Trojans and Needless programs running.

kevindWNEC Topic Starter

Post #1November 14, 2006, 3:13 PM UTC

Hi Everyone.

Its time for me to clean my computer and have come to several roadblocks. AVG the other day said it detected 20ish viruses including 3 trojans. I believe the names were generic.qrx, generic.svd, and startpage.ade

Anyway AVG said it couldn't heal these - so I'm here today, on my knees, asking for help from all you experts!

Also, needless programs are running in my taskbar such as yahoo messenger, quicktime, and "safely remove hardware". I'd love for it if these programs didn't start when my computer starts - especially that damned yahoo messenger. I've tried a slurry of ways to remove it but to no avail.

here is my hijackthis log!

Logfile of HijackThis v1.99.1
Scan saved at 9:40:14 AM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Lexmark 4300 Series\lxcemon.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINNT\System32\NMSSvc.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\system32\lxcecoms.exe
C:\WINNT\System32\alg.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [vfwwdm32] C:\WINNT\System32\vfwwdm32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: ConferenceRoom Java Client - http://chat.strictlyhosting.com:8080/java/cr.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: {00F5A157-D564-4D5E-95F9-AD3D533D5D35} (FamilyFantastic.PhotoFantastic) - http://www.familyfantastic.com/builder/pag…toFantastic.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/en/wowbeta/Si.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://f2.pg.photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINNT\system32\lxcecoms.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

Trogan

Post #2November 14, 2006, 6:14 PM UTC

Hi kevindWNEC, welcome to Tom Coyote Forums!

Some things to do first:

1. HijackThis is currently sitting on your Desktop. You need to have it in its own folder, so backups have a place to sit. This step is important!

2. I don't see any indication of a Firewall in your HijackThis log. This may be because:

(1.) You are using Windows Firewall or a hardware Firewall.
(2.) You are using a Firewall of an unknown vendor.
(3.) You are using a Firewall, but it is disabled for unknown reasons
(4.) You don't use any firewall at all.

In the case you don't have a Firewall, please download one from the list below - They are Free!

Zone Alarm << I recommend this
Sunbelt Kerio PF
Outpost Firewall

3. You have two anti-virus programs running (AVG and McAfee). This is not a good idea as multiple anti-virus programs can conflict and cause more problems. You need to uninstall one of them through Add/Remove programs.
______________________________

Now, I would like to see another log from HijackThis.

Run Hijackthis.
Click on Open the Misc Tools section.
Next click on Open uninstall manager.
Press the Save list button.
Save the file to your desktop, with the default name of uninstall_list
Copy & Paste the entire contents of that file in your in your next post.

______________________________

We need to get a file scanned to find out what it is:

go to VirusTotal
Copy and paste the following file path into the Search Box at the top of the page:
C:\WINNT\System32\vfwwdm32.exe
Click on the Send button
Please post the results in your next reply.

Please post the Uninstall list, VirusTotal scan results and a new HijackThis log.

kevindWNEC

Post #3November 15, 2006, 4:01 AM UTC last edited November 15, 2006, 4:03 AM UTC

Ok, I deleted McAfee. Moved hijackthis its own folder in c:.. Made sure windows firewall was enabled, which it was. Downloaded ZoneAlarm and have it running.

Uninstall List

ABBYY FineReader 6.0 Sprint
Adobe Acrobat 5.0
AIM+ (remove only)
AOL Instant Messenger
Application Verifier Database
ArcSoft PhotoImpression
Audio CD Maker
AVG Free Edition
BitTorrent 3.4.2
Blackhawk Striker
Blasterball 2
Conquer 2.0
Cool Edit Pro 2.0
Creative Driver
Creative Jukebox Driver
Creative NOMAD II Driver
DAEMON Tools
Dark Orbit
Disney's Lilo and Stitch Pinball
DivX Codec
DivX Player
Do More
Dolet Light for Finale
DreamStation DXi
DVD
Easy CD Creator 5 Basic
Excavation
eXeem 0.22
Finale 2003
GameSpy Arcade
Gateway Rhapsody
GdiplusUpgrade
GemMaster 2
Google Toolbar for Internet Explorer
GTW V.92 Voicemodem
Half-Life: Counter-Strike
HelpSpot
HijackThis 1.99.1
HP Image Zone 3.5
hp instant support
HP Software Update
Intel® PRO Network Adapters and Drivers
Intel® PROSet II
InterActual Player
iPod for Windows 2005-02-22
iPod Updater 2004-08-06
IrfanView (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 8
Lexmark 4300 Series
Lexmark Fax Solutions
LimeWire PRO 4.12.6
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)
Macromedia Shockwave Player
Memories Disc Creator 2.0
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB886906)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2003
Microsoft Money 2003
Microsoft Money 2003 System Pack
Microsoft Office Professional Edition 2003
Microsoft Picture It! Photo 7.0
Microsoft Streets and Trips 2002
Microsoft Works 2003 Setup Launcher
Microsoft Works 7.0
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (1.5.0.8)
MSN Messenger 7.0
Network Play System (Patching)
NOMAD Jukebox 3 Driver
NSIS Example2
NVIDIA Display Driver
NVIDIA Drivers
overland
Pacific Poker
PC-Doctor for Windows
PhoneTools
Pig Pen
Polaroid Digital Cam
Power Tab Editor 1.7
PS/2 Millennium Keyboard
Quicken 2003 New User Edition
QuickTime
Readiris 7.5
RealPlayer
SafeCast Shared Components
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
SeeMePlayMe Client
Shareaza version 2.1.0.0
Shockwave
SimCity 2000® Special Edition
SoulSeek Client 156c
Sound Blaster Audigy
Space Rocks
Spyware Doctor 3.8
Starsiege TRIBES 1.8
Steam
TabIt version 2.01 (Trial)
TeamSpeak 2 RC2
The Sims
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
USB Game Pad
Ventrilo Client
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Virtual Warfare
WeatherBug
Webshots!
Winamp (remove only)
Windows Application Compatibility Toolkit 2.6
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
World of Warcraft
ZoneAlarm

Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 10:52:33 PM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\alg.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Lexmark 4300 Series\lxcemon.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\WINNT\system32\lxcecoms.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\notepad.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [vfwwdm32] C:\WINNT\System32\vfwwdm32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: ConferenceRoom Java Client - http://chat.strictlyhosting.com:8080/java/cr.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: {00F5A157-D564-4D5E-95F9-AD3D533D5D35} (FamilyFantastic.PhotoFantastic) - http://www.familyfantastic.com/builder/pag…toFantastic.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/en/wowbeta/Si.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://f2.pg.photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINNT\system32\lxcecoms.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

Virustotal Log

omplete scanning result of "vfwwdm32.exe", received in VirusTotal at 11.15.2006, 04:53:47 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.15.2006 no virus found
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.14.2006 no virus found
AVG 386 11.14.2006 no virus found
BitDefender 7.2 11.15.2006 no virus found
CAT-QuickHeal 8.00 11.14.2006 no virus found
ClamAV devel-20060426 11.14.2006 no virus found
DrWeb 4.33 11.15.2006 no virus found
eTrust-InoculateIT 23.73.56 11.15.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 no virus found
Ewido 4.0 11.14.2006 no virus found
Fortinet 2.82.0.0 11.15.2006 no virus found
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.14.2006 no virus found
Kaspersky 4.0.2.24 11.15.2006 no virus found
McAfee 4895 11.14.2006 no virus found
Microsoft 1.1609 11.15.2006 no virus found
NOD32v2 1866 11.14.2006 no virus found
Norman 5.80.02 11.14.2006 no virus found
Panda 9.0.0.4 11.14.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker [removed] 11.14.2006 no virus found
UNA 1.83 11.14.2006 no virus found
VBA32 3.11.1 11.14.2006 no virus found
VirusBuster 4.3.15:9 11.14.2006 no virus found

Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709

It seems that file, according to virustotals, is not a virus.

Trogan

Post #4November 15, 2006, 7:22 AM UTC

the results came back clean, but I still want to get the file checked out please.

But first, click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:

SafeCast Shared Components
_______________________________

Lets view hidden files and folders:

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Next, locate this file

C:\WINNT\System32\vfwwdm32.exe

Right-click and select Properties. Go to the Version tab and write down any info that is listed, especially next to Company.
_______________________________

Please download the Suspicious file Packer from Safer-Networking.Org and unzip it to your desktop.

Run SFP.exe.

Please copy the following line into the Step 1: Paste Text window:

C:\WINNT\System32\vfwwdm32.exe

then click "Continue".

This will create a .cab file on your desktop named requested-files[Date/Time].cab

Next please visit SpyKillers forum here

http://www.thespykiller.co.uk/forum/index.php?board=1.0

Read the instructions for uploading files which is the first topic on the forum, then start a new Topic named 'File Submission', please then post a link to this thread and upload the requested files.cab archive from your desktop
_______________________________

Please do an online scan with Panda ActiveScan

- Once you are on the Panda site, click the Scan your PC button
- A new window will open…click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log. Don't forgot the Property of the file above.

Thanks!

kevindWNEC

Post #5November 16, 2006, 1:35 AM UTC last edited November 16, 2006, 1:40 AM UTC

vfwwdm32.exe

File Version: 5.1.2600.2180
Description: WMM Driver for WDM Video Capture Devices
Copright: Microsoft Corp
Company: Microsoft Corp

Incident Status Location

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.realmedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[ad.yieldmanager.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.casalemedia.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.atdmt.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.tribalfusion.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.entrepreneur.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.peel.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.azjmp.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt[searchportal.information.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[ad.yieldmanager.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.advertising.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.realmedia.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.casalemedia.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.doubleclick.net/]
Spyware:Cookie/Qsrch Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.qsrch.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.entrepreneur.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.peel.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.azjmp.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt[searchportal.information.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[ad.yieldmanager.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.atdmt.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.realmedia.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.doubleclick.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.casalemedia.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.adrevolver.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.advertising.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.trafficmp.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.tribalfusion.com/]
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[citi.bridgetrack.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.peel.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.entrepreneur.com/]
Spyware:Cookie/Qsrch Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.qsrch.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt[searchportal.information.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.advertising.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.tribalfusion.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.advertising.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.realmedia.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.doubleclick.net/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[media.fastclick.net/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.pacificpoker.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.entrepreneur.com/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.webpower.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.peel.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt[searchportal.information.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.doubleclick.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.mediaplex.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.ads.pointroll.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.advertising.com/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.pacificpoker.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.entrepreneur.com/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.webpower.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.peel.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt[searchportal.information.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.advertising.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.peel.com/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.pacificpoker.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.target.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.entrepreneur.com/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.webpower.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[.toplist.cz/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt[searchportal.information.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.advertising.com/]
Spyware:Cookie/Luckynugget Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[www.luckynugget.com/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.pacificpoker.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.peel.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.target.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.entrepreneur.com/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt[.webpower.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.realmedia.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.doubleclick.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.casalemedia.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.fastclick.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.tribalfusion.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.advertising.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.questionmarket.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.atdmt.com/]
Spyware:Cookie/Luckynugget Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[www.luckynugget.com/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.pacificpoker.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.target.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.entrepreneur.com/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt[.webpower.com/]
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt[.pacificpoker.com/]
Spyware:Cookie/Luckynugget Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt[www.luckynugget.com/]
Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt[.kinghost.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt[.toplist.cz/]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[VerifierBug.class]
Adware:Adware/PestTrap Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-2fe5a879-59f21bac.zip[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-3f1991e2-52775d5b.zip[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[VerifierBug.class]
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-5f5cccb6-3779eff7.zip[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[VerifierBug.class]
Possible Virus. Renamed C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-73a13bb7-23e77b8c.zip[Xeyond.class]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@azjmp[2].txt
Spyware:Cookie/Barelylegal Not disinfected C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@clickbank[2].txt
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@entrepreneur[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@target[2].txt
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@webpower[1].txt
Spyware:Cookie/Freehqvideos Not disinfected C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Spyware:Cookie/Freehqvideos Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@_mov[1].txt
Potentially unwanted tool:Application/Zango Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\180740.tmp
Potentially unwanted tool:Application/Zango Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\caxE.tmp
Adware:Adware/Cydoor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\cd_clint.dll
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@adrevolver[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@adrevolver[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@advertising[1].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@atwola[2].txt
Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@banner[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@belnk[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@bluestreak[2].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@casalemedia[2].txt
Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@centrport[1].txt
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@doubleclick[2].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@fastclick[1].txt

kevindWNEC

Post #6November 16, 2006, 1:45 AM UTC

rest of panda scan

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@questionmarket[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@realmedia[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@tradedoubler[1].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@tribalfusion[1].txt
Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@valueclick[1].txt
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@zedo[1].txt
Adware:Adware/KeenValue Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\remove.exe
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\temp.cab[IExploreSkins.exe]
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\temp.cab[toolbar.dll]
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\toolbar.dll
Potentially unwanted tool:Application/Altnet Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\__unin__.exe
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~106591.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~158125.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~160683.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~161657.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~164605.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~165571.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~166425.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~167322.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~168401.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~169924.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~170917.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~171848.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~172605.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~173852.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~174304.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~175286.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~176134.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~177684.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~178650.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~179842.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~180672.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~181335.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~181995.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~182739.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~183770.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~186963.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~188091.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~188680.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~190269.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~191861.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~192584.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~193597.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~194498.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~265762.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~288992.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~289413.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~321664.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~322094.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~339427.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~339452.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~365715.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~412048.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~422780.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~433827.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~435202.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~438428.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~452254.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~499560.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~520043.tmp
Adware:Adware/WinTools Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~555738.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~573963.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~574295.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~627939.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~69449.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~809407.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~833151.tmp
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\~900821.tmp
Potentially unwanted tool:Application/Zango Not disinfected C:\Program Files\Mozilla Firefox\plugins\npclntax.dll
Adware:adware/gator

hijack this

Logfile of HijackThis v1.99.1
Scan saved at 8:33:09 PM, on 11/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\alg.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Lexmark 4300 Series\lxcemon.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\WINNT\system32\lxcecoms.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [vfwwdm32] C:\WINNT\System32\vfwwdm32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: ConferenceRoom Java Client - http://chat.strictlyhosting.com:8080/java/cr.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: {00F5A157-D564-4D5E-95F9-AD3D533D5D35} (FamilyFantastic.PhotoFantastic) - http://www.familyfantastic.com/builder/pag…toFantastic.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/en/wowbeta/Si.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://f2.pg.photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINNT\system32\lxcecoms.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

Trogan

Post #7November 16, 2006, 3:28 PM UTC

Hi kevindWNEC!

Thanks for uploading the file. From the properties, it looks like it belongs to Microsoft, so it safe.
_________________________________

You may wish to Print or Save the following instructions, as the internet will not be available once in Safe Mode later on in the fix!

Go to Start > Control Panel > double-click the Java icon to open it.

Click on Delete Files… under the General tab,

In the next window, make sure all THREE boxes are checked and press OK.

Press OK again to exist the Java Control Panel
_________________________________

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
This program is for XP and Windows 2000 only!

Double-click ATF Cleaner.exe to open it.

Under Main select the following: Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.
_________________________________

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
_________________________________

Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O16 - DPF: ConferenceRoom Java Client - http://chat.strictlyhosting.com:8080/java/cr.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB

O18 - Filter: text/html - (no CLSID) - (no file)

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis
_________________________________

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

_________________________________

View hidden files and folders:

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Next, find and delete the following in RED, if present:

C:\Program Files\Mozilla Firefox\plugins\npclntax.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\cd_clint.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\remove.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\temp.cab
C:\Documents and Settings\Administrator\Local Settings\Temp\toolbar.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\__unin__.exe
_________________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
  [external image: Posted Image]
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes

. Reboot back into Normal Mode, and post a new HJT log, along with the AVG anti-spyware log.

kevindWNEC

Post #8November 17, 2006, 3:31 AM UTC

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 10:19:05 PM 11/16/2006 + Scan result: C:\RECYCLER\S-1-5-21-2766135343-2047463394-3049170724-500\Dc8.exe -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Altnet -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-2766135343-2047463394-3049170724-500\Dc7.dll -> Adware.WebSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\AUI -> Adware.WebSearch : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~106289.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~106591.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~158125.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~160683.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~161657.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~164605.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~165571.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~166425.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~167322.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~168401.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~169924.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~170917.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~171848.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~172605.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~173852.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~174304.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~175286.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~176134.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~177684.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~178650.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~179842.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~180672.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~181335.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~181995.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~182739.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~183770.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~186963.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~188091.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~188589.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~188680.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~190269.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~191861.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~192584.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~193597.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~194498.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~265762.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~288992.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~289413.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~306939.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~307713.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~310670.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~321664.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~322094.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~330607.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~339427.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~339452.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~357287.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~365715.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~387317.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~392757.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~409772.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~412048.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~420870.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~422780.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~433827.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~435202.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~438428.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~441742.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~452254.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~453521.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~466390.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~474159.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~497129.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~499560.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~520043.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~530719.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~536992.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~555738.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~573963.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~574295.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~627939.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~63118.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~642515.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~64654.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~69449.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~809407.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~833151.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~900821.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~958030.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\~992190.tmp -> Adware.Wintol : Cleaned with backup (quarantined). C:\WINNT\Downloaded Program Files\gsda.dll -> Not-A-Virus.Downloader.Win32.SpyGame : Cleaned with backup (quarantined). :mozilla.110:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.120:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.123:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.128:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.51:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.79:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.102:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.104:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.105:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.107:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.147:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.160:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.161:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.166:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.174:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.230:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.231:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.269:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.270:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.271:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.48:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.49:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.505:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.509:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.636:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.790:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.835:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.395:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.396:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.397:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.462:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.463:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.466:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.467:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.511:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.512:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.513:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.566:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.567:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.568:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.594:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.595:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.880:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.881:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.882:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.60:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Admarketplace : Cleaned. :mozilla.61:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Admarketplace : Cleaned. :mozilla.43:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.53:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.54:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.55:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.56:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.13:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.35:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.36:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.37:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.48:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.48:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.49:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.51:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.52:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.52:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.53:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.54:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.6:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.76:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.80:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.33:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.65:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.84:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.89:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.127:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.129:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.131:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.132:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.39:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.40:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.40:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.41:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.58:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.59:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.60:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.61:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.62:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.63:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.64:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.68:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.69:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.75:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.76:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.77:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.79:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.80:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.82:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.309:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.528:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.532:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.655:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.808:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.847:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.376:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.37:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.73:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.271:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.307:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.308:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.317:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.325:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.329:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.330:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.330:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.331:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.332:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.332:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.333:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.334:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.339:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.344:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.344:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.345:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.345:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.346:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.350:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.351:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.351:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.351:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.352:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.352:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.360:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.361:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.370:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.378:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.386:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.400:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.403:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.403:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.404:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.406:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.407:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.409:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.417:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.418:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.452:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.453:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.457:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.470:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-3.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.470:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.502:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.510:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.511:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.512:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.513:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.525:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.533:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.534:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.535:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.536:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.537:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.538:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.538:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.539:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.540:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.541:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.542:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.543:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.547:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.551:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.552:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.553:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.590:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.600:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.606:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.607:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.611:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.612:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.620:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-5.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.625:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-4.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.639:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.657:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.657:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.658:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.659:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.660:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.661:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.662:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.690:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.691:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.696:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.697:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.698:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.699:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.714:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.721:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.722:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.723:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.728:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.72:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.732:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.733:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.735:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-6.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.737:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.737:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.738:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.739:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-7.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.743:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.744:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.745:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.746:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.763:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.764:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.784:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.785:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.786:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-8.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.791:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.804:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.default\cookies-9.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.809:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4jaqbdhk.defau

Trogan

Post #9November 17, 2006, 3:04 PM UTC

Could you post a new HijackThis log too please. Also, is AVG anti-virus still finding any infected files? If so, can you tell me the location of the files please.

kevindWNEC

Post #10November 17, 2006, 3:32 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 10:26:18 PM, on 11/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Lexmark 4300 Series\lxcemon.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINNT\system32\lxcecoms.exe
C:\WINNT\System32\wbem\wmiprvse.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [vfwwdm32] C:\WINNT\System32\vfwwdm32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {00F5A157-D564-4D5E-95F9-AD3D533D5D35} (FamilyFantastic.PhotoFantastic) - http://www.familyfantastic.com/builder/pag…toFantastic.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com/en/wowbeta/Si.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://f2.pg.photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINNT\system32\lxcecoms.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

sorry ! think the previous post was too long for the scan + hijackthis

anyways - i will be away until sunday. so take your time looking through the info.

Trogan

Post #11November 17, 2006, 3:57 PM UTC

Hi,

You didn't answer my last question:

Also, is AVG anti-virus still finding any infected files? If so, can you tell me the location of the files please.

Please let me know.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version…

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 5.0 Update 9.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement."
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove the following…
- J2SE Runtime Environment 5.0 Update 6
- J2SE Runtime Environment 5.0 Update 8
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version.

Please post a new HijackThis log, and answer my question.

Thanks!

Trogan

Post #12November 18, 2006, 4:36 PM UTC

Hi again! I've been notified that there is no file present when you uploaded it to the other forum. I would be very greatful if you could try uploading the file again following the instructions for Suspicious file Packer. Thanks!

kevindWNEC

Post #13November 19, 2006, 9:37 PM UTC

Hi, Back from my lil vacation.. OK AVG is not listing any viruses present as of now. I will be working on that file thing shortly.

Trogan

Post #14November 19, 2006, 9:43 PM UTC

Hope you enjoyed your vacation. I'll be waiting for your next reply.