Trojans/malware/popups

Hi jonin6 - We are currently studying your log and will have instructions for you shortly. Thank you for your patience.

Hi Waterfalls, Thank you for your support. I await a reply. Sincerely, Jonin

Hi,

Welcome to TomCoyote Forums! Please follow these instructions exactly and in the order given.

• HijackThis is running from a Temp folder. The contents of a Temp folder periodically get deleted. Since HijackThis creates backups each time it fixes an entry, the program along with the backups are subject to being deleted. You will have to move it to a permanent folder.
Rather than create a new folder and move it, just download the current version from here and save it to a convenient location. This is a self-executing file, so just double-click the file and it will install itself in its own folder in Program Files. Use this version from now on. The other one will be deleted during the steps we will take.

• Please disable Ad-Watch as it may hinder the removal of some entries. You can re-enable it after your computer is clean.
To disable Ad-Watch:
1. Right click on the Ad-Watch icon in the system tray and select "Restore Ad-Watch".
2. At the bottom of the screen there will be two checkable items called "Active" and "Automatic".Active: Switches Monitoring On or Off without closing
Automatic: Switches Automatic Blocking On or Off
3. Uncheck (red X) both items.

Remember, when we have completed cleaning your machine, to turn Ad-Watch back on using the same steps - but select ONLY Active. Ad-Watch will prompt you to accept those registry changes that were made in the cleanup. They must be accepted.

• Now download Look2Me-Destroyer.exe to your desktop.

- Close all windows before continuing.
- Double-click Look2Me-Destroyer.exe to run it.
- Put a check next to Run this program as a task.
- You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
- When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
- Once it's done scanning, click the Remove L2M button.
- You will receive a Done Scanning message, click OK.
- When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
- Your computer will then shutdown.
- Turn your computer back on.

If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

• Please post the contents of Look2Me-Destroyer.txt and a new HiJackThis log.

Hi,

• Go to Start > Run and copy/paste: sc delete Windows Event - click OK
Again, go to Start > Run and copy/paste: sc delete WinEvent - click OK

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
O23 - Service: Windows Event (WinEvent) - Unknown owner - C:\WINDOWS\winevent.exe (file missing)

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'. Then exit HijackThis.

Reboot your computer.

• Please download, install, and update ewido anti-spyware.

• Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
• After the update finishes (the status bar at the bottom will display "Update successful")
• Then click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan
• Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
• Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.
• Click on Save Report-, then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
• Close Ewido and reboot!!

• Post back with the results of the ewido scan and a new HijackThis log. Also, let me know how your computer is running now.

Wel… what can I do now? I've tried running Ewido twice, the first time i finished the scan and then continued to Apply all actions which it did until it reached one of the listings and then said Error… unfortunately the program at that point froze and I had to end the program which didn't allow me to save a report. Then the second time I ran it in Safe mode where it finished the scan and I proceeded to Apply all actions and then it said done after the first listing and froze again where I had to end the program and could not generate a report either. Please advise. Thank you in advance. Oh yeah, the first time I ran it popups came up while it was scanning…

• Please download Combofix: http://download.bleepingcomputer.com/sUBs/combofix.exe
and save to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.

Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Do not proceed with the rest of the fix if you fail to run combofix
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100

• Post back with the combofix.txt log and a new HijackThis log.

So while I'm doing the above, I just wanted to let you know that I booted in safe mode and ran a memory scan, registry scan and fast scan and included the logs below: ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 8:32:56 PM 2006-09-27 + Scan result: [288] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [340] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [352] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [512] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [576] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [748] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [784] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). ::Report end ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 8:33:48 PM 2006-09-27 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKLM\SOFTWARE\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKLM\SOFTWARE\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-746137067-1547161642-725345543-1003\Software\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-746137067-1547161642-725345543-1003\Software\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-746137067-1547161642-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). ::Report end ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 8:42:54 PM 2006-09-27 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-746137067-1547161642-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). C:\WINDOWS\Temp\TMP14.tmp\drsmartload106a.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined). C:\WINDOWS\Temp\TMP14.tmp\mmxateam.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined). C:\WINDOWS\Temp\TMP4.tmp\mmxateam.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined). C:\WINDOWS\Temp\TMP5.tmp\mmxateam.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined). C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [288] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [340] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [352] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [512] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [576] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [748] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). [784] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined). :mozilla.6:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.7:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.10:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.11:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.12:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.13:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.15:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.17:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.18:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.19:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.20:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.21:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.22:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.23:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.24:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.25:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.26:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.27:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.281:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.28:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.29:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.30:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.31:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.32:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.33:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.34:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.35:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.36:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.37:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.383:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.38:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.39:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.40:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.417:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.41:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.42:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.43:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.44:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.45:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.46:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.47:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.48:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.49:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.50:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.51:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.52:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.53:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.55:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.8:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.9:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@chumtv.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@maxim.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@supportsoft.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.637:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.638:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.86:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.87:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.88:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.89:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.92:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.94:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). :mozilla.100:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). :mozilla.101:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). :mozilla.102:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). :mozilla.98:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). :mozilla.99:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@adorigin[2].txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][1].txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined). :mozilla.104:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined). :mozilla.105:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined). :mozilla.660:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.661:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.662:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.162:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.163:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.175:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined). :mozilla.606:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined). :mozilla.607:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined). :mozilla.176:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.177:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.178:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.179:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.180:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.181:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.702:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.187:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.188:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.189:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.190:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.283:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined). :mozilla.781:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][1].txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined). :mozilla.266:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.96:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). :mozilla.134:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.135:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.136:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.137:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.138:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.139:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.287:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). :mozilla.655:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). :mozilla.656:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). :mozilla.784:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined). :mozilla.785:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined). :mozilla.706:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.707:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.708:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.686:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined). :mozilla.415:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.416:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.436:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.423:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup (quarantined). :mozilla.424:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup (quarantined). :mozilla.717:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). :mozilla.718:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). :mozilla.719:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). :mozilla.720:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). :mozilla.478:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). :mozilla.495:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.496:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.497:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.498:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.499:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.191:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.192:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.193:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.194:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.195:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.196:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.197:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.198:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.199:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.200:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.201:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.202:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.203:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.204:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.205:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.206:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.207:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.208:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.209:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.210:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.211:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.212:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.213:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.214:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.215:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.216:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.217:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.218:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.219:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.220:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.221:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.222:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.223:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.224:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.225:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.226:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.227:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.228:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.229:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.230:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.231:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.232:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.233:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.234:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.235:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.236:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.237:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.238:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.512:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup (quarantined). :mozilla.514:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.515:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.516:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.517:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.518:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.519:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.520:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.521:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.522:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.523:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.524:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.525:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.526:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.527:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.528:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.529:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.530:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.531:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.532:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.533:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.534:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.535:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.536:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.537:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.538:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.539:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.540:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.541:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.542:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.543:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.544:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.545:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.546:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.547:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.548:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.549:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.550:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.551:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.552:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.553:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.554:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.555:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.556:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.557:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.558:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.563:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.564:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.565:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Jonin\Cookies\jonin@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.593:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.594:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.595:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.597:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.598:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.439:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.440:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.441:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.442:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.469:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.470:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.471:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.472:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.473:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup (quarantined). :mozilla.621:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined). :mozilla.622:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined). :mozilla.639:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.640:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.641:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.642:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.643:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.644:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.80:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.81:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.82:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.83:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.84:C:\Documents and Settings\Jonin\Application Data\Mozilla\Firefox\Profiles\9w6jlwlm.default\cookies.txt -> TrackingCookie.Yiel

• Please download Combofix: http://download.bleepingcomputer.com/sUBs/combofix.exe
and save to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.

Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Do not proceed with the rest of the fix if you fail to run combofix
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100

• Post back with the combofix.txt log and a new HijackThis log.

Please follow my instructions exactly and in the order given.

• If you have an earlier version of eMule than version 0.47, you need to uninstall the program because it probably came bundled with spyware. If you do have an earlier version, then:
- Go to Start > Control Panel > Add/Remove Programs
- Select eMule
- Click Remove
- Select popupwithcast (if listed)
- Click Remove
- Exit

• Open Notepad and copy and paste the text inside the quotebox in it:

REGEDIT4

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"{B84CCA60-06C2-4105-0329-040307230001}"=-

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"{B84CCA60-06C2-4105-0329-040307230001}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\newname]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\septpop06apsept]

- Save this as fix.reg -> choose to save as *all files -> and place it on your desktop.
- It should look like this: [external image: Posted Image]
- Double-click on it and, when you are asked if you want to merge the contents to the registry, click YES/OK.

• Please set your system to show all files.
- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab. Under the Hidden files and folders heading, select Show hidden files
and folders.
- Uncheck: Hide file extensions for known file types
- Uncheck the Hide protected operating system files (recommended) option.
- Click Yes to confirm.
- Click OK.

• Reboot into SAFE MODE.
To get into the Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - URLSearchHook: (no name) - _{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O16 - DPF: {754693AA-011F-40DD-B075-DD4644A47F54} (Importer.Imp) - http://www.imvu.com/catalog/invite/Importer.CAB

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'. Then exit HijackThis.

• Navigate to and delete the following folders if present:
C:\Program Files\Common Files\{B84CCA60-06C2-4105-0329-040307230001}
C:\Program Files\popupwithcast

• Navigate to and delete the following files if present:
C:\WINDOWS\popupwithcast.exe
C:\Program Files\swxf.exe
C:\Program Files\secure32.html
C:\Documents and Settings\Jonin\Application Data\WavCodec.wff
C:\nwnmff_e11.exe

• Navigate to and delete the following folder if present:
C:\Program Files\Common Files\{B84CCA60-06C2-4105-0329-040307230001}

• Reboot into Normal Mode.

• Now go to the following site: http://virusscan.jotti.org/
and scan the following files:
C:\WINDOWS\system32\nsw20.dll
C:\WINDOWS\system32\lfoc9b2b.sys
C:\aumco.exe

When you go to the site, you will see "File to upload & scan" at the top of the page. Click "Browse" and a "File Upload" window will open.
Navigate to the first file:
C:\WINDOWS\system32\nsw20.dll
Click onto the file, click "Open" and then click "Submit"
Wait for the scan to finish. Copy the results because you will paste them in your next reply.
Repeat the steps for the next two files.

• Post back with the results from Jotti's on the three files and a new HijackThis log.

Hey there Waterfalls: I didn't continue with the rest of the instructions as I got an error when I tried to add the information to the registry. It gave me the following error: "Cannot import C:\Documents and Settings\Jonin\Desktop\fix.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor." I didn't have a version of eMule below 0.47 nor did I have popupwithcast in the Add/Remove Programs. Please advise. Jonin6

Hi,

I want you to delete the fix.reg file that you created.

Go back and read the instructions carefully. Create the file again following the directions exactly as I posted them. The wording inside the quotebox beginnning with REGEDIT4 is to be copied and pasted to Notepad. Then follow the rest of the steps exactly.

As far as popwithcast not being in Add/Remove Programs, I didn't think it would be. That's why I put next to it "(if listed)" so that's okay.