.overture[1].txt (ID = 3106) 7:36 PM: user1@data4.perf.overture[1].txt (ID = 3106) 7:36 PM: user1@dc.touchclarity[1].txt (ID = 3566) 7:36 PM: user1@dealtime[2].txt (ID = 2505) 7:36 PM: user1@did-it[2].txt (ID = 2523) 7:36 PM: user1@directtrack[1].txt (ID = 2527) 7:36 PM: user1@disney.go[2].txt (ID = 2729) 7:36 PM: user1@disney.store.go[1].txt (ID = 2729) 7:36 PM: user1@disneyland.disney.go[1].txt (ID = 2729) 7:36 PM: user1@disneyshopping.go[1].txt (ID = 2729) 7:36 PM: user1@dist.belnk[2].txt (ID = 2293) 7:36 PM: user1@dlm.dlmax[2].txt (ID = 2532) 7:36 PM: user1@dr.webservicehosts[2].txt (ID = 3663) 7:36 PM: user1@e.rn11[1].txt (ID = 3262) 7:36 PM: Found Spy Cookie: ru4 cookie 7:36 PM: user1@edge.ru4[2].txt (ID = 3269) 7:36 PM: user1@efashionsolutions.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@emimusic.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@entrepreneur.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@entrepreneurs.about[2].txt (ID = 2038) 7:36 PM: user1@espn.go[2].txt (ID = 2729) 7:36 PM: user1@exitexchange[1].txt (ID = 2633) 7:36 PM: user1@expage[2].txt (ID = 2637) 7:36 PM: Found Spy Cookie: experclick cookie 7:36 PM: user1@experclick[2].txt (ID = 2639) 7:36 PM: user1@fashion.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: fe.lea.lycos.com cookie 7:36 PM: user1@fe.lea.lycos[1].txt (ID = 2660) 7:36 PM: user1@genealogy.about[1].txt (ID = 2038) 7:36 PM: user1@geography.about[1].txt (ID = 2038) 7:36 PM: user1@go2net[1].txt (ID = 2730) 7:36 PM: user1@gostats[1].txt (ID = 2747) 7:36 PM: user1@gotoast[1].txt (ID = 2751) 7:36 PM: user1@go[2].txt (ID = 2728) 7:36 PM: user1@heartburn.about[1].txt (ID = 2038) 7:36 PM: user1@highbeam.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@hits.clickandtrack[1].txt (ID = 2397) 7:36 PM: user1@howstuffworks[2].txt (ID = 2805) 7:36 PM: user1@ic-live[1].txt (ID = 2821) 7:36 PM: user1@infospace[2].txt (ID = 2865) 7:36 PM: user1@inventors.about[1].txt (ID = 2038) 7:36 PM: user1@jobsearchtech.about[2].txt (ID = 2038) 7:36 PM: user1@kount[2].txt (ID = 2911) 7:36 PM: user1@l2m[1].txt (ID = 2913) 7:36 PM: user1@littlerock.about[1].txt (ID = 2038) 7:36 PM: user1@mediamgr.ugo[1].txt (ID = 3609) 7:36 PM: user1@metareward[2].txt (ID = 2990) 7:36 PM: user1@microsofteup.112.2o7[2].txt (ID = 1958) 7:36 PM: user1@movies.go[1].txt (ID = 2729) 7:36 PM: user1@msn.espn.go[2].txt (ID = 2729) 7:36 PM: user1@msn.touchclarity[1].txt (ID = 3566) 7:36 PM: user1@msnportal.112.2o7[1].txt (ID = 1958) 7:36 PM: Found Spy Cookie: realmedia cookie 7:36 PM: user1@network.realmedia[2].txt (ID = 3236) 7:36 PM: user1@nextag[2].txt (ID = 5014) 7:36 PM: user1@nuker[2].txt (ID = 3085) 7:36 PM: user1@offeroptimizer[1].txt (ID = 3087) 7:36 PM: user1@offeroptimizer[2].txt (ID = 3087) 7:36 PM: user1@offeroptimizer[3].txt (ID = 3087) 7:36 PM: user1@offeroptimizer[4].txt (ID = 3087) 7:36 PM: user1@offeroptimizer[5].txt (ID = 3087) 7:36 PM: Found Spy Cookie: mygeek cookie 7:36 PM: user1@partners.mygeek[1].txt (ID = 3042) 7:36 PM: Found Spy Cookie: partnerweekly cookie 7:36 PM: user1@partnerweekly[2].txt (ID = 3109) 7:36 PM: user1@partygaming.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@partypoker[2].txt (ID = 3111) 7:36 PM: user1@paypopup[1].txt (ID = 3119) 7:36 PM: user1@photography.about[1].txt (ID = 2038) 7:36 PM: user1@physics.about[1].txt (ID = 2038) 7:36 PM: user1@pricegrabber[2].txt (ID = 3185) 7:36 PM: user1@rapidresponse.directtrack[2].txt (ID = 2528) 7:36 PM: user1@reunion[1].txt (ID = 3255) 7:36 PM: user1@rightmedia[1].txt (ID = 3259) 7:36 PM: user1@rn11[2].txt (ID = 3261) 7:36 PM: user1@rotator.adjuggler[1].txt (ID = 2071) 7:36 PM: user1@rsi.abc.go[1].txt (ID = 2729) 7:36 PM: user1@rsi.espn.go[1].txt (ID = 2729) 7:36 PM: user1@sbinformation.about[1].txt (ID = 2038) 7:36 PM: Found Spy Cookie: domain sponsor cookie 7:36 PM: user1@searchportal.domainsponsor[1].txt (ID = 2534) 7:36 PM: user1@servedby.adscpm[1].txt (ID = 2137) 7:36 PM: user1@server3.web-stat[2].txt (ID = 3649) 7:36 PM: user1@serving-sys[1].txt (ID = 3343) 7:36 PM: user1@servlet[1].txt (ID = 3345) 7:36 PM: user1@servlet[2].txt (ID = 3345) 7:36 PM: user1@specificpop[1].txt (ID = 3401) 7:36 PM: user1@sports.espn.go[2].txt (ID = 2729) 7:36 PM: Found Spy Cookie: stamps.com cookie 7:36 PM: user1@stamps[1].txt (ID = 3437) 7:36 PM: user1@starpulse[1].txt (ID = 3439) 7:36 PM: user1@starware[2].txt (ID = 3441) 7:36 PM: user1@stat.dealtime[2].txt (ID = 2506) 7:36 PM: Found Spy Cookie: statstracking cookie 7:36 PM: user1@stats-tracking[1].txt (ID = 3453) 7:36 PM: user1@stats1.reliablestats[1].txt (ID = 3254) 7:36 PM: user1@tacoda[1].txt (ID = 6444) 7:36 PM: user1@teentvmovies.about[1].txt (ID = 2038) 7:36 PM: user1@toplist[1].txt (ID = 3557) 7:36 PM: user1@tracking[2].txt (ID = 3571) 7:36 PM: user1@tracking[3].txt (ID = 3571) 7:36 PM: Found Spy Cookie: trafficmp cookie 7:36 PM: user1@trafficmp[1].txt (ID = 3581) 7:36 PM: user1@trb[1].txt (ID = 3587) 7:36 PM: user1@tvplex.go[1].txt (ID = 2729) 7:36 PM: user1@usparks.about[2].txt (ID = 2038) 7:36 PM: user1@vitacost.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@volkswagen.122.2o7[1].txt (ID = 1958) 7:36 PM: user1@web.tickle[1].txt (ID = 3530) 7:36 PM: user1@webservicehosts[2].txt (ID = 3662) 7:36 PM: user1@webtracking.touchclarity[1].txt (ID = 3566) 7:36 PM: user1@womenshistory.about[1].txt (ID = 2038) 7:36 PM: user1@www.burstbeacon[1].txt (ID = 2335) 7:36 PM: user1@www.cardomain[1].txt (ID = 2351) 7:36 PM: user1@www.myaffiliateprogram[1].txt (ID = 3032) 7:36 PM: Found Spy Cookie: newtopsites cookie 7:36 PM: user1@www.newtopsites[2].txt (ID = 3078) 7:36 PM: user1@www.screensavers[2].txt (ID = 3298) 7:36 PM: user1@www.stamps[1].txt (ID = 3438) 7:36 PM: user1@www.starpulse[2].txt (ID = 3440) 7:36 PM: Found Spy Cookie: stlyrics cookie 7:36 PM: user1@www.stlyrics[2].txt (ID = 3462) 7:36 PM: user1@www.xzoomy[2].txt (ID = 3742) 7:36 PM: Found Spy Cookie: seeq cookie 7:36 PM: user1@www48.seeq[1].txt (ID = 3332) 7:36 PM: user1@xiti[1].txt (ID = 3717) 7:36 PM: user1@yadro[1].txt (ID = 3743) 7:36 PM: user1@yieldmanager[2].txt (ID = 3749) 7:36 PM: christopher ulep@888[1].txt (ID = 2019) 7:36 PM: christopher ulep@ad.yieldmanager[2].txt (ID = 3751) 7:36 PM: christopher ulep@adopt.specificclick[2].txt (ID = 3400) 7:36 PM: christopher ulep@as.casalemedia[1].txt (ID = 2355) 7:36 PM: christopher ulep@ask[1].txt (ID = 2245) 7:36 PM: christopher ulep@atwola[2].txt (ID = 2255) 7:36 PM: christopher ulep@azjmp[2].txt (ID = 2270) 7:36 PM: christopher ulep@belnk[1].txt (ID = 2292) 7:36 PM: Found Spy Cookie: bluestreak cookie 7:36 PM: christopher ulep@bluestreak[2].txt (ID = 2314) 7:36 PM: christopher ulep@casalemedia[2].txt (ID = 2354) 7:36 PM: christopher ulep@cassava[1].txt (ID = 2362) 7:36 PM: christopher ulep@customer[1].txt (ID = 2481) 7:36 PM: christopher ulep@data1.perf.overture[2].txt (ID = 3106) 7:36 PM: christopher ulep@dist.belnk[2].txt (ID = 2293) 7:36 PM: christopher ulep@ecnext.122.2o7[1].txt (ID = 1958) 7:36 PM: christopher ulep@entrepreneur.122.2o7[1].txt (ID = 1958) 7:36 PM: christopher ulep@exitexchange[1].txt (ID = 2633) 7:36 PM: christopher ulep@go[1].txt (ID = 2728) 7:36 PM: christopher ulep@hits.clickandtrack[2].txt (ID = 2397) 7:36 PM: christopher ulep@microsoftconsumermarketing.112.2o7[1].txt (ID = 1958) 7:36 PM: christopher ulep@microsofteup.112.2o7[1].txt (ID = 1958) 7:36 PM: christopher ulep@nextag[1].txt (ID = 5014) 7:36 PM: christopher ulep@offeroptimizer[1].txt (ID = 3087) 7:36 PM: christopher ulep@offeroptimizer[2].txt (ID = 3087) 7:36 PM: christopher ulep@realmedia[1].txt (ID = 3235) 7:36 PM: christopher ulep@tacoda[2].txt (ID = 6444) 7:36 PM: christopher ulep@www.burstbeacon[1].txt (ID = 2335) 7:36 PM: christopher ulep@yieldmanager[2].txt (ID = 3749)

#5 imoFLUX

New Member

Authentic Member
14 posts

Posted 21 April 2006 - 12:32 AM

Spy Sweeper Session Log (con't) 7:36 PM: Starting File Sweep 7:37 PM: Found Adware: altnet 7:37 PM: c:\documents and settings\guest\local settings\temp\admcache (2 subtraces) (ID = -2147481437) 7:37 PM: Found Adware: apropos 7:37 PM: c:\documents and settings\guest\local settings\temp\autoupdate0 (2 subtraces) (ID = -2147481415) 7:37 PM: c:\windows\inst (ID = -2147480086) 7:37 PM: c:\program files\e2g (ID = -2147481074) 7:37 PM: c:\documents and settings\dad's account\local settings\temp\atf (ID = -2147481416) 7:37 PM: c:\program files\sysprotect (1 subtraces) (ID = -2147451366) 7:37 PM: c:\documents and settings\guest\local settings\temp\~apropos0 (6 subtraces) (ID = -2147481414) 7:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:38 PM: Found Adware: dollarrevenue 7:38 PM: drsmartload45a[1].exe (ID = 282332) 7:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:40 PM: Found Adware: targetsaver 7:40 PM: tsupdate2[2].ini (ID = 193498) 7:41 PM: drsmartload[1].exe (ID = 283447) 7:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:42 PM: ppq2d.tmp (ID = 64354) 7:42 PM: setup.inf (ID = 50158) 7:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:43 PM: keyboard11[1].exe (ID = 283448) 7:43 PM: mousepad11[1].exe (ID = 283449) 7:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:43 PM: newname11[1].exe (ID = 283451) 7:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:49 PM: Found Adware: surfsidekick 7:49 PM: bk.exe (ID = 283452) 7:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:50 PM: Warning: Failed to open file "c:\recycler\\info2". The system cannot find the file specified 7:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:51 PM: 3cafa44e-5323-4174-b27a-d0e747 (ID = 50083) 7:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:56 PM: Found Adware: zquest 7:56 PM: win.exe (ID = 269842) 7:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:59 PM: Found Adware: clearsearch 7:59 PM: 7d418aa1-5d17-40c8-abc8-8e5b19 (ID = 224) 7:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:00 PM: 19912ddd-f9b0-48d3-b043-1e98f4 (ID = 50083) 8:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:02 PM: fb27df47-f70c-4109-a0d3-f8b4d0 (ID = 50083) 8:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:03 PM: 02cb9810-4952-449d-ab17-b663ee (ID = 50083) 8:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:08 PM: adm4.inf (ID = 49781) 8:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:09 PM: Found Adware: webhancer 8:09 PM: 74364011-b3d8-4850-83f7-bfc765 (ID = 188787) 8:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:10 PM: Found Adware: elitemediagroup-mediamotor 8:10 PM: winspy.exe (ID = 251295) 8:10 PM: unwn.exe (ID = 268798) 8:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:10 PM: 247f7c11-8d8d-474c-a894-0dd722 (ID = 50179) 8:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:12 PM: e36f9c92-24e1-4297-9b6f-de2a72 (ID = 50179) 8:12 PM: 0424b61c-8912-45c5-92aa-3b7b74 (ID = 50083) 8:12 PM: installerwnus[1].exe (ID = 271215) 8:12 PM: 6239817b-b973-4a21-85fa-b797b3 (ID = 50185) 8:12 PM: edcbfe94-84d0-415c-b8f2-0f2e8b (ID = 50185) 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: pre1.exe (ID = 268848) 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:14 PM: ykhor.dat (ID = 268995) 8:14 PM: cdffa3ad-d462-4393-8477-f549ae (ID = 50086) 8:15 PM: da0fd0ab-6e44-4b42-a368-860a6f (ID = 50086) 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:16 PM: b7c82708-0fa6-4f05-ac59-6b02ee (ID = 50083) 8:16 PM: enhtb.exe (ID = 63347) 8:16 PM: 19f426f8-fd82-48b0-a08d-7897de (ID = 50185) 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: Found Adware: look2me 8:17 PM: guard.tmp (ID = 159) 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:17 PM: ia0.tmp (ID = 253411) 8:17 PM: dcbe7a5c-619a-452f-9d79-55f681 (ID = 50179) 8:18 PM: p6n80g5ue6.dll (ID = 159) 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:18 PM: en84l1lq1.dll (ID = 159) 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: lmbmp13n.dll (ID = 159) 8:20 PM: temp.fr3bc7 (ID = 159) 8:20 PM: enrql1951.dll (ID = 159) 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: 14091b02-242c-4766-83c1-2cb886 (ID = 50086) 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:21 PM: newrsfr.dll (ID = 159) 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: b4dc787d-68f3-4215-afc8-285edf (ID = 50185) 8:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:22 PM: guard.tmp_tobedeleted (ID = 159) 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: temp.fr5e80 (ID = 159) 8:23 PM: bttsprx3.dll (ID = 159) 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:23 PM: 00c41d81-2ec9-4cc1-942d-7b736b (ID = 50087) 8:23 PM: 93805f45-7159-4cbf-a135-1b224d (ID = 50086) 8:23 PM: 2ad56d7c-5167-4adc-b958-6fd50d (ID = 50087) 8:23 PM: temp.fr01e0 (ID = 159) 8:24 PM: dhu.exe (ID = 269844) 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: 0a0fbd41-8374-4e46-b959-8b3228 (ID = 50086) 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:25 PM: jtlu0739e.dll (ID = 159) 8:25 PM: j44o0eh3eh4.dll (ID = 159) 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:26 PM: 7b3d2dba-044e-493f-836d-2e22b1 (ID = 50086) 8:26 PM: stcbase.dll (ID = 159) 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: adm8.tmp (ID = 49778) 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:28 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: 10bb8054-d34f-4f04-a879-8f3682 (ID = 50086) 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:29 PM: pmf995mon.dll (ID = 159) 8:30 PM: dnpu0179e.dll (ID = 159) 8:30 PM: ii22.exe (ID = 83314) 8:30 PM: ii24.tmp (ID = 51040) 8:30 PM: 30f10075-b403-47d5-a475-d8c2f7 (ID = 50087) 8:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:31 PM: mm_reco.exe (ID = 83380) 8:31 PM: dyime.dll (ID = 159) 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: mm_reco.exe (ID = 83380) 8:32 PM: Found Adware: winantispyware 2005 8:32 PM: setup.exe (ID = 122245) 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:32 PM: 3ecdfa4d-6b8e-4c83-8157-e45e7e (ID = 50179) 8:33 PM: s4880eluehq80.dll (ID = 159) 8:33 PM: ltfll.execommon startup (ID = 268995) 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:33 PM: 679170d0-e344-4adc-8665-e051e8 (ID = 50179) 8:33 PM: class-barrel (ID = 78229) 8:33 PM: 1c288aaa-2507-460f-a21c-ebb0eb (ID = 50179) 8:33 PM: vocabulary (ID = 78283) 8:33 PM: 1b723d30-f0a0-4f52-a0b8-08ff83 (ID = 50087) 8:33 PM: 6e069b93-6268-4e98-83ff-027aee (ID = 50087) 8:34 PM: ir40l5hm1.dll (ID = 159) 8:34 PM: 8a40278b-f846-4064-8607-055e0e (ID = 50086) 8:34 PM: fbd03473-e268-44db-a7bb-1cd492 (ID = 50185) 8:34 PM: widmtpdr.dll (ID = 159) 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:34 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: d6bbc0e3-ba1c-44d5-93aa-653c17 (ID = 50087) 8:35 PM: trembed.dll (ID = 159) 8:35 PM: wadap32.dll (ID = 159) 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:35 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: sscan.sys (ID = 283268) 8:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:36 PM: jvjof.exe (ID = 268934) 8:37 PM: dmonwv.dll (ID = 268799) 8:37 PM: atslwsk.dll (ID = 268933) 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:37 PM: checks02.exe (ID = 251279) 8:37 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || TheMonitor (ID = 0) 8:38 PM: tmskfj.exe (ID = 268995) 8:38 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || sewcfi (ID = 0) 8:38 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1008\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 8:38 PM: HKU\WRSS_Profile_S-1-5-21-516116760-3508293876-2501954535-1007\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 8:38 PM: HKU\S-1-5-21-516116760-3508293876-2501954535-1006\Software\Microsoft\Windows\CurrentVersion\Run || pbeeg (ID = 0) 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: pcheck.dll (ID = 283271) 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:38 PM: ltfll.exe (ID = 268995) 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:39 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:40 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:41 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:42 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: enhuninstall.exe (ID = 63348) 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:43 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: ~sysprotectscannersetup.exe (ID = 283254) 8:44 PM: setup.exe (ID = 283252) 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:44 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: pisfs.dll (ID = 159) 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:45 PM: 3096bb0e-e324-41cc-a10c-4ed18e (ID = 50185) 8:45 PM: 7f15b63b-c443-4282-a77c-0483a8 (ID = 50083) 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:45 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: kjdlt1.dll (ID = 159) 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:46 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:47 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:48 PM: deskbar.ini (ID = 64321) 8:48 PM: Found Adware: exact cashback/bargain buddy 8:48 PM: nls[1].cfg (ID = 138305) 8:48 PM: initial.inf (ID = 64361) 8:48 PM: Warning: Invalid Stream 8:48 PM: Warning: Invalid Stream

#6 imoFLUX

New Member

Authentic Member
14 posts

Posted 21 April 2006 - 12:34 AM

Spy Sweeper Session Log (con't1) 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:49 PM: Warning: Invalid Stream 8:49 PM: Warning: Invalid Stream 8:49 PM: File Sweep Complete, Elapsed Time: 01:12:53 8:49 PM: Full Sweep has completed. Elapsed time 01:18:10 8:49 PM: Traces Found: 2126 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:50 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:51 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:00 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:04 PM: Removal process initiated 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: Quarantining All Traces: clearsearch 9:05 PM: Quarantining All Traces: clkoptimizer 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: clkoptimizer is in use. It will be removed on reboot. 9:05 PM: jvjof.exe is in use. It will be removed on reboot. 9:05 PM: dmonwv.dll is in use. It will be removed on reboot. 9:05 PM: atslwsk.dll is in use. It will be removed on reboot. 9:05 PM: tmskfj.exe is in use. It will be removed on reboot. 9:05 PM: ltfll.exe is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\atslwsk.dll is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\jvjof.exe is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\jvjof.exe is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\jvjof.exe is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\tmskfj.exe is in use. It will be removed on reboot. 9:05 PM: C:\WINDOWS\SYSTEM32\dmonwv.dll is in use. It will be removed on reboot. 9:05 PM: Quarantining All Traces: directrevenue-abetterinternet 9:05 PM: Quarantining All Traces: isearch desktop search 9:05 PM: Quarantining All Traces: look2me 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:05 PM: look2me is in use. It will be removed on reboot. 9:05 PM: en84l1lq1.dll is in use. It will be removed on reboot. 9:05 PM: enrql1951.dll is in use. It will be removed on reboot. 9:05 PM: Quarantining All Traces: lopdotcom 9:05 PM: Quarantining All Traces: purityscan 9:05 PM: Quarantining All Traces: apropos 9:06 PM: Quarantining All Traces: begin2search 9:06 PM: Quarantining All Traces: coolwebsearch (cws) 9:06 PM: Quarantining All Traces: dollarrevenue 9:06 PM: Quarantining All Traces: e2g 9:06 PM: Quarantining All Traces: elitemediagroup-mediamotor 9:06 PM: Quarantining All Traces: enbrowser 9:06 PM: enbrowser is in use. It will be removed on reboot. 9:06 PM: checks02.exe is in use. It will be removed on reboot. 9:06 PM: Quarantining All Traces: isearch toolbar 9:06 PM: Quarantining All Traces: surfsidekick 9:06 PM: Quarantining All Traces: zquest 9:06 PM: Quarantining All Traces: 216.130.185.122 hijack 9:06 PM: Quarantining All Traces: altnet 9:06 PM: Quarantining All Traces: clientman 9:06 PM: Quarantining All Traces: command 9:06 PM: Quarantining All Traces: desktoptraffic 9:06 PM: Quarantining All Traces: drsnsrch.com hijack 9:06 PM: Quarantining All Traces: ebates money maker 9:06 PM: Quarantining All Traces: exact cashback/bargain buddy 9:06 PM: Quarantining All Traces: ezula ilookup 9:06 PM: Quarantining All Traces: ieplugin 9:06 PM: Quarantining All Traces: shopnav.com hijack 9:06 PM: Quarantining All Traces: spyaxe fakealert 9:06 PM: Quarantining All Traces: sysprotect 9:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:06 PM: Quarantining All Traces: targetsaver 9:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:06 PM: Quarantining All Traces: webhancer 9:07 PM: Quarantining All Traces: webrebates 9:07 PM: Quarantining All Traces: 123count cookie 9:07 PM: Quarantining All Traces: 203.199.200 cookie 9:07 PM: Quarantining All Traces: 2o7.net cookie 9:07 PM: Quarantining All Traces: 3 cookie 9:07 PM: Quarantining All Traces: 360i cookie 9:07 PM: Quarantining All Traces: 412 cookie 9:07 PM: Quarantining All Traces: 447 cookie 9:07 PM: Quarantining All Traces: 5 cookie 9:07 PM: Quarantining All Traces: 64.62.232 cookie 9:07 PM: Quarantining All Traces: 888 cookie 9:07 PM: Quarantining All Traces: a cookie 9:07 PM: Quarantining All Traces: aa cookie 9:07 PM: Quarantining All Traces: abetterinternet cookie 9:07 PM: Quarantining All Traces: about cookie 9:07 PM: Quarantining All Traces: adecn cookie 9:07 PM: Quarantining All Traces: adjuggler cookie 9:07 PM: Quarantining All Traces: adknowledge cookie 9:07 PM: Quarantining All Traces: adlegend cookie 9:07 PM: Quarantining All Traces: adminder cookie 9:07 PM: Quarantining All Traces: adorigin cookie 9:07 PM: Quarantining All Traces: adprofile cookie 9:07 PM: Quarantining All Traces: adrevservice cookie 9:07 PM: Quarantining All Traces: ad-rotator cookie 9:07 PM: Quarantining All Traces: adscpm cookie 9:07 PM: Quarantining All Traces: adshooter cookie 9:07 PM: Quarantining All Traces: adultfriendfinder cookie 9:07 PM: Quarantining All Traces: adultxxxpornstars cookie 9:07 PM: Quarantining All Traces: advertising cookie 9:07 PM: Quarantining All Traces: affiliate cookie 9:07 PM: Quarantining All Traces: affiliatefuel.com cookie 9:07 PM: Quarantining All Traces: ask cookie 9:07 PM: Quarantining All Traces: askmen cookie 9:07 PM: Quarantining All Traces: atwola cookie 9:07 PM: Quarantining All Traces: azjmp cookie 9:07 PM: Quarantining All Traces: banner cookie 9:07 PM: Quarantining All Traces: bannerspace cookie 9:07 PM: Quarantining All Traces: barelylegal cookie 9:07 PM: Quarantining All Traces: belnk cookie 9:07 PM: Quarantining All Traces: bestmovies cookie 9:07 PM: Quarantining All Traces: bizrate cookie 9:07 PM: Quarantining All Traces: bluestreak cookie 9:07 PM: Quarantining All Traces: bpath cookie 9:07 PM: Quarantining All Traces: burstbeacon cookie 9:07 PM: Quarantining All Traces: burstnet cookie 9:07 PM: Quarantining All Traces: cardomain cookie 9:07 PM: Quarantining All Traces: casalemedia cookie 9:07 PM: Quarantining All Traces: cassava cookie 9:07 PM: Quarantining All Traces: cc214142 cookie 9:07 PM: Quarantining All Traces: ccbill cookie 9:07 PM: Quarantining All Traces: cgi-win cookie 9:07 PM: Quarantining All Traces: classmates cookie 9:07 PM: Quarantining All Traces: clickandtrack cookie 9:07 PM: Quarantining All Traces: clicktracks cookie 9:07 PM: Quarantining All Traces: clickzs cookie 9:07 PM: Quarantining All Traces: cliks cookie 9:07 PM: Quarantining All Traces: commission junction cookie 9:07 PM: Quarantining All Traces: counter cookie 9:07 PM: Quarantining All Traces: customer cookie 9:07 PM: Quarantining All Traces: danni cookie 9:07 PM: Quarantining All Traces: dbbsrv cookie 9:07 PM: Quarantining All Traces: dealtime cookie 9:07 PM: Quarantining All Traces: did-it cookie 9:07 PM: Quarantining All Traces: directtrack cookie 9:07 PM: Quarantining All Traces: dl cookie 9:07 PM: Quarantining All Traces: dlmax cookie 9:07 PM: Quarantining All Traces: domain sponsor cookie 9:07 PM: Quarantining All Traces: enhance cookie 9:07 PM: Quarantining All Traces: epilot cookie 9:07 PM: Quarantining All Traces: esurance cookie 9:07 PM: Quarantining All Traces: euniverseads cookie 9:07 PM: Quarantining All Traces: exitexchange cookie 9:07 PM: Quarantining All Traces: exitfuel cookie 9:07 PM: Quarantining All Traces: expage cookie 9:07 PM: Quarantining All Traces: experclick cookie 9:07 PM: Quarantining All Traces: eyeblaster cookie 9:07 PM: Quarantining All Traces: fe.lea.lycos.com cookie 9:07 PM: Quarantining All Traces: freemoviesanddownloads cookie 9:07 PM: Quarantining All Traces: gangbangsquad cookie 9:07 PM: Quarantining All Traces: gator cookie 9:07 PM: Quarantining All Traces: go.com cookie 9:07 PM: Quarantining All Traces: go2net.com cookie 9:07 PM: Quarantining All Traces: goclick cookie 9:07 PM: Quarantining All Traces: gorillanation cookie 9:07 PM: Quarantining All Traces: gostats cookie 9:07 PM: Quarantining All Traces: gotoast cookie 9:07 PM: Quarantining All Traces: hbmediapro cookie 9:07 PM: Quarantining All Traces: herfirstlesbiansex cookie 9:07 PM: Quarantining All Traces: hotbar cookie 9:07 PM: Quarantining All Traces: howstuffworks cookie 9:07 PM: Quarantining All Traces: hypertracker.com cookie 9:07 PM: Quarantining All Traces: ic-live cookie 9:07 PM: Quarantining All Traces: inet-traffic.com cookie 9:07 PM: Quarantining All Traces: infospace cookie 9:07 PM: Quarantining All Traces: kinghost cookie 9:07 PM: Quarantining All Traces: kount cookie 9:07 PM: Quarantining All Traces: l2m.net cookie 9:07 PM: Quarantining All Traces: livestat cookie 9:07 PM: Quarantining All Traces: megago cookie 9:07 PM: Quarantining All Traces: mensniche cookie 9:07 PM: Quarantining All Traces: metareward.com cookie 9:07 PM: Quarantining All Traces: military cookie 9:07 PM: Quarantining All Traces: mircx cookie 9:07 PM: Quarantining All Traces: mp3downloadhq cookie 9:07 PM: Quarantining All Traces: mrskin cookie 9:07 PM: Quarantining All Traces: myaffiliateprogram.com cookie 9:07 PM: Quarantining All Traces: mygeek cookie 9:07 PM: Quarantining All Traces: naughtyplayer cookie 9:07 PM: Quarantining All Traces: newtopsites cookie 9:07 PM: Quarantining All Traces: nextag cookie 9:07 PM: Quarantining All Traces: nuker cookie 9:07 PM: Quarantining All Traces: offeroptimizer cookie 9:07 PM: Quarantining All Traces: outster cookie 9:07 PM: Quarantining All Traces: overture cookie 9:07 PM: Quarantining All Traces: partnerweekly cookie 9:07 PM: Quarantining All Traces: partypoker cookie 9:07 PM: Quarantining All Traces: passion cookie 9:07 PM: Quarantining All Traces: paypopup cookie 9:07 PM: Quarantining All Traces: precisead cookie 9:07 PM: Quarantining All Traces: pricegrabber cookie 9:07 PM: Quarantining All Traces: pub cookie 9:07 PM: Quarantining All Traces: rc cookie 9:07 PM: Quarantining All Traces: realmedia cookie 9:07 PM: Quarantining All Traces: rednova cookie 9:07 PM: Quarantining All Traces: reliablestats cookie 9:07 PM: Quarantining All Traces: reunion cookie 9:07 PM: Quarantining All Traces: rightmedia cookie 9:07 PM: Quarantining All Traces: rn11 cookie 9:07 PM: Quarantining All Traces: ru4 cookie 9:07 PM: Quarantining All Traces: screensavers.com cookie 9:07 PM: Quarantining All Traces: search123 cookie 9:07 PM: Quarantining All Traces: searchadnetwork cookie 9:07 PM: Quarantining All Traces: seeq cookie 9:07 PM: Quarantining All Traces: serving-sys cookie 9:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:07 PM: Quarantining All Traces: servlet cookie 9:07 PM: Quarantining All Traces: sexsearch cookie 9:07 PM: Quarantining All Traces: smni cookie 9:07 PM: Quarantining All Traces: socalcoeds.com cookie 9:07 PM: Quarantining All Traces: specificclick.com cookie 9:07 PM: Quarantining All Traces: specificpop cookie 9:07 PM: Quarantining All Traces: stamps.com cookie 9:07 PM: Quarantining All Traces: starpulse cookie 9:07 PM: Quarantining All Traces: starware.com cookie 9:07 PM: Quarantining All Traces: stats.klsoft.com cookie 9:07 PM: Quarantining All Traces: statstracking cookie 9:07 PM: Quarantining All Traces: stlyrics cookie 9:07 PM: Quarantining All Traces: tacoda cookie 9:07 PM: Quarantining All Traces: teenax cookie 9:07 PM: Quarantining All Traces: teensforcash cookie 9:07 PM: Quarantining All Traces: tickle cookie 9:07 PM: Quarantining All Traces: toplist cookie 9:07 PM: Quarantining All Traces: touchclarity cookie 9:07 PM: Quarantining All Traces: tracking cookie 9:07 PM: Quarantining All Traces: trafficmp cookie 9:07 PM: Quarantining All Traces: trb.com cookie 9:07 PM: Quarantining All Traces: tvguide cookie 9:07 PM: Quarantining All Traces: ugo cookie 9:07 PM: Quarantining All Traces: upspiral cookie 9:07 PM: Quarantining All Traces: videodome cookie 9:07 PM: Quarantining All Traces: webpower cookie 9:07 PM: Quarantining All Traces: webservicehosts cookie 9:07 PM: Quarantining All Traces: websponsors cookie 9:07 PM: Quarantining All Traces: web-stat cookie 9:07 PM: Quarantining All Traces: webtrendslive cookie 9:07 PM: Quarantining All Traces: wegcash cookie 9:07 PM: Quarantining All Traces: winantispyware 2005 9:07 PM: Quarantining All Traces: wirefly cookie 9:07 PM: Quarantining All Traces: xiti cookie 9:07 PM: Quarantining All Traces: xxx69 cookie 9:07 PM: Quarantining All Traces: xzoomy cookie 9:07 PM: Quarantining All Traces: yadro cookie 9:07 PM: Quarantining All Traces: yieldmanager cookie 9:07 PM: Warning: Launched explorer.exe 9:07 PM: Warning: Quarantine process could not restart Explorer. 9:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:09 PM: Spy Installation Shield: found: Adware: clkoptimizer, version 1.0.0.0 -- Execution Denied 9:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:11 PM: BHO Shield: found: -- BHO installation denied at user request 9:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 9:16 PM: Preparing to restart your computer. Please wait... 9:16 PM: Removal process completed. Elapsed time 00:11:41 9:25 PM: Memory Shield: Found: Memory-resident threat e2g, version 1.0.0.0 9:25 PM: Detected running threat: e2g 9:30 PM: | End of Session, Thursday, April 20, 2006 | ******** 7:29 PM: | Start of Session, Thursday, April 20, 2006 | 7:29 PM: Spy Sweeper started 7:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:29 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:29 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:29 PM: Your spyware definitions have been updated. 7:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:30 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 7:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:30 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 7:31 PM: | End of Session, Thursday, April 20, 2006 |

#7 imoFLUX

New Member

Authentic Member
14 posts

Posted 21 April 2006 - 12:40 AM

Thank you LDTate for the reply. You have been a real big help with the step-by-step instructions in how to trouble shoot my computer. As of rite now it seems I am not getting any error messages and annoying pop-ups. :thumbup:

Thanks again LDTate

#8 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 21 April 2006 - 08:43 PM

You need To disable TeaTimer, it can stop our fix.

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts

Please do not delete anything unless instructed to.

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ie.search.msn...st/srchasst.htm

R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://ie.search.msn...st/srchasst.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn...st/srchasst.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm

R3 - URLSearchHook: (no name) - _{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\jvjof.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,urqsppy.exe

O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)

O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe

O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

O15 - Trusted Zone: http://free.aol.com

O15 - Trusted Zone: *.mmohsix.com

O15 - Trusted Zone: *.msn.com

O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.14...geWell-ipix.cab

O20 - AppInit_DLLs: iniwin32.dll

O20 - Winlogon Notify: Run - C:\WINDOWS\system32\en84l1lq1.dll (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these Files if listed:
C:\WINDOWS\system32\jvjof.exe
C:\WINDOWS\system32\en84l1lq1.dll

Open C:\Windows\Prefetch\ Delete ALL files in this folder.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#9 imoFLUX

New Member

Authentic Member
14 posts

Posted 22 April 2006 - 12:42 PM

New HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 11:33:55 AM, on 4/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Christopher Ulep\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsof...arch/search.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsof...obby/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsof...search.asp?p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {26098EA2-C95D-48EA-89B4-63C5A63BD42F} - http://www.pacimedia...ll/pcs_0031.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1130234580109
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} (AIM UPF Control) - http://pictures06.ai...AIM.9.5.1.8.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {C62DFDC7-2EEC-4C2C-827A-BC0BFB4260B3} (IMViewerControl Class) - http://companion.log...1/bin/imvid.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon....es/vzWebIns.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://aceshigh.mic...igh/FlashAX.cab
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.log...3/bin/imvid.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O20 - AppInit_DLLs: iniwin32.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#10 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 22 April 2006 - 12:55 PM

Download Blacklight Beta from here:
http://www.f-secure....light/try.shtml

Hit I accept. It will take you to download page.
Download blbeta.exe and save it to the Desktop.
Once saved... double click blbeta.exe to install the program.
Click accept agreement and Click scan
This app too may fire off a warning from antivirus. Let the driver load.
Wait for it to finish.
If it displays any items...don't do anything with them yet. Just hit exit (close)
It will drop a log on Desktop that starts with fsbl....big number

Please post contents of log.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

Advertisements

Register to Remove

#11 imoFLUX

New Member

Authentic Member
14 posts

Posted 22 April 2006 - 02:31 PM

Tried DL'ing F-Secure Blacklight and gave me this message: was unable to aquire necessary privileges.

#12 imoFLUX

New Member

Authentic Member
14 posts

Posted 22 April 2006 - 02:33 PM

Also Spy Sweeper popped up and said warning E2G was detected running in memory. Now Im doing a re-sweep.

#13 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 23 April 2006 - 05:26 AM

Download this one and let me know if it finds anything.
RootkitRevealer
http://www.sysintern...itRevealer.html

When it's done, go to file->save
save the logfile to the desktop, and then paste the contents here.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#14 imoFLUX

New Member

Authentic Member
14 posts

Posted 23 April 2006 - 11:49 AM

Downloaded RootkitRevealer. Scanned system and saved log to desktop, and it seems that it didn't appear to my desktop. Trying to find the file. I am sure that I saved it to my desktop. Next thing you know RootkitRevealer shut down with log.

#15 imoFLUX

New Member

Authentic Member
14 posts

Posted 23 April 2006 - 12:39 PM

RootkitReveal Log HKLM\SOFTWARE\Classes\CLSID\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6}\AppId2 4/23/2006 9:04 AM 4 bytes Data mismatch between Windows API and raw hive data. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\#SharedObjects\D5QFVSXZ\static.userplane.com 4/23/2006 9:35 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\#SharedObjects\D5QFVSXZ\static.userplane.com\presence 4/23/2006 9:35 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\#SharedObjects\D5QFVSXZ\static.userplane.com\presence\m 4/23/2006 9:35 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\#SharedObjects\D5QFVSXZ\static.userplane.com\presence\m\presence.swf 4/23/2006 9:35 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\#SharedObjects\D5QFVSXZ\static.userplane.com\presence\m\presence.swf\presence.sol 4/23/2006 9:35 AM 44 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.userplane.com 4/23/2006 9:35 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.userplane.com\settings.sol 4/23/2006 9:35 AM 90 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@ad.yieldmanager[1].txt 4/23/2006 9:39 AM 155 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@ad[1].txt 4/22/2006 2:07 PM 334 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@ad[2].txt 4/23/2006 9:36 AM 596 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@casalemedia[2].txt 4/23/2006 9:39 AM 441 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@dehp.myspace[1].txt 4/23/2006 9:39 AM 83 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@demr.myspace[1].txt 4/23/2006 9:39 AM 111 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@demr.myspace[2].txt 4/22/2006 11:58 AM 91 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@myspace[1].txt 4/22/2006 2:39 PM 1.19 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@myspace[2].txt 4/23/2006 9:39 AM 1.27 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@profile.myspace[1].txt 4/23/2006 9:37 AM 87 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@purevolume[1].txt 4/23/2006 9:56 AM 346 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@purevolume[2].txt 4/22/2006 1:30 PM 346 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@tradedoubler[1].txt 4/23/2006 9:35 AM 92 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@tribalfusion[1].txt 4/23/2006 9:39 AM 87 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@viewmorepics.myspace[1].txt 4/23/2006 9:38 AM 92 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@www.myspace[1].txt 4/23/2006 9:36 AM 76 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@www.myspace[2].txt 4/22/2006 2:38 PM 149 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@www.plusfortyfour[1].txt 4/23/2006 9:52 AM 109 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@yahoo[1].txt 4/23/2006 9:02 AM 904 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Cookies\christopher ulep@yahoo[2].txt 4/23/2006 9:52 AM 925 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Incomplete\Preview-T-1100836-Plus 44-No It isn't.mp3 4/23/2006 9:54 AM 110.42 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temp\drmtemp000DA76C.htm 4/23/2006 9:14 AM 4.49 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temp\~DF40E1.tmp 4/23/2006 9:12 AM 96.00 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\010906_25x25-cherry-purple-01[1].gif 4/23/2006 9:02 AM 1.16 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\0209_25x25_square_smiley_02[1].gif 4/23/2006 9:01 AM 1.36 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\0209_cc_25x25_yahoo_0205_v5[1].jpg 4/23/2006 9:01 AM 1.32 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\031606_25x25[1].gif 4/23/2006 9:01 AM 271 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\0423pittjolie[1].jpg 4/23/2006 9:52 AM 4.49 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\100seB[1].gif 4/23/2006 9:52 AM 11.99 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\125[1].gif 4/23/2006 9:52 AM 868 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\154[1].gif 4/22/2006 2:36 PM 732 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[1].jpg 4/23/2006 9:51 AM 1.81 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[22].jpg 4/23/2006 9:46 AM 1.03 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[2].jpg 4/23/2006 9:51 AM 3.03 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[33].jpg 4/23/2006 9:48 AM 2.66 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[34].jpg 4/23/2006 9:48 AM 3.00 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[35].jpg 4/23/2006 9:48 AM 2.74 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\1[3].jpg 4/23/2006 9:51 AM 3.81 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\20060125_64222_v1_300x100_concept1_megan_W2M[1].jpg 4/23/2006 9:01 AM 7.74 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[14].jpg 4/23/2006 9:41 AM 2.68 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[1].jpg 4/23/2006 9:51 AM 2.84 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[26].jpg 4/23/2006 9:42 AM 2.80 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[29].jpg 4/23/2006 9:46 AM 1.84 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[2].jpg 4/23/2006 9:51 AM 4.43 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[3].jpg 4/23/2006 9:51 AM 3.32 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[43].jpg 4/23/2006 9:48 AM 2.49 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[44].jpg 4/23/2006 9:48 AM 3.22 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\2[4].jpg 4/23/2006 9:51 AM 2.44 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[14].jpg 4/23/2006 9:42 AM 3.83 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[1].jpg 4/23/2006 9:51 AM 1.93 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[22].jpg 4/23/2006 9:48 AM 2.99 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[23].jpg 4/23/2006 9:48 AM 3.24 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[24].jpg 4/23/2006 9:48 AM 4.28 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\3[2].jpg 4/23/2006 9:51 AM 3.09 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ad_eo_1.1[1].js 4/22/2006 2:36 PM 978 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ad_tab[1].gif 4/23/2006 9:55 AM 147 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\aol_homepage[1].gif 4/23/2006 9:55 AM 12.72 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ar_next[1].gif 4/23/2006 9:52 AM 68 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\BB10[1].gif 4/23/2006 9:55 AM 6.58 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\Bellagio5star_promo[1].gif 4/23/2006 9:11 AM 16.56 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\blko1[1].gif 4/23/2006 9:02 AM 245 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\bt_dd_2[1].gif 4/23/2006 9:01 AM 70 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\bt_s_dd_2[1].gif 4/23/2006 9:01 AM 122 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\btn_close[1].gif 4/23/2006 9:56 AM 128 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CA2V8T2J.htm 4/23/2006 9:51 AM 8.45 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CA6BMZ2N.htm 4/23/2006 9:48 AM 8.51 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAFMHC1N.swf 4/23/2006 9:02 AM 38.97 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAIDCMID.htm 4/23/2006 9:48 AM 64 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAMHMR0D.htm 4/23/2006 9:55 AM 64 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\campfire_bg[1].gif 4/23/2006 9:56 AM 4.04 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAOZ8BW5.htm 4/23/2006 9:51 AM 3.88 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAQ3C16R.swf 4/23/2006 9:01 AM 12.53 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CATEELQH.htm 4/23/2006 9:51 AM 8.10 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAUBW12N.htm 4/23/2006 9:51 AM 8.05 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAWLQJG5.HTM 4/23/2006 9:02 AM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\CAYEL1A4.htm 4/23/2006 9:48 AM 7.97 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ckbx_grn[1].gif 4/23/2006 9:52 AM 692 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\clock_bg[1].jpg 4/23/2006 9:11 AM 4.09 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\comments[2].js 4/23/2006 9:42 AM 5.39 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\copyright[1].gif 4/23/2006 9:55 AM 805 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\cr_gg_sw[1].gif 4/23/2006 9:01 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\cr_srch_ne[1].gif 4/23/2006 9:02 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\cr_srch_se[1].gif 4/23/2006 9:02 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\cr_wrn_nw[1].gif 4/23/2006 9:02 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ct_lrec_031016[1].js 4/23/2006 9:01 AM 1.82 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\dftc1[1].gif 4/23/2006 9:01 AM 223 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\dom-drag[1].js 4/23/2006 9:02 AM 5.98 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\edl1[1].swf 4/23/2006 9:52 AM 18.77 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\exp_minus[1].gif 4/23/2006 9:02 AM 377 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\flash[1].swf 4/23/2006 9:52 AM 98.83 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\folderview[2].js 4/23/2006 9:01 AM 7.25 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\footer_tile[1].gif 4/23/2006 9:02 AM 57 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\header-background[1].gif 4/23/2006 9:03 AM 511 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\icon11[1].gif 4/23/2006 9:02 AM 689 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\img_edit[1].jpg 4/23/2006 9:52 AM 9.70 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\imgad[1].jpg 4/23/2006 9:48 AM 27.44 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ipb_topic[1].js 4/23/2006 9:02 AM 12.44 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\Listener-304217-203681[1].jpg 4/23/2006 9:56 AM 2.81 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\Listener-62497-187452[1].jpg 4/23/2006 9:56 AM 2.34 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\login_md5_1_12[2].js 4/23/2006 9:01 AM 7.86 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\main[1].css 4/23/2006 9:03 AM 6.28 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\mainfeature-taking_back_sundayjpg[1].jpg 4/23/2006 9:55 AM 38.02 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\mc2[1].js 4/23/2006 9:01 AM 6.60 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\menu_item[1].gif 4/23/2006 9:02 AM 87 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ml[1].gif 4/23/2006 9:52 AM 687 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\mvp_host[1].gif 4/23/2006 9:02 AM 2.06 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\myyhp_1.9[2].js 4/23/2006 9:01 AM 3.09 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\navmain-background[1].gif 4/23/2006 9:03 AM 247 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\next[1].gif 4/23/2006 9:56 AM 344 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\noitisnt[1].mp3 4/23/2006 9:52 AM 1.05 MB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\pe_tours_and_shows[1].gif 4/23/2006 9:55 AM 2.30 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\pixel[2].gif 4/23/2006 9:40 AM 43 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\pldn3[1].gif 4/23/2006 9:52 AM 106 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\plus-44[1].htm 4/23/2006 9:52 AM 614 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\purepick-death_from_above_1979jpg[1].jpg 4/23/2006 9:55 AM 6.81 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\purepick-the_states_onlinejpg[1].jpg 4/23/2006 9:55 AM 2.20 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\purepromo-constancyjpg[1].jpg 4/23/2006 9:55 AM 5.68 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\purepromo-moz_temprojpg[1].jpg 4/23/2006 9:55 AM 2.23 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\qt_lo_1[1].gif 4/23/2006 9:01 AM 68 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\random_profile_jump[1].gif 4/23/2006 9:56 AM 5.94 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\rc_wg2w_ne_1[1].gif 4/23/2006 9:01 AM 111 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\rc_wg2w_sw_1[1].gif 4/23/2006 9:01 AM 111 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\right_box_bottom_corner[1].gif 4/23/2006 9:02 AM 67 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\serverLowerRightPaneFrame[1].html 4/23/2006 9:11 AM 154 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\shd_m_2[1].gif 4/23/2006 9:01 AM 67 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ShowFolder[1] 4/23/2006 9:02 AM 12.71 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ShowFolder[1].htm 4/23/2006 9:02 AM 49.91 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\silho_neutral_1[1].gif 4/23/2006 9:01 AM 568 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\skinny_bg[1].gif 4/23/2006 9:56 AM 1.95 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\small_feature_name_bg[1].gif 4/23/2006 9:55 AM 934 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\small_feature_text[1].swf 4/23/2006 9:55 AM 5.08 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\smile[1].gif 4/23/2006 9:02 AM 699 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\sort_dn_1[1].gif 4/23/2006 9:01 AM 96 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\spacer[1].gif 4/23/2006 9:02 AM 43 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\src_wc4w_ne_1[1].gif 4/23/2006 9:01 AM 95 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\t_new[1].gif 4/23/2006 9:02 AM 1.73 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\tabs2[1].gif 4/23/2006 9:56 AM 3.79 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\the_classic_crime[1].swf 4/23/2006 9:55 AM 42.85 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\thumbup[1].gif 4/23/2006 9:02 AM 958 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\tier2_backstagehome[1].jpg 4/23/2006 9:55 AM 8.50 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\title_pure_extras[1].gif 4/23/2006 9:55 AM 1.90 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\title_pure_picks[1].gif 4/23/2006 9:55 AM 1.85 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\tk3_email_icon_25x25[1].gif 4/23/2006 9:01 AM 152 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\top_box[1].gif 4/23/2006 9:02 AM 44 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\top_corner_bottom[1].gif 4/23/2006 9:02 AM 76 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\tri_web2[1].gif 4/22/2006 2:36 PM 64 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\tshc1[1].gif 4/23/2006 9:01 AM 236 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\uh_tcrn[1].gif 4/23/2006 9:01 AM 75 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ulm_btn_11px_l[1].gif 4/22/2006 2:36 PM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\utils[1].js 4/23/2006 9:11 AM 260 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\virb_300x60[1].gif 4/23/2006 9:55 AM 3.48 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\y3[1].gif 4/23/2006 9:52 AM 1.83 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\yahoo_nw_freemo_160x35[1].gif 4/23/2006 9:02 AM 874 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\ylib_dom[2].js 4/23/2006 9:01 AM 4.66 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\1GK7XDK5\yregml_200507281530[2].js 4/23/2006 9:01 AM 3.02 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\000000_new_ico[1].gif 4/23/2006 9:42 AM 74 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\121405_2_300x250_allnone_fordummies[1].swf 4/23/2006 9:01 AM 13.22 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\154[1].gif 4/23/2006 9:52 AM 732 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\1[17].jpg 4/23/2006 9:42 AM 2.33 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\1[1].jpg 4/23/2006 9:51 AM 2.37 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\1[30].jpg 4/23/2006 9:48 AM 5.50 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\1[31].jpg 4/23/2006 9:48 AM 3.08 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\1[7].jpg 4/23/2006 9:41 AM 2.68 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\20050603_52352_2_728x90_super_set1[1].swf 4/23/2006 9:02 AM 17.94 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\20105_25x25_diploma_icon[1].gif 4/23/2006 9:02 AM 348 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\2[11].jpg 4/23/2006 9:41 AM 3.29 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\2[19].jpg 4/23/2006 9:41 AM 3.04 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[12].jpg 4/23/2006 9:41 AM 1.08 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[13].jpg 4/23/2006 9:41 AM 3.62 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[1].jpg 4/23/2006 9:51 AM 3.08 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[27].jpg 4/23/2006 9:46 AM 2.98 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[31].jpg 4/23/2006 9:47 AM 2.61 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[37].jpg 4/23/2006 9:48 AM 2.32 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[38].jpg 4/23/2006 9:48 AM 2.80 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[39].jpg 4/23/2006 9:48 AM 3.29 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[40].jpg 4/23/2006 9:48 AM 4.24 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[41].jpg 4/23/2006 9:48 AM 2.48 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\3[42].jpg 4/23/2006 9:48 AM 3.38 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\70iltlA[1].gif 4/23/2006 9:52 AM 1.99 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ad_eo_1.1[1].js 4/23/2006 9:52 AM 978 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\affiliate-reader[1].swf 4/23/2006 9:12 AM 518 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\age_w[1].gif 4/23/2006 9:01 AM 71 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\asap2[1].jpg 4/23/2006 9:02 AM 2.24 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\asap[1].gif 4/23/2006 9:02 AM 11.02 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\av-15276[1].jpg 4/23/2006 9:02 AM 20.91 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\bandname[1].swf 4/23/2006 9:56 AM 8.15 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\bc_2.0.3[1].js 4/22/2006 2:36 PM 1.91 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\bg_boxes4[1].gif 4/23/2006 9:11 AM 7.38 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\blkc1[1].gif 4/23/2006 9:01 AM 177 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\box_login_br[1].gif 4/23/2006 9:40 AM 70 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\bt_dd_l_2[1].gif 4/23/2006 9:01 AM 70 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CA4C2Z31.htm 4/23/2006 9:56 AM 2.65 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CAATKBOX.htm 4/23/2006 9:51 AM 8.20 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CAD0ORL1.swf 4/23/2006 9:55 AM 1.14 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CAL52D0Z.htm 4/23/2006 9:02 AM 8.51 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CALLW5S3.htm 4/23/2006 9:55 AM 2.87 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\campfire_end[1].gif 4/23/2006 9:56 AM 159 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\CAXPVRYK.swf 4/23/2006 9:02 AM 26.45 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\container_bg[1].gif 4/23/2006 9:55 AM 77 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\cr_gg_se[1].gif 4/23/2006 9:01 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\cr_gr_01[1].gif 4/23/2006 9:02 AM 108 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\cr_wrn_se[1].gif 4/23/2006 9:02 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\cr_wrn_sw[1].gif 4/23/2006 9:02 AM 94 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\css_14[1].css 4/23/2006 9:02 AM 26.71 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\endcap[1].gif 4/23/2006 9:56 AM 616 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\footer_nav_tile[1].gif 4/23/2006 9:02 AM 57 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\get_video[2] 4/23/2006 9:49 AM 6.09 MB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\go_to_featured_artist[1].gif 4/23/2006 9:55 AM 2.17 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\hea_edit[1].gif 4/23/2006 9:52 AM 497 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\header[1].gif 4/23/2006 9:55 AM 3.80 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\header_search_results[1].gif 4/23/2006 9:55 AM 1.04 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\homepage[1].css 4/23/2006 9:55 AM 12.00 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\how_can_my_band[1].gif 4/23/2006 9:55 AM 2.24 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\icon_arrow_orange[1].gif 4/23/2006 9:55 AM 57 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\icon_new_window[1].gif 4/23/2006 9:56 AM 82 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\imgad[1].jpg 4/23/2006 9:55 AM 10.32 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\inbc1[1].gif 4/23/2006 9:01 AM 162 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\index[1].htm 4/23/2006 9:02 AM 297.83 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ipb_global_xmlenhanced[1].js 4/23/2006 9:02 AM 9.18 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ips_menu_html[1].js 4/23/2006 9:02 AM 2.79 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\listener-116982-812812500836[1].jpg 4/23/2006 9:56 AM 2.58 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\Listener-285515-287554[1].jpg 4/23/2006 9:56 AM 2.70 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\login[1].htm 4/23/2006 9:01 AM 64.07 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\login[2].htm 4/23/2006 9:02 AM 21.57 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\lower-banners[1].htm 4/23/2006 9:12 AM 1.33 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\lsmfonts20040826[1].css 4/23/2006 9:02 AM 739 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\mail_blue_all[2].css 4/23/2006 9:01 AM 42.96 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\main[1].htm 4/23/2006 9:52 AM 2.86 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\main[1].js 4/23/2006 9:03 AM 435 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\main_feature_name_bg[1].gif 4/23/2006 9:55 AM 2.08 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\MDF_TF_300x81[1].jpg 4/23/2006 9:12 AM 19.30 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\menu_action_down[1].gif 4/23/2006 9:02 AM 100 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ml[1].gif 4/22/2006 2:36 PM 687 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\music[1].htm 4/23/2006 9:52 AM 642 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\my[1].gif 4/23/2006 9:52 AM 849 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\nav[1].gif 4/23/2006 9:02 AM 585 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\p_offline[1].gif 4/23/2006 9:02 AM 1.29 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\p_quote[1].gif 4/23/2006 9:02 AM 1.04 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\perc1[1].gif 4/23/2006 9:01 AM 146 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\pldn3[1].gif 4/22/2006 2:36 PM 106 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\purepick-dangerous_musejpg[1].jpg 4/23/2006 9:55 AM 2.29 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\purepick-jblakejpg[1].jpg 4/23/2006 9:55 AM 2.78 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\purepick-triviumjpg[1].jpg 4/23/2006 9:55 AM 9.12 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\purepromo-bermanjpg[1].jpg 4/23/2006 9:55 AM 3.55 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\purevolume[1].htm 4/23/2006 9:55 AM 27.11 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\quick_search[1].gif 4/23/2006 9:55 AM 1.94 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\rc_c4c3w_se_1[1].gif 4/23/2006 9:01 AM 164 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\rc_c4c3w_sw_1[1].gif 4/23/2006 9:01 AM 164 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\rc_wc3c5_ne_1[1].gif 4/23/2006 9:02 AM 167 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\results[2].htm 4/23/2006 9:51 AM 58.71 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\right_box_corner[1].gif 4/23/2006 9:02 AM 68 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\RootkitRevealer[1].zip 4/23/2006 9:03 AM 207.99 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\RootkitRevealer[1].zip:Zone.Identifier 4/23/2006 9:03 AM 26 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\search[1].htm 4/23/2006 9:52 AM 58.76 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\SearchButton[1].gif 4/23/2006 9:03 AM 571 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\section_1_bg[1].gif 4/23/2006 9:55 AM 2.74 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\section_2_bg[1].gif 4/23/2006 9:55 AM 5.35 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\section_4_bg[1].gif 4/23/2006 9:55 AM 105 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\seeking_w[1].gif 4/23/2006 9:01 AM 102 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\shift1[1].gif 4/23/2006 9:01 AM 57 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ShowFolder[1].htm 4/23/2006 9:01 AM 72.44 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ShowFolder[2].htm 4/23/2006 9:02 AM 57.21 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\SITandGO_Aruba_LR2[1].jpg 4/23/2006 9:12 AM 8.57 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\sp_msgr60_1[1].gif 4/23/2006 9:01 AM 1.55 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\spacer[1].gif 4/23/2006 9:01 AM 43 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\star_half[1].gif 4/23/2006 9:40 AM 242 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\styles[1].css 4/23/2006 9:40 AM 13.95 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\table_results_bg[1].gif 4/23/2006 9:40 AM 652 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\tabs4[1].gif 4/23/2006 9:56 AM 8.15 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\tag_edit[1].gif 4/23/2006 9:01 AM 690 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\tagline-20pt[1].gif 4/23/2006 9:40 AM 670 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\thumbup[1].gif 4/23/2006 9:02 AM 958 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\top_nav_bg[1].gif 4/23/2006 9:02 AM 58 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\tracker[1].js 4/23/2006 9:11 AM 692 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\transatlantic[1].swf 4/23/2006 9:56 AM 34.16 KB Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\uh_bk[1].gif 4/23/2006 9:01 AM 43 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\uh_crn2[1].gif 4/23/2006 9:01 AM 105 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\ui[2].js 4/23/2006 9:42 AM 917 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\upgrade_08[1].gif 4/23/2006 9:01 AM 811 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\video[1].gif 4/23/2006 9:52 AM 311 bytes Hidden from Windows API. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\vmail16_1[1].gif 4/23/2006 9:01 AM 608 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4LQFODAJ\WinternalsSponsor[1].gif 4/23/2006 9:03 AM 1.42 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Christopher Ulep\Local Settings\Temporary Internet Files\Content.IE5\4

Edited by imoFLUX, 23 April 2006 - 12:44 PM.

Body Background

skin color theme