Spyware / Malware / Virus Removal

HIjack This log

20 min read

Looking for the outcome? Ask AI

rmh411 Topic Starter

Post #1July 29, 2006, 4:07 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 11:34:47 PM, on 7/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Microsoft Shared\DirectX

Extensions\DXDebugService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\1146591053\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\ATISched.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Camfrog\Camfrog Video Chat 3.72\Camfrog Video Chat.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Security Task Manager\TaskMan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\common files\aol\1146591053\ee\aim6.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Darkling\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://us.rd.yahoo.com/customize/ie/defaul…/www.yahoo.com/

ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88}

- (no file)
O2 - BHO: (no name) - {4292C9ED-99B6-0D99-C7E7-C09E59D33756} -

C:\WINDOWS\system32\rqiycpmu.dll (file missing)
O2 - BHO: (no name) - {5FB3BBAA-3EC2-25E3-0621-41DAF918C108} - (no file)
O2 - BHO: Windows Live Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common

Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 -

{9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common

Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program

Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Norton Internet Security 2006 -

{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common

Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} -

C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI

Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LFAgent] "C:\Program Files\Everstrike Software\Lock

Folder XP 3.5\LF30.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common

Files\AOL\1146591053\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI

Multimedia\main\ATIDtct.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI

Multimedia\main\ATISched.EXE"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM

XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"

/background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash

/minimized
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat

3.72\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat

3.72\Camfrog Video Chat.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program

Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI

Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program

Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} -

C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no

file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no

file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}

- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program

Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient

Class) -

http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -

C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient

Class) -

http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{306FF139-C988-420C-8F8D-25A05D6E1F85}:

NameServer = 24.29.103.10,24.29.103.11
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} -

C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common

Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation -

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) -

Symantec Corporation - C:\Program Files\Norton Internet

Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program

Files\Norton Internet Security\comHost.exe
O23 - Service: ftcvlwlgazgq (gbegutfl6) - Unknown owner -

C:\WINDOWS\system32\puwnawai6.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation -

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec

Corporation - C:\Program Files\Norton Internet Security\Norton

AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\Security

Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program

Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

ken545

Post #2August 9, 2006, 1:01 AM UTC

rmh411

Welcome to Tom Coyote, sorry for the delay in responding, if I said we were overwhelmed with logs it would be an understatement.

You HJT log is unreadable the way you posted it , lets do this…..

DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to My Computer > YOUR C:\ DRIVE > Program Files and create a new folder and name it Hijackthis .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\Program Files\Hijackthis\Hijackthis.exe

Please do not proceed until you have moved HJT

Open HJT Scan and Save a Log File, it will open in Notepad, go to Format and make sure WordWrap is checked, then to Edit> Select All…..Edit > Copy and Paste the new log into this thread.

Ken

rmh411

Post #3August 10, 2006, 1:08 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 8:58:15 PM, on 8/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\DirectX Extensions\DXDebugService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\1146591053\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\ATISched.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Camfrog\Camfrog Video Chat 3.72\Camfrog Video Chat.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Pinnacle\Studio 8\bin\amcap.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\HIJackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {4292C9ED-99B6-0D99-C7E7-C09E59D33756} - C:\WINDOWS\system32\rqiycpmu.dll (file missing)
O2 - BHO: (no name) - {5FB3BBAA-3EC2-25E3-0621-41DAF918C108} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LFAgent] "C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1146591053\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat 3.72\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat 3.72\Camfrog Video Chat.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{306FF139-C988-420C-8F8D-25A05D6E1F85}: NameServer = 24.29.103.10,24.29.103.11
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ftcvlwlgazgq (gbegutfl6) - Unknown owner - C:\WINDOWS\system32\puwnawai6.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

ken545

Post #4August 10, 2006, 1:42 AM UTC

rmh411,

Great

Right where we want it to be.

We need to make sure all hidden files are showing :

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide file extensions for known types option.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

* Go to Start> Run and type in services.msc then press Enter
* Scroll down to ftcvlwlgazgq
* Double Click that service to open it.
* Click on Stop Service.
* Then change the Startup Type to Disabled.
* OK your way out of the program.

Open HJT > Misc Tools > Delete an NT Service
* Type in gbegutfl6
* Then click on OK, it will ask you to reboot, do so.

HERE and save that file to your desktop.

* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.

Open HJT Scan Only, close all open windows and your browser, check these and click on Fix Checked.

O2 - BHO: (no name) - {4292C9ED-99B6-0D99-C7E7-C09E59D33756} - C:\WINDOWS\system32\rqiycpmu.dll (file missing)

O2 - BHO: (no name) - {5FB3BBAA-3EC2-25E3-0621-41DAF918C108} - (no file)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O23 - Service: ftcvlwlgazgq (gbegutfl6) - Unknown owner - C:\WINDOWS\system32\puwnawai6.exe (file missing)

Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
*** make sure to remember where you saved that file, this is important
* Close Ewido

Still in Safemode, look for these files and delete them.

C:\WINDOWS\system32\rqiycpmu.dll
C:\WINDOWS\system32\puwnawai6.exe

Reboot normally and lets run a system cleaner.

If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
Tutorial for CCleaner

I need to see the Ewido report and a new HJT log

rmh411

Post #5August 12, 2006, 6:56 PM UTC

hey i did as instructed but these files werent on my comp C:\WINDOWS\system32\rqiycpmu.dll C:\WINDOWS\system32\puwnawai6.exe during safe mode also this object wasnt there O23 - Service: ftcvlwlgazgq (gbegutfl6) - Unknown owner - C:\WINDOWS\system32\puwnawai6.exe (file missing) ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 9:58:46 PM 8/11/2006 + Scan result: C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined). E:\Setups\pacificpoker.exe -> Adware.Casino : Cleaned with backup (quarantined). C:\Program Files\Microsoft AntiSpyware\Quarantine\BC1B3806-A7E5-45D2-B6B6-E630EA\DF003266-E33B-46F6-98FE-15FC0E -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Documents and Settings\never use\Start Menu\Programs\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WhenUSave -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\never use\Start Menu\Programs\WhenUSearch -> Adware.WhenU : Cleaned with backup (quarantined). :mozilla.230:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.230:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.231:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.231:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.232:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.232:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.233:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.233:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.234:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.234:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.235:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.235:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.236:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.236:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.237:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.237:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.238:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.238:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.239:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.239:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.240:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.240:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.241:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.241:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.242:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.242:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.243:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.243:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.244:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.244:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.245:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.245:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.246:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.246:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.247:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.247:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.248:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.248:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.366:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.366:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). :mozilla.23:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.25:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.25:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.26:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.26:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.27:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.27:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.28:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.28:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.29:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.29:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.30:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.440:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.440:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.356:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.356:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.357:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.357:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.17:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.17:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.18:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.18:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.20:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.20:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.8:C:\Documents and Settings\never use\Application Data\Mozilla\Firefox\Profiles\q51a696k.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@bfast[1].txt -> TrackingCookie.Bfast : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). :mozilla.86:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.86:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.87:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.87:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.478:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined). :mozilla.478:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined). :mozilla.226:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.226:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.227:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.227:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.228:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.228:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.64:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.64:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.65:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.65:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.66:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.66:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.67:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.67:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.68:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.68:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.69:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.69:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.70:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.70:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.71:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.71:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). C:\Documents and Settings\never use\Cookies\never use@centrport[1].txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined). :mozilla.10:C:\Documents and Settings\never use\Application Data\Mozilla\Firefox\Profiles\q51a696k.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.203:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.203:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.204:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.204:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.9:C:\Documents and Settings\never use\Application Data\Mozilla\Firefox\Profiles\q51a696k.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\never use\Cookies\never use@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.295:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). :mozilla.295:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). :mozilla.114:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.114:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.130:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.130:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.133:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.133:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.134:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.134:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.142:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.142:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.143:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.143:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.55:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.55:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.58:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.58:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.250:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.250:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.437:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.437:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.485:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.485:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.486:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.486:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.506:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.506:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.507:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.507:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.508:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.508:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.509:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.509:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Hitslink : Cleaned with backup (quarantined). :mozilla.446:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Kmpads : Cleaned with backup (quarantined). :mozilla.446:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Kmpads : Cleaned with backup (quarantined). :mozilla.192:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.192:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.359:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined). :mozilla.359:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined). :mozilla.360:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined). :mozilla.360:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined). :mozilla.303:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.303:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.304:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.304:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.347:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.347:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.120:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.120:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.121:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.121:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.122:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.122:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.123:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.123:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.124:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.124:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.125:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.125:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.126:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.126:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.522:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.522:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.523:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.523:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.524:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.524:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.101:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). :mozilla.101:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). :mozilla.337:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). :mozilla.337:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.104:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.104:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.105:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.105:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.106:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.106:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.107:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.107:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.108:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.108:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.109:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.109:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.110:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.110:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.111:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.111:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.112:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.112:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.113:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.113:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.115:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.115:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.116:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.116:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.117:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.117:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.118:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.118:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.119:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.119:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.179:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.179:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.180:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.180:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.181:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.181:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.182:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.182:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.183:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.183:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\never use\Application Data\Mozilla\Firefox\Profiles\q51a696k.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup (quarantined). :mozilla.88:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.88:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.89:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.89:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.94:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.94:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.95:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.95:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.96:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.96:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.97:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.97:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.98:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.98:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.99:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.99:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.276:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.276:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.277:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.277:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.278:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.278:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Darkling\Cookies\darkling@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.396:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Targetnet : Cleaned with backup (quarantined). :mozilla.396:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Targetnet : Cleaned with backup (quarantined). :mozilla.457:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). :mozilla.457:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). :mozilla.338:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.338:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-2.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.184:C:\Documents and Settings\Darkling\Application Data\Mozilla\Firefox\Profiles\c9eba2rq.default\cookies-1.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.184:C:\Documents and Settings\Darkling\Ap

ken545

Post #6August 12, 2006, 7:02 PM UTC

This will be gone after you disable and remove the service, it was just a double check.

O23 - Service: ftcvlwlgazgq (gbegutfl6) - Unknown owner - C:\WINDOWS\system32\puwnawai6.exe (file missing) I need to see a new HJT log

rmh411

Post #7August 12, 2006, 9:30 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 2:41:45 PM, on 8/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\DirectX Extensions\DXDebugService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\1146591053\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\ATISched.EXE
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Camfrog\Camfrog Video Chat 3.72\Camfrog Video Chat.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Pinnacle\Studio 8\bin\amcap.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HIJackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {4292C9ED-99B6-0D99-C7E7-C09E59D33756} - (no file)
O2 - BHO: (no name) - {5FB3BBAA-3EC2-25E3-0621-41DAF918C108} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LFAgent] "C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1146591053\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat 3.72\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat 3.72\Camfrog Video Chat.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{306FF139-C988-420C-8F8D-25A05D6E1F85}: NameServer = 24.29.103.10,24.29.103.11
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

ken545

Post #8August 13, 2006, 1:48 AM UTC

rmh411,

Open Ewido and go into the Quarantine folder and remove it all, nothing in there you want to keep.

We must disable the Real-Time Protection feature of Windows Defender for it may interfere with the changes we need to make.

To disable Real-Time Protection:

Go to "Tools" | "General Settings"
Scroll down to "Real-time protection options"
Uncheck "Turn on real-time protection (recommended)"
Remember to reactivate this feature when we have finished all our work.

Open HJT Scan Only, close all open windows and your browser, check these and click on Fix Checked

O2 - BHO: (no name) - {4292C9ED-99B6-0D99-C7E7-C09E59D33756} - (no file)
O2 - BHO: (no name) - {5FB3BBAA-3EC2-25E3-0621-41DAF918C108} - (no file)

Download Pocket Killbox to your desktop, unzip it to a folder that you can find

* Highlight all the files with the complete path in the quote and press Ctrl C on your keyboard.

C:\WINDOWS\system32\puwnawai6.exe
C:\WINDOWS\system32\rqiycpmu.dll

* Open Pocket Killbox
* Go to File > Paste from clipboard
* Set it to Delete on Reboot
* Tick the box that says End Explorer shell while killing file
* If its not greyed out..Click the radio button that say Unregister .dll before deleting.
* Make sure ALL Files is selected
* Click on the Red circle with the white X
* It will ask you to confirm the deletion…Say yes
* It will ask you to reboot, say yes

Post a new HJT log please and let me know how your system is running now.

Ken

ken545

Post #9August 29, 2006, 8:21 PM UTC

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

HIjack This log

✨ Ask AI

Ask AI