Hi...here's my log, Cherry

hi cherry1959,

look in add/remove programs panel for COWABANGA or maybe outerinfo. uninstall if found.
try a online scan at one of these:

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
check AutoClean under Scan Options.

Panda ActiveScan
http://www.pandasoftware.com/products/acti…CACHEHINT=Guest

Kaspersky virus scanner
http://www.kaspersky.com/virusscanner

Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
check Auto Clean.

F-Secure virus scanner
http://support.f-secure.com/enu/home/ols.shtml


eTrust Antivirus Web Scanner
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

also download and run a squared:
http://www.emsisoft.com/en/software/download/

shelf life

Hi thanks shelf life…when I try to remove COWABANGA from the add/remove program, I get a dialog box that pops up which states :" To confirm your intention to remove to this ad supported product please enter the 4 digit code shown below"… it shows a 4 digit verification code…I am afraid to proceed and enter this code because I do not know if this will actually allow me to then remove COWABANGA or perhaps it is part of thier "trap" to further mess with my system….please advise if this a legitimate "removal" function
thanks

hi cherry1959, yes, its safe to enter the "code"

I dumped the Cowabanga, ran a Panda scan, and an Ad-Aware scan which found all the below junk. I put them all in Quarantine for the moment because I am a afraid to delete….how do I know if I can delete this junk without screwing up any other stuff,registers etc. I've heard horror stories of people who deleted stuff they should not have….here's the Ad-Aware scan result: ( deleted all the cookie stuff it listed) Ifigured they were safe to dump… Thanks ArchiveData(bondservant.bckp) Referencefile : SE1R120 25.08.2006 ====================================================== PURITYSCAN »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[0]=Process : C:\PROGRAM FILES\COMMON FILES\LAPM\XNMRHIP.EXE VX2 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[1]=File : c:\WINDOWS\TEMP\BI2.cab obj[2]=File : c:\WINDOWS\TEMP\BI2.cab obj[12]=File : c:\WINDOWS\TEMP\biini.cab obj[13]=File : c:\WINDOWS\TEMP\bi.ini obj[25]=File : c:\WINDOWS\BI.INI obj[36]=File : C:\WINDOWS\inf\payload.inf obj[37]=File : C:\windows\TEMP\biini.inf obj[38]=File : C:\windows\TEMP\BI2.cab obj[39]=File : C:\windows\TEMP\bi2.inf obj[40]=File : C:\windows\TEMP\billionaire.bmp obj[78]=RegValue : software\dbi "BII1d2OfSInst" obj[79]=RegValue : software\dbi "BIT1o2pListSPos" obj[80]=RegValue : software\dbi "BII1n2ProgSCab" obj[81]=RegValue : software\dbi "BII1n2ProgSEx" obj[82]=RegValue : software\dbi "BII1n2ProgSLstest" obj[83]=RegValue : software\dbi "BIC1n2trSEvnt" obj[84]=RegValue : software\dbi "BIC1n2trMsgSDisp" obj[85]=RegValue : software\dbi "BIC1S2Insur" obj[86]=RegValue : software\dbi "BIT1h2rshSCheckSIn" obj[87]=RegValue : software\dbi "BI1C2ntrSTransac" obj[88]=RegValue : software\dbi "BIC1u2rrentSMode" obj[89]=RegValue : software\dbi "BIC1n2tFyl" obj[90]=RegValue : software\dbi "BIM1o2deSSync" obj[91]=RegValue : software\dbi "BIT1h2rshSBath" obj[92]=RegValue : software\dbi "BIT1h2rshSysSInf" obj[93]=RegValue : software\dbi "BIT1h2rshSMots" obj[94]=RegValue : software\dbi "BII1g2noreS" obj[95]=RegValue : software\dbi "BIs1t2i3cky1S" obj[96]=RegValue : software\dbi "BIs1t2icky2S" obj[97]=RegValue : software\dbi "BI1N2a3tionSCode" obj[98]=RegValue : software\dbi "BID1s2tSSEnd" obj[99]=RegValue : software\dbi "BID1s2tSCHost" obj[100]=RegValue : software\dbi "BID1s2tSCPath" obj[101]=RegValue : software\dbi "BIL1a2stMotsSDay" obj[102]=RegValue : software\dbi "BIL1a2stSSChckin" obj[103]=RegValue : software\dbi "BIS1t2atusOfSInst" obj[104]=RegValue : software\dbi "BIC1o2d3eOfSFinalAd" obj[105]=RegValue : software\dbi "BIT1i2m3eOfSFinalAd" obj[142]=Regkey : software\dbi IBIS TOOLBAR »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[3]=File : c:\WINDOWS\TEMP\down_.cab obj[41]=RegData : software\microsoft\internet explorer\main "Use Search Asst" obj[106]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrHighlight" obj[107]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrForeColor" obj[108]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrBackColor" obj[109]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrDownload" obj[110]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrViewed" obj[111]=RegValue : software\microsoft\mediaplayer\control\playbar "ClrStatic" obj[112]=RegValue : software\microsoft\internet explorer\main "AutoSearch" obj[143]=Regkey : software\microsoft\mediaplayer\control\playbar PRUTECT »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[4]=Folder : C:\Program Files\E2G obj[26]=File : C:\Program Files\e2g\data obj[53]=RegValue : software\microsoft\windows\currentversion\uninstall\e2g plugin "UninstallString" obj[54]=RegValue : software\microsoft\windows\currentversion\uninstall\e2g plugin "HelpLink" obj[55]=RegValue : software\microsoft\windows\currentversion\uninstall\e2g plugin "Publisher" obj[56]=RegValue : software\microsoft\windows\currentversion\uninstall\e2g plugin "URLInfoAbout" obj[67]=RegValue : software\e2g "source" obj[68]=RegValue : software\e2g "checkStarted" obj[69]=RegValue : software\e2g "id" obj[70]=RegValue : software\e2g "spread" obj[71]=RegValue : software\e2g "lastBuild" obj[72]=RegValue : software\e2g "lastCheck" obj[73]=RegValue : software\e2g "lastMerchant" obj[74]=RegValue : software\e2g "lastReplacement" obj[114]=Regkey : typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e} obj[115]=Regkey : appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e} obj[116]=Regkey : appid\iebhos.dll obj[123]=Regkey : software\microsoft\windows\currentversion\uninstall\e2g plugin obj[132]=Regkey : iebhos.control.1 obj[133]=Regkey : iebhos.control obj[134]=Regkey : software\microsoft\downloadmanager obj[135]=Regkey : software\e2g CLEARSEARCH »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[5]=Folder : C:\Program Files\ClearSearch obj[6]=Folder : C:\windows\TEMP\ClrSch obj[27]=File : C:\windows\TEMP\clrsch\CSIE.DL_ obj[48]=RegValue : software\clrsch "promo" obj[121]=Regkey : software\clrsch GAIN »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[7]=File : c:\/windows/downloaded program files/conflict.1/hdplugin1015.dll obj[8]=File : c:\/windows/downloaded program files/conflict.2/hdplugin1015.dll obj[9]=File : c:\/windows/downloaded program files/conflict.5/hdplugin1015.dll obj[10]=File : c:\/windows/downloaded program files/conflict.6/hdplugin1015.dll obj[14]=File : c:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll obj[15]=File : c:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1015.dll obj[16]=File : c:\WINDOWS\Downloaded Program Files\HDPlugin1015.dll obj[17]=File : c:\WINDOWS\Downloaded Program Files\CONFLICT.5\HDPlugin1015.dll obj[18]=File : c:\WINDOWS\Downloaded Program Files\CONFLICT.6\HDPlugin1015.dll obj[30]=File : C:\WINDOWS\GatorPdpPlugin.log obj[31]=File : C:\WINDOWS\GatorHDPlugin.log obj[32]=File : C:\WINDOWS\GatorHDPlugin.log-old.log obj[63]=RegValue : Software\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll" obj[64]=RegValue : Software\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1015.dll" obj[65]=RegValue : Software\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\Downloaded Program Files\CONFLICT.5\HDPlugin1015.dll" obj[66]=RegValue : Software\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\Downloaded Program Files\CONFLICT.6\HDPlugin1015.dll" obj[127]=Regkey : Software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/HDPlugin1015.dll obj[128]=Regkey : Software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.2/HDPlugin1015.dll obj[129]=Regkey : Software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.5/HDPlugin1015.dll obj[130]=Regkey : Software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.6/HDPlugin1015.dll obj[138]=Regkey : .default\software\microsoft\systemcertificates\trustedpublisher\ctls obj[139]=Regkey : .default\software\microsoft\systemcertificates\trustedpublisher\crls SAHAGENT »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[11]=File : c:\WINDOWS\SYSTEM\SahAgent.exe obj[19]=File : c:\WINDOWS\Downloaded Program Files\lsp_.dll obj[20]=File : c:\WINDOWS\Downloaded Program Files\SAHAgent_.exe obj[21]=File : c:\WINDOWS\Downloaded Program Files\SAHUninstall_.exe obj[22]=File : c:\WINDOWS\Downloaded Program Files\SahHtml_.exe obj[23]=File : c:\WINDOWS\Downloaded Program Files\WEBInstaller.dll obj[33]=File : C:\windows\TEMP\bundletracking.asp obj[34]=File : C:\WINDOWS\downloaded program files\xmlparse_.dll obj[35]=File : C:\WINDOWS\downloaded program files\xmltok_.dll obj[140]=Regkey : software\winsock2\layered provider sample obj[141]=Regkey : software\vgroup DSSAGENT »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[24]=File : c:\WINDOWS\Bbstore\DSS\DSSAGENT.EXE obj[49]=RegValue : software\broderbund software\dss "CobwebInterval" obj[50]=RegValue : software\broderbund software\dss "ServerURL" obj[51]=RegValue : software\broderbund software\dss "Active" obj[52]=RegValue : software\broderbund software\dss "AutolaunchRemoved" FAVORITEMAN »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[28]=File : C:\WINDOWS\SYSTEM\im64.dll obj[29]=File : C:\WINDOWS\SYSTEM\v.dat obj[59]=RegValue : .DEFAULT\software\microsoft\windows "Counter" obj[60]=RegValue : .DEFAULT\software\microsoft\windows "Server" obj[61]=RegValue : .DEFAULT\software\microsoft\windows "Object" ALEXA »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[42]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "MenuStatusBar" obj[43]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Script" obj[44]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "clsid" obj[45]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Icon" obj[46]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "HotIcon" obj[47]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "ButtonText" obj[58]=RegValue : .DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping "{c95fe080-8f5d-11d2-a20b-00aa003c157a}" XUPITER »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[57]=RegValue : software\microsoft\windows\currentversion\uninstall\xupiter "UninstallString" obj[75]=RegValue : software\microsoft\internet explorer\main "Search Bar" obj[76]=RegValue : software\microsoft\internet explorer\search "CustomizeSearch" obj[117]=Regkey : interface\{d686db39-659a-491a-a35c-60b99495c16e} obj[118]=Regkey : xtsearch.xtsearchhook obj[119]=Regkey : xtsearch.xtsearchhook.1 obj[126]=Regkey : software\microsoft\windows\currentversion\uninstall\xupiter POSSIBLE BROWSER HIJACK ATTEMPT »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[62]=RegValue : SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000EF1-0786-4633-87C6-1AA7A44296DA} "Installer" obj[131]=Regkey : SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000EF1-0786-4633-87C6-1AA7A44296DA} ADWARE.FONE »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[77]=RegValue : software\microsoft\windows\currentversion\uninstall\dmo "UninstallString" obj[120]=Regkey : software\microsoft\windows\currentversion\explorer\browser helper objects\{00000ef1-0786-4633-87c6-1aa7a44296da} obj[136]=Regkey : software\microsoft\windows\currentversion\uninstall\dmo IGETNET »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[113]=Regkey : typelib\{53f066f0-a4c0-4f46-83eb-2dfd03f938cf} OTHER »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[122]=Regkey : software\aveo SPYWARE.E2GIVE »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[124]=Regkey : software\classes\appid\{3b99f202-145a-4e5a-ac7b-88a36910bf5e} obj[125]=Regkey : software\classes\typelib\{3b99f202-145a-4e5a-ac7b-88a36910bf5e} obj[137]=Regkey : software\classes\appid\iebhos.dll

hi cherry1959,

I put them all in Quarantine for the moment because I am a afraid to delete….how do I know if I can delete this junk without screwing up any other stuff,registers etc.

i would leave them in quarantine for a few days, just to make sure everything functions ok and most likely it will. lavasofts ad aware is one of the originals and very good. then after a few days you can delete the quarantine files if you want to. the files are harmless in quarantine.

shelf life

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php