This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help with all this stuff.

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Part 3…

KEY - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings - No SUBKEYS
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings -
Internet Settings\\User Agent - Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Internet Settings\\IE5_UA_Backup_Flag - 5.0
Internet Settings\\NoNetAutodial - 0
Internet Settings\\MigrateProxy - 1
Internet Settings\\EnableNegotiate - 1
Internet Settings\\ProxyEnable - 0
Internet Settings\\EmailName - IEUser@
Internet Settings\\AutoConfigProxy - wininet.dll
Internet Settings\\MimeExclusionListForCache - multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
Internet Settings\\WarnOnPost - 01 00 00 00
Internet Settings\\UseSchannelDirectly - 01 00 00 00
Internet Settings\\EnableHttp1_1 - 1
Internet Settings\\PrivacyAdvanced - 0
Internet Settings\\WarnOnZoneCrossing - 1
Internet Settings\\GlobalUserOffline - 0
Internet Settings\\PrivDiscUiShown - 1
Internet Settings\\EnableAutodial - 0
Internet Settings\\UrlEncoding - 0
Internet Settings\\ProxyHttp1.1 - 0
Internet Settings\\CertificateRevocation - 0
Internet Settings\\DisableCachingOfSSLPages - 1
Internet Settings\\SecureProtocols - 40
Internet Settings\\WarnonBadCertRecving - 1
Internet Settings\\WarnOnPostRedirect - 1
Internet Settings\\ProxyServer - :0
Internet Settings\5.0 -
Internet Settings\Cache -
Internet Settings\Connections -
Internet Settings\Digest -
Internet Settings\Lockdown_Zones -
Internet Settings\P3P -
Internet Settings\Passport -
Internet Settings\TemplatePolicies -
Internet Settings\Url History -
Internet Settings\ZoneMap -
Internet Settings\Zones -

KEY - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - No SUBKEYS
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults -
ProtocolDefaults\\ -
ProtocolDefaults\\http - 3
ProtocolDefaults\\https - 3
ProtocolDefaults\\ftp - 3
ProtocolDefaults\\file - 3
ProtocolDefaults\\@ivt - 1
ProtocolDefaults\\shell - 0

KEY - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones - Include SUBKEYS
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones -
Zones\\ -
Zones\\SelfHealCount - 1
Zones\0 -
Zones\0\\ -
Zones\0\\DisplayName - My Computer
Zones\0\\Description - Your computer
Zones\0\\Icon - explorer.exe#0100
Zones\0\\CurrentLevel - 0
Zones\0\\Flags - 33
Zones\0\\1001 - 0
Zones\0\\1004 - 0
Zones\0\\1200 - 0
Zones\0\\1201 - 1
Zones\0\\1400 - 0
Zones\0\\1402 - 0
Zones\0\\1405 - 0
Zones\0\\1406 - 0
Zones\0\\1407 - 0
Zones\0\\1601 - 0
Zones\0\\1604 - 0
Zones\0\\1605 - 0
Zones\0\\1606 - 0
Zones\0\\1607 - 0
Zones\0\\1608 - 0
Zones\0\\1609 - 1
Zones\0\\1800 - 0
Zones\0\\1802 - 0
Zones\0\\1803 - 0
Zones\0\\1804 - 0
Zones\0\\1805 - 0
Zones\0\\1A00 - 0
Zones\0\\1A02 - 0
Zones\0\\1A03 - 0
Zones\0\\1A04 - 0
Zones\0\\1A05 - 0
Zones\0\\1A06 - 0
Zones\0\\1A10 - 0
Zones\0\\1C00 - 131072
Zones\0\\1E05 - 196608
Zones\0\\2001 - 0
Zones\0\\2004 - 0
Zones\0\\1206 - 0
Zones\0\\1806 - 0
Zones\0\\1807 - 0
Zones\0\\1808 - 0
Zones\0\\1809 - 3
Zones\0\\2100 - 0
Zones\0\\2101 - 3
Zones\0\\2102 - 0
Zones\0\\2200 - 0
Zones\0\\2201 - 0
Zones\0\\2300 - 1
Zones\0\\2000 - 0
Zones\1 -
Zones\1\\ -
Zones\1\\DisplayName - Local intranet
Zones\1\\Description - This zone contains all Web sites that are on your organization's intranet.
Zones\1\\Icon - shell32.dll#0018
Zones\1\\CurrentLevel - 66816
Zones\1\\MinLevel - 65536
Zones\1\\RecommendedLevel - 66816
Zones\1\\Flags - 219
Zones\1\\1001 - 1
Zones\1\\1004 - 3
Zones\1\\1200 - 0
Zones\1\\1201 - 3
Zones\1\\1400 - 0
Zones\1\\1402 - 0
Zones\1\\1405 - 0
Zones\1\\1406 - 1
Zones\1\\1407 - 0
Zones\1\\1601 - 0
Zones\1\\1604 - 0
Zones\1\\1605 - 0
Zones\1\\1606 - 0
Zones\1\\1607 - 0
Zones\1\\1608 - 0
Zones\1\\1609 - 1
Zones\1\\1800 - 1
Zones\1\\1802 - 0
Zones\1\\1803 - 0
Zones\1\\1804 - 1
Zones\1\\1805 - 0
Zones\1\\1A00 - 131072
Zones\1\\1A02 - 0
Zones\1\\1A03 - 0
Zones\1\\1A04 - 0
Zones\1\\1A05 - 0
Zones\1\\1A06 - 0
Zones\1\\1A10 - 0
Zones\1\\1C00 - 131072
Zones\1\\1E05 - 131072
Zones\1\\2001 - 0
Zones\1\\2004 - 0
Zones\1\\1206 - 0
Zones\1\\1806 - 0
Zones\1\\1807 - 0
Zones\1\\1808 - 0
Zones\1\\1809 - 3
Zones\1\\2100 - 0
Zones\1\\2101 - 0
Zones\1\\2102 - 0
Zones\1\\2200 - 0
Zones\1\\2201 - 0
Zones\1\\2300 - 1
Zones\1\\2000 - 0
Zones\2 -
Zones\2\\ -
Zones\2\\DisplayName - Trusted sites
Zones\2\\Description - This zone contains Web sites that you trust not to damage your computer or data.
Zones\2\\Icon - inetcpl.cpl#00004480
Zones\2\\CurrentLevel - 65536
Zones\2\\MinLevel - 65536
Zones\2\\RecommendedLevel - 65536
Zones\2\\Flags - 71
Zones\2\\1001 - 0
Zones\2\\1004 - 1
Zones\2\\1200 - 0
Zones\2\\1201 - 1
Zones\2\\1400 - 0
Zones\2\\1402 - 0
Zones\2\\1405 - 0
Zones\2\\1406 - 0
Zones\2\\1407 - 0
Zones\2\\1601 - 0
Zones\2\\1604 - 0
Zones\2\\1605 - 0
Zones\2\\1606 - 0
Zones\2\\1607 - 0
Zones\2\\1608 - 0
Zones\2\\1609 - 1
Zones\2\\1800 - 0
Zones\2\\1802 - 0
Zones\2\\1803 - 0
Zones\2\\1804 - 0
Zones\2\\1805 - 0
Zones\2\\1A00 - 0
Zones\2\\1A02 - 0
Zones\2\\1A03 - 0
Zones\2\\1A04 - 0
Zones\2\\1A05 - 0
Zones\2\\1A06 - 0
Zones\2\\1A10 - 0
Zones\2\\1C00 - 196608
Zones\2\\1E05 - 196608
Zones\2\\2001 - 0
Zones\2\\2004 - 0
Zones\2\\1206 - 0
Zones\2\\1806 - 0
Zones\2\\1807 - 0
Zones\2\\1808 - 0
Zones\2\\1809 - 3
Zones\2\\2000 - 0
Zones\2\\2100 - 0
Zones\2\\2101 - 1
Zones\2\\2102 - 0
Zones\2\\2200 - 0
Zones\2\\2201 - 0
Zones\2\\2300 - 1
Zones\3 -
Zones\3\\ -
Zones\3\\DisplayName - Internet
Zones\3\\Description - This zone contains all Web sites you haven't placed in other zones
Zones\3\\Icon - inetcpl.cpl#001313
Zones\3\\CurrentLevel - 69632
Zones\3\\MinLevel - 69632
Zones\3\\RecommendedLevel - 69632
Zones\3\\Flags - 1
Zones\3\\1001 - 1
Zones\3\\1004 - 3
Zones\3\\1200 - 0
Zones\3\\1201 - 3
Zones\3\\1400 - 0
Zones\3\\1402 - 0
Zones\3\\1405 - 0
Zones\3\\1406 - 3
Zones\3\\1407 - 0
Zones\3\\1601 - 0
Zones\3\\1604 - 0
Zones\3\\1605 - 0
Zones\3\\1606 - 0
Zones\3\\1607 - 0
Zones\3\\1608 - 0
Zones\3\\1609 - 1
Zones\3\\1800 - 1
Zones\3\\1802 - 0
Zones\3\\1803 - 0
Zones\3\\1804 - 1
Zones\3\\1805 - 1
Zones\3\\1A00 - 131072
Zones\3\\1A02 - 0
Zones\3\\1A03 - 0
Zones\3\\1A04 - 3
Zones\3\\1A05 - 1
Zones\3\\1A06 - 0
Zones\3\\1A10 - 1
Zones\3\\1C00 - 65536
Zones\3\\1E05 - 131072
Zones\3\\{AEBA21FA-782A-4A90-978D-B72164C80120} - 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 1E 28 1A 04 1B 0C 3B C2 21 27 53 0D 36 05 2C 05 04 3D 4F 3A 4A 44 33 3A 0A 06 12 68 53 7C 20 13 35 5D 4C 10 27 01 56 7A 2D 3F 38 4F 79 0F 16 26 75 53 1C 31 00 56 7A 3E 32 24 4F 79 1B 00 33 71 4D 23 32 29 7C 6A 35 31 34 40 72 3B 01 2E 5D 4C 2A 07 15 48 72 38 12 00 56 7A 3E 16 3C 71 4D 24 33 35 7C 72 35 0E 3C 1A 41 44 19 0F 31 3A 56 7A 2E 3E 31 0C 7C 6A 10 27 0C 05 5D 4C 39 19 12 15 61 54 2E 00 33 32 40 52 03 25 1F 05 5D 4C 2C 0C 0A 15 61 54 1A 26 1F 05 5D 4C 10 21 1D 1B 71 4D 3B 24 3A 21 6D 72 24 16 3C 32 40 72 21 0F 3A 1A 41 44 1B 1E 01 01 71 4D 32 23 30 27 6D 4D 1F 28 10 3C 56 7A 2F 2E 32 16 7C 6A 3A 12 3B 28 75 53 0B 3F 12 01 71 4D 23 32 29 27 75 53 12 30 32 1E 4F 79 12 38 17 01 71 4D 30 3E 37 27 6D 72 38 12 3F 04 41 44 0A 0E 32 28 49 5F 1C 24 0B 1B 36 21 41 7B 5B 24 39 31 7C 6A 2B 0E 25 75 53 1A 2E 26 41 72 34 16 26 71 4D 30 30 3A 7C 6A 07 33 1A 56 7A 3A 00 33 71 4D 23 32 29 7C 6A 1A 26 1A 40 52 24 3F 1A 6D 4D 1C 22 28 75 53 13 25 20 41 44 0A 0E 32 75 53 08 07 20 71 4D 10 27 0D 05 5D 4C 24 1A 1E 1B 71 4D 3F 20 3F 21 6D 4D 10 27 0C 05 5D 4C 39 19 12 3A 56 7A 3A 20 2C 0C 7C 6A 3E 0C 37 07 75 53 12 30 32 3A 56 7A 25 2D 23 0C 7C 6A 2B 08 21 3A 56 7A 22 3A 32 3A 56 72 24 1E 26 1A 41 44 07 1F 03 1B 75 53 1C 31 01 01 71 4D 32 23 30 27 6D 72 34 1E 30 04 41 44 1B 1E 3B 28 49 5F 07 33 12 1B 5D 4C 35 0B 0A 1F 75 53 0B 00 34 28 40 72 3B 01 2D 04 41 44 01 05 34 28 40 52 22 36 04 34 48 72 38 12 3F 04 41 44 0A 0E 1F 01 71 4D 24 33 35 27 06 1C 68 53 49 14 21 01 40 52 10 27 0D 40 52 2C 29 05 6D 4D 1F 28 05 56 7A 2F 2E 32 75 53 07 33 12 40 52 3F 3A 19 6D 72 20 00 34 71 4D 1A 26 1A 40 52 24 3F 1A 6D 72 35 08 38 5D 4C 2D 01 18 48 7A 27 23 1F 56 7A 3B 2F 3F 4F 79 08 39 01 1B 71 72 33 1F 39 3A 56 7A 2E 3E 31 0C 7C 72 35 0E 3F 1A 41 44 0A 0A 35 3A 56 7A 3A 20 2C 0C 7C 6A 03 25 1F 05 5D 4C 2C 0C 0A 15 61 54 27 05 34 32 40 52 10 21 09 05 5D 4C 2D 01 18 15 61 54 07 37 17 05 5D 4C 1C 24 03 1B 71 4D 30 30 3B 27 6D 72 33 17 3F 28 40 72 34 1E 30 04 41 44 1B 1E 00 01 71 4D 2F 2C 2C 27 6D 4D 0B 26 3F 3C 56 7A 3A 20 23 16 7C 6A 35 05 33 28 75 53 12 30 17 01 71 4D 30 3E 37 27 75 53 13 25 20 1E 4F 79 1F 29 1F 01 71 4D 24 33 35 27 06 21 41 7B 5B 3D 24 37 7C 6A 2B 0E 25 40 72 33 1F 39 5D 72 34 1E 30 5D 4C 2A 0D 18 48 7A 27 12 3B 71 4D 23 32 12 56 72 20 0C 2E 5D 4C 2C 0C 0A 75 53 1A 26 1F 40 72 35 08 38 5D 4C 2D 01 18 75 53 0F 21 27 41 44 07 1F 3E 61 54 3D 06 22 32 40 52 2C 29 05 32 48 72 34 1E 05 1B 71 4D 10 27 0C 05 5D 4C 39 19 1A 1B 71 4D 23 32 24 21 6D 4D 03 25 1F 05 5D 4C 2C 0C 0A 3A 56 7A 25 2D 23 0C 7C 6A 2B 08 21 07 75 53 13 25 20 3A 56 7A 3E 3E 3B 0C 7C 6A 3F 0F 23 3A 56 7A 2F 2E 3D 3C 56 72 33 1F 39 04 41 44 1A 0E 05 01 75 53 1C 31 00 01 71 4D 2F 2C 2C 27 6D 72 20 0C 2D 04 41 44 06 18 2A 28 49 5F 1A 26 1A 1B 5D 4C 2C 0C 0F 1F 75 53 1C 1C 3E 28 40 72 38 12 3F 04 41 44 0A 16 3C 28 40 52 3E 39 06 34 21 21 41 7B 5B 23 27 3C 7C 6A 17 37 17 40 52 32 24 05 6D 4D 0E 21 2C 75 53 0B 31 31 75 53 08 3E 21 41 44 07 1E 3C 61 54 17 37 17 05 5D 4C 00 33 1E 1B 71 4D 2E 39 3B 21 6D 72 20 06 32 32 40 72 21 0F 3C 1A 41 44 1A 0E 1F 01 71 4D 20 2C 30 27 6D 4D 0E 21 2C 3C 56 7A 3A 2E 2D 16 7C 6A 3F 07 22 28 6E 02 68 4A 7C 21 09 26 5D 4C 29 1D 1F 56 7A 3F 32 38 4F 79 1E 30 01 56 7A 3A 2E 2D 4F 79 14 07 22 71 4D 24 30 3B 7C 6A 2A 1E 2F 07 75 53 0C 2D 26 3A 56 7A 31 25 3D 0C 7C 6A 3E 0E 35 3A 56 7A 3B 2F 3D 3A 56 72 34 1E 26 04 41 44 0B 0A 1E 01 75 53 0E 38 01 01 71 4D 23 30 2B 27 6D 72 21 0F 3C 04 28 1B 67 6B 5F 00 22 10 75 53 1F 21 27 41 44 0B 0A 31 75 53 0E 1D 22 71 4D 03 27 1D 40 52 3E 39 08 75 53 08 31 21 41 44 1A 0E 32 3A 56 7A 3F 32 38 0C 7C 6A 06 3E 0D 05 5D 4C 35 0D 09 15 61 54 29 07 22 32 40 52 17 37 17 1B 5D 4C 3A 19 16 1F 61 54 06 3E 0D 1B 5D 4C 03 27 11 01 71 4D 24 33 3B 27 06 21 41 73 41 11 25 1D 56 7A 2E 3E 3B 4F 79 18 12 3F 71 4D 2E 39 3B 7C 6A 3E 0E 35 40 72 21 0F 3C 5D 4C 36 0D 19 48 72 34 1E 1F 1B 71 4D 00 33 16 05 5D 4C 38 04 01 1B 71 4D 23 30 2B 21 6D 4D 1C 24 0D 05 5D 4C 29 1D 17 3C 56 7A 3F 32 38 16 7C 6A 39 09 25 09 75 53 0B 31 31 3C 56 7A 3B 2F 3D 16 15 39 5F 7B 42 03 38 02 40 20 2C 1E 4F 21 41 7B 5B 23 27 3C 7C 14 07 22 6E 02 68 4A 7C 20 13 35 5D 30 37 08 06 21 41 7B 5B 23 27 3C 7C 1B 39 1D 30 0C 7C 50 68 3A 3B 34 4F 1B 1E 3B 6E 02 68 73 41 0B 22 0A 56 12 30 32 28 1B 67 73 41 0B 22 2A 41 2C 0C 0F 21 21 41 7B 5B 23 27 3C 7C 08 1C 3E 66 1C 44 4F 56 06 13 05 61 27 23 1F 4F 2D 5B 53 7C 20 13 35 5D 3E 39 06 06 1C 68 53 7C 21 09 26 5D 32 12 3F 6E 02 68 4A 44 3E 37 02 6D 1C 24 01 4F 2D 5B 73 41 08 38 27 41 38 04 19 6E 02 68 4A 44 3E 37 02 6D 3E 0E 35 3B 21 41 7B 5B 24 39 31 7C 08 39 00 4F 2D 7C 50 68 3B 1D 3C 71 25 2D 2C 20 28 7C 50 68 3B 25 3B 4F 01 1D 2A 6E 02 68 4A 44 3E 37 02 6D 10 21 09 29 01 5E 45 67 14 30 07 49 12 16 3C 66 1C 44 73 41 08 38 27 41 36 0A 1B 21 2D 42 73 41 10 3B 2D 41 00 33 1E 4F 2D 5B 53 5E 2E 07 1D 75 21 07 22 66 1C 7C 50 68 23 24 31 4F 0D 15 01 4F 2D 5B 53 5E 2E 07 1D 48 0B 18 3C 6E 02 68 4A 44 26 36 0C 6D 2B 06 25 66 21 41 7B 5B 14 21 01 40 3A 31 24 15 21 41 7B 5B 3C 3E 3F 7C 12 38 17 4F 2D 5B 53 5E 2E 07 1D 75 35 08 38 36 1D 56 76 74 37 08 19 40 07 37 17 29 01 7C 50 68 23 24 31 4F 07 1F 3E 16 05 7C 50 68 20 3A 39 75 25 12 3F 66 1C 44 4F 56 1C 12 1D 56 1C 24 0D 29 21 41 7B 5B 3D 24 37 7C 1E 1D 22 66 1C 44 4F 56 1C 12 30 61 23 13 11 4F 2D 5B 53 5E 2F 01 15 48 10 27 0C 6E 02 68 4A 7C 36 12 38 5D 24 3F 19 6E 02 68 4A 44 21 2C 04 6D 35 05 34 66 1C 44 4F 56 1C 12 1D 56 1C 3B 25 28 1B 67 6B 5F 01 2C 28 75 24 1E 26 36 21 41 7B 5B 3D 24 37 7C 14 3A 0B 30 21 41 7B 5B 36 0C 7C
Zones\3\\{A8A88C49-5EB2-4990-A1A2-0876022C854F} - 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 41 0F 3F 2F 28 1B 67 6B 10 28 03 09 3F 1B 3C 15 36 21 50 68 3A 3B 34 4F 79 08 39 0D 49 72 33 1F 39 5D 4C 17 37 05 56 7A 2F 2E 32 4F 79 1F 12 3B 75 53 0B 3F 12 56 7A 3A 20 23 4F 79 12 05 33 71 4D 3A 31 29 7C 6A 2B 08 21 40 72 38 12 3F 5D 4C 39 1D 17 48 72 21 0F 03 56 7A 2F 06 22 32 40 52 2C 29 05 3A 56 7A 2E 3E 31 0C 7C 6A 2B 06 25 32 40 52 33 24 01 32 75 53 0B 3F 32 04 4F 79 1B 3B 1F 0C 40 72 3B 01 2D 1A 75 53 12 30 3F 04 4F 79 08 3F 09 0C 75 53 13 25 20 04 75 53 07 37 17 05 5D 4C 36 0A 1B 3A 56 72 35 0E 3C 3C 56 7A 2D 3F 38 16 7C 6A 17 37 01 1B 5D 4C 2A 0D 18 1F 61 54 12 12 3B 28 40 52 3F 3A 19 34 48 72 20 0C 17 01 71 4D 1A 26 1A 1B 5D 4C 2C 0C 17 01 71 4D 30 3E 37 27 6D 4D 1B 3B 0C 1B 5D 4C 39 1D 17 3C 56 7A 3B 2F 3F 16 15 39 5F 7B 42 29 1D 3C 71 4D 30 06 22 71 4D 32 23 30 7C 6A 2A 1E 19 75 53 1C 31 20 41 72 24 12 3B 71 4D 23 32 24 7C 6A 03 25 17 56 7A 25 05 33 71 4D 3A 31 29 7C 6A 10 21 09 40 52 27 2C 0B 6D 4D 0F 28 2A 75 53 08 3E 23 41 44 1B 1E 3C 3A 56 7A 12 34 16 05 75 53 1F 21 2D 04 4F 79 10 27 0C 05 5D 4C 39 19 12 15 75 53 0B 3F 32 04 4F 79 1B 00 34 32 40 52 24 3F 19 32 48 7A 2C 10 17 1B 71 4D 30 1C 3E 32 40 52 27 2C 0B 32 48 7A 27 16 3C 32 40 52 3E 07 20 3A 56 7A 2F 2E 3D 16 7C 6A 12 34 1E 01 71 4D 17 37 01 1B 5D 4C 2A 0D 18 3C 56 7A 3E 32 24 16 7C 6A 3E 0C 34 09 75 53 0B 3F 3F 1E 4F 79 12 38 12 01 71 72 3B 01 2E 3C 56 7A 2F 24 39 16 7C 72 38 12 3F 04 41 44 0A 0E 32 3C 56 7A 3B 2F 3F 16 15 39 7C 50 68 23 24 31 4F 79 08 39 0D 49 5F 12 34 16 40 52 17 37 01 40 52 22 38 0B 6D 4D 0F 34 1A 56 7A 3A 20 2C 75 53 03 25 1F 40 52 24 3F 19 6D 72 3B 05 34 71 4D 10 21 09 40 52 27 2C 0B 6D 72 24 1E 26 5D 4C 36 0A 1B 48 7A 36 13 01 1B 71 4D 32 23 30 21 6D 4D 17 37 01 3A 56 7A 2F 06 25 32 40 52 33 24 01 3A 56 7A 3A 20 2C 0C 7C 6A 3E 00 34 32 40 52 24 3F 19 32 75 53 12 30 3F 04 4F 79 08 3F 09 0C 40 72 38 12 3F 1A 75 53 0F 21 27 04 4F 79 14 3A 0B 0C 75 53 1C 31 21 1E 75 53 12 34 16 1B 5D 4C 29 1D 1D 3C 56 72 35 0E 3F 3C 56 7A 3E 32 24 16 7C 6A 03 25 1A 1B 5D 4C 35 0B 0F 1F 61 54 27 05 33 28 40 52 24 3F 1A 34 48 72 35 08 1D 01 71 4D 1B 3B 0C 1B 5D 4C 39 1D 1F 01 71 4D 24 33 35 27 06 1C 7C 50 68 20 3A 39 4F 79 08 06 22 71 4D 32 23 30 7C 6A 2A 1E 19 40 72 35 0E 3F 5D 72 24 1A 25 5D 4C 35 0B 0A 48 7A 23 00 34 71 4D 3A 31 12 56 72 3B 01 2E 5D 4C 2A 07 15 75 53 1B 3B 0C 40 72 24 1E 26 5D 4C 36 0A 1B 75 53 1C 31 21 04 4F 79 0A 2A 06 0C 40 72 34 1E 30 1A 41 44 1B 1E 3B 3A 56 7A 07 33 12 05 75 53 0B 3F 32 04 4F 79 03 25 1F 05 5D 4C 2C 0C 0A 15 75 53 12 30 3F 04 4F 79 08 1C 3E 32 40 52 27 2C 0B 32 48 7A 27 23 1F 1B 71 4D 24 07 20 32 40 52 22 38 08 34 48 7A 34 17 3F 28 40 52 23 16 26 3C 56 7A 2F 2E 32 16 7C 6A 07 33 1A 01 71 4D 03 25 1A 1B 5D 4C 35 0B 0F 3C 56 7A 25 2D 2C 16 7C 6A 35 31 37 09 75 53 1C 3B 25 1E 4F 79 13 35 00 01 71 72 24 1E 26 3C 56 7A 3B 2F 3F 16 15 21 41 7B 5B 23 27 3C 7C 6A 2A 16 3C 71 4D 20 2C 30 7C 6A 06 3E 0D 40 52 3F 38 18 6D 4D 08 27 2C 75 53 08 31 21 75 53 1F 21 27 04 4F 79 18 2D 06 0C 75 53 0E 38 21 04 75 53 03 27 1D 05 5D 4C 36 0A 19 3A 56 72 34 1E 26 3C 56 7A 3F 32 38 16 7C 6A 06 3E 0D 1B 5D 4C 35 0D 09 1F 61 54 29 07 22 28 29 01 5E 45 67 14 30 1F 56 7A 17 37 17 40 72 25 1A 39 5D 4C 38 04 01 56 7A 3A 2E 2D 4F 79 14 3A 01 56 7A 3B 2E 3D 4F 79 0F 16 3C 32 40 52 32 24 05 32 48 7A 18 28 01 1B 71 4D 23 06 32 32 40 52 3E 39 08 32 48 7A 37 16 3C 28 40 52 32 12 3F 3C 56 7A 31 25 3D 16 7C 6A 03 27 11 01 71 4D 1C 24 0D 1B 36 1D 56 76 74 14 21 01 40 52 23 28 02 6D 4D 0C 34 2B 75 53 0E 38 21 41 44 06 1E 2C 75 53 08 07 22 71 4D 1C 27 0D 40 52 23 28 02 3A 56 7A 3F 32 38 0C 7C 6A 39 1D 22 32 40 52 3F 38 18 32 75 53 08 3E 21 04 4F 79 0F 29 07 02 40 72 25 1A 39 04 75 53 0E 38 21 1E 4F 79 1B 39 1D 02 75 53 08 3E 21 1E 6E 02 7C 50 68 20 3A 39 4F 79 0F 16 3C 75 53 0C 2D 1E 56 7A 31 25 3D 4F 79 1B 06 32 71 4D 24 33 3B 7C 6A 3F 0E 25 40 72 34 1E 26 1A 41 44 0B 0A 31 3A 56 7A 06 3E 0D 05 75 53 0B 31 31 04 4F 79 1C 24 0D 05 5D 4C 29 1D 17 1F 75 53 0C 2D 26 1E 4F 79 1E 1D 22 28 40 52 3F 38 18 34 48 7A 22 12 01 01 66 1C 44 73 41 0B 22 2A 41 3A 19 16 21 2D 42 73 41 0B 22 2A 41 1C 24 01 4F 2D 5B 53 5E 35 1E 22 75 27 1D 22 66 1C 7C 50 68 3A 3B 34 4F 06 1E 11 4F 2D 5B 53 5E 35 1E 22 48 1C 18 2D 6E 02 68 4A 44 3F 2D 31 6D 35 05 33 66 21 41 7B 5B 03 38 02 40 3A 31 29 15 21 41 7B 5B 23 27 3C 7C 08 3F 1D 4F 2D 5B 53 5E 35 1E 22 75 24 1E 26 36 1D 56 76 74 3E 03 1C 40 1C 24 0B 29 01 7C 50 68 3A 3B 34 4F 0B 0A 31 28 30 21 41 7B 5B 23 27 0A 56 1C 24 0D 1B 36 1D 56 76 74 03 38 0A 56 0E 38 01 01 66 1C 44 4F 56 06 13 0A 56 0B 31 31 1E 20 28 74 4E 68 23 26 0A 56 1C 31 20 1E 20 28 74 4E 7C 20 13 0A 56 12 30 12 01 66 1C 44 4F 56 06 1B 2B 71 25 2D 23 16 15 39 5F 73 41 0B 22 2A 41 2A 07 15 3C 4F 2D 5B 53 5E 35 1E 22 48 0F 28 2A 3C 4F 2D 5B 53 7C 20 13 35 5D 3E 39 06 34 21 2D 42 73 41 08 38 27 41 00 33 1E 4F 2D 5B 53 5E 36 04 17 75 21 07 22 66 1C 7C 50 68 3B 25 3B 4F 0D 15 01 4F 2D 5B 53 5E 36 04 17 48 0B 18 3C 6E 02 68 4A 44 3E 37 02 6D 2B 06 25 66 21 41 7B 5B 1C 3E 17 40 3A 31 24 15 21 41 7B 5B 24 39 31 7C 12 38 17 4F 2D 5B 53 5E 36 04 17 75 35 08 38 36 1D 56 76 74 3F 09 2F 40 07 37 17 29 01 7C 50 68 3B 25 3B 4F 07 1F 3E 16 05 7C 50 68 3B 25 3B 75 25 12 3F 28 29 01 5E 45 67 14 1D 3C 75 21 0F 3C 3C 4F 2D 5B 53 5E 36 04 17 75 27 09 3C 04 28 1B 67 6B 5F 08 21 2A 75 20 0E 2C 04 28 1B 67 6B 5F 1C 3E 17 75 35 0E 3F 3C 4F 2D 5B 53 5E 36 04 1F 56 12 30 32 1E 20 28 74 4E 7C 21 09 26 5D 24 3F 1A 34 6E 02 68 4A 44 3E 37 02 6D 2B 08 21 09 6E 02 68 4A 44 1C 3E 17 40 2F 20 31 27 06 1C 68 53 7C 21 09 26 5D 3E 07 20 3C 4F 2D 5B 53 5E 2E 07 1D 75 25 12 3F 66 1C 7C 50 68 23 24 31 4F 07 1F 01 4F 2D 5B 53 5E 2E 07 1D 48 0E 21 2C 6E 02 68 4A 44 26 36 0C 6D 3E 06 32 66 21 41 7B 5B 14 21 01 40 30 30 3A 15 21 41 7B 5B 3C 3E 3F 7C 12 38 12 4F 2D 5B 53 5E 2E 07 1D 75 3B 01 2E 36 1D 56 76 74 37 08 19 40 10 21 09 29 01 7C 50 68 23 24 31 4F 0A 0E 32 16 05 7C 50 68 23 24 31 75 21 07 20 66 1C 44 4F 56 1F 14 05 56 00 33 16 1B 6E 02 68 4A 44 26 36 0C 6D 1C 24 0D 1B 36 1D 56 76 74 37 08 19 40 06 3E 0D 1B 36 1D 56 76 74 37 1C 26 71 03 27 1D 1B 6E 02 68 4A 44 26 36 0C 75 35 0E 3F 04 28 1B 67 6B 5F 14 21 01 40 3A 31 24 27 06 21 41 7B 5B 3C 3E 3F 7C 12 38 1F 02 3B 21 41 7B 5B 3C 1C 26 71 2F 24 39 16 15 39 5F 7B 42 14 21 01 40 2F 20 1F 01 6E 02 68 4A 44 26 36 0C 6D 1C 24 03 01 66 1C 7C 50 68 20 3A 39 4F 0B 0A 1E 4F 2D 5B 53 5E 2F 01 15 48 08 27 2C 6E 02 68 4A 44 21 2C 04 6D 39 1D 22 66 21 41 7B 5B 15 3B 09 40 23 30 2B 15 21 41 7B 5B 3D 24 37 7C 08 39 00 4F 2D 5B 53 5E 2F 01 15 75 3B 01 2D 36 1D 56 76 74 28 02 21 40 1A 26 1F 29 01 7C 50 68 20 3A 39 4F 1B 14 30 16 05 7C 50 68 20 3A 39 75 24 16 3C 66 1C 44 4F 56 1C 12 1D 56 1C 24 0B 29 21 41 7B 5B 3D 24 37 7C 18 12 3F 28 29 01 5E 45 67 0D 35 09 49 29 07 22 28 29 01 5E 45 67 0D 35 1D 56 0E 1D 22 28 29 21 41 7B 5B 3D 24 37 7C 03 27 1D 1B 36 1D 56 76 74 28 1A 3E 71 2F 2E 32 16 15 39 7C 50 68 20 3A 39 4F 01 1D 2D 28 30 0C 7C 50 68 20 3A 1D 56 12 30 3F 1E 20 28 74 4E 68 29 1A 3E 71 2F 24 39 3C 4F 21 41 7B 5B 3D 24 37 7C 1F 16 3C 3C 4F 2D 5B 73 41 11 25 25 41 36 0A 1B 3C 4F 2D 5B 53 5E 20 39 74
Zones\3\\2001 - 0
Zones\3\\2004 - 0
Zones\3\\1206 - 3
Zones\3\\1806 - 1
Zones\3\\1807 - 1
Zones\3\\1808 - 0
Zones\3\\1809 - 0
Zones\3\\2100 - 0
Zones\3\\2101 - 0
Zones\3\\2102 - 3
Zones\3\\2200 - 3
Zones\3\\2201 - 3
Zones\3\\2300 - 1
Zones\3\\2000 - 0
Zones\4 -
Zones\4\\ -
Zones\4\\DisplayName - Restricted sites
Zones\4\\Description - This zone contains Web sites that could potentially damage your computer or data.
Zones\4\\Icon - inetcpl.cpl#00004481
Zones\4\\CurrentLevel - 73728
Zones\4\\MinLevel - 73728
Zones\4\\RecommendedLevel - 73728
Zones\4\\Flags - 3
Zones\4\\1001 - 3
Zones\4\\1004 - 3
Zones\4\\1200 - 3
Zones\4\\1201 - 3
Zones\4\\1400 - 3
Zones\4\\1402 - 3
Zones\4\\1405 - 3
Zones\4\\1406 - 3
Zones\4\\1407 - 3
Zones\4\\1601 - 1
Zones\4\\1604 - 1
Zones\4\\1605 - 0
Zones\4\\1606 - 3
Zones\4\\1607 - 3
Zones\4\\1608 - 3
Zones\4\\1609 - 1
Zones\4\\1800 - 3
Zones\4\\1802 - 1
Zones\4\\1803 - 3
Zones\4\\1804 - 3
Zones\4\\1805 - 1
Zones\4\\1A00 - 65536
Zones\4\\1A02 - 3
Zones\4\\1A03 - 3
Zones\4\\1A04 - 3
Zones\4\\1A05 - 3
Zones\4\\1A06 - 3
Zones\4\\1A10 - 3
Zones\4\\1C00 - 0
Zones\4\\1E05 - 65536
Zones\4\\{AEBA21FA-782A-4A90-978D-B72164C80120} - 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 13 37 13 12 14 1A 15 39
Zones\4\\{A8A88C49-5EB2-4990-A1A2-0876022C854F} - 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 13 37 13 12 14 1A 15 39
Zones\4\\2001 - 3
Zones\4\\2004 - 3
Zones\4\\1206 - 3
Zones\4\\1806 - 3
Zones\4\\1807 - 1
Zones\4\\1808 - 0
Zones\4\\1809 - 0
Zones\4\\2100 - 3
Zones\4\\2101 - 3
Zones\4\\2102 - 3
Zones\4\\2200 - 3
Zones\4\\2201 - 3
Zones\4\\2300 - 3
Zones\4\\2000 - 3

< End of report >



Incident Status Location

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\dave and michelle\Cookies\dave and michelle@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\dave and michelle\Cookies\dave and michelle@doubleclick[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\dave and michelle\Cookies\dave and michelle@hitbox[2].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\dave and michelle\Cookies\dave and [removed][1].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet [removed][2].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet [removed][1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@atwola[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@bluestreak[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@casalemedia[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@fastclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@mediaplex[2].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@overture[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@realmedia[1].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet [removed][1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@tribalfusion[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@zedo[1].txt
Hi Budapest George.

Having posting problems

Sorry, I should have warned you that it would take more than one post. :oops:

There is no sign of anything wrong in the WinPFind2 report. I would have expected Panda ActiveScan to have picked up the 'me_' temporary files if they were bad. Although I would still like to know what those files are, I think we can be pretty sure that they are OK. You can get rid of those cookies by running ATF Cleaner or CCleaner.

—————————————————————

Housekeeping

There is a bit of tidying up to do. I suggest that you keep AVG Anti-Spyware and either CCleaner or ATF Cleaner, as they are useful programs. You can delete the following:
  • WinPFind2 and its report
  • FindAWF and its report
  • Any miscellaneous files we saved on your desktop (.bat, .reg or .txt)
  • ComboFix and its report
  • FileFind (unless you want to keep it)
  • Killbox
You can uninstall the following, if you don't want to keep them (use Add/Remove Programs)
  • Erunt (registry backup tool)
  • Kaspersky Online Scan
  • Panda ActiveScan
————————————————————-

Flush System Restore

Now that the computer is clean, it would be a good idea to 'flush' the System Restore points.

Turn OFF System Restore.
  • Click on Start
  • Right-click My Computer
  • Click Properties
  • Click the System Restore tab
  • Check Turn off System Restore
  • Click Apply, and then click OK
Restart your computer

Turn ON System Restore.
  • Click on Start
  • Right-click My Computer
  • Click Properties
  • Click the System Restore tab
  • Uncheck Turn off System Restore
  • Click Apply, and then click OK
This will create a new, clean restore point.

——————————————————–

This is my standard 'speech' once someone's computer is clean. Forgive me if you already do some, or all, of the following.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Internet Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to 'Prompt'
      • Change the Download unsigned ActiveX controls to 'Disable'
      • Change the Initialise and script ActiveX controls not marked as safe to 'Disable'
      • Change the Installation of desktop items to 'Prompt'
      • Change the Launching programs and files in an IFRAME to 'Prompt'
      • Change the Navigate sub-frames across different domains to 'Prompt'
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the OK button to exit the Internet Properties page.
  • Use an Anti-Virus Software - It is very important that you have a good anti-virus program running on your computer. This alone can save you a lot of trouble with malware in the future. Without one, you are wide-open to infection. Two good ones are Avast and AVG. Both are free, for personal use.
  • Update your Anti-Virus Software - It is imperative that you update your anti-virus software at least once a week (even more if you can). If you do not update your anti-virus software then it will not be able to catch any of the new variants that may come out.
  • Use a Firewall - I cannot stress how important it is that you use a firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can greatly lower your risk. Windows XP Firewall is better than nothing, but it only protects against incoming traffic. It doesn't protect you against outgoing baddies trying to "phone home". I strongly suggest that you use one of the third-party ones. Sunbelt Kerio and Zone Alarm are both good and have a free version.
  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit Windows Update regularly. This will ensure you always have the latest security updates installed on your computer. If there are new updates to install, install them immediately, reboot your computer and revisit the site until there are no more critical updates.
  • If they are not already present, I would recommend that you download and install some, or all, of the following programs (all free):
    • Spybot - Search and Destroy -Download and install Spybot - Search and Destroy with its TeaTimer option.
      This will provide real-time spyware and hijacker protection on your computer, alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here: Instructions for Spybot S&D and Ad-Aware
    • Ad-Aware SE Personal - Download and install Ad-Aware SE Personal. You should also scan your computer with the program on a regular basis just as you would an anti-virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here: Instructions for Spybot S&D and Ad-Aware
    • SpywareBlaster - SpywareBlaster will add a large list of programs and websites into your Internet Explorer and/or Firefox browser settings that will protect you from running and downloading known malicious programs. An article on anti-malware products with links for this program and others can be found here: Computer Safety on line - Anti-Malware
    • McAfee SiteAdvisor and Firetrust Sitehound. These both give warnings when you are about to enter a website that is on their 'block' list. I use Sitehound, but both have a good reputation (N.B. use only one of them, not both).
  • Update all of these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected will reduce dramatically.

Let me know if you have any further questions.
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI