What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Heur/crypted

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've gotten 2 Antivir notices about a HEUR/Crypted virus on my computer.
First it was found in one of my online games which I don't play anymore (Gunz).Which I deleted the program file for.
The second was found in my Sound System.
I don't know what the cause is so can you please help me out.
(The virus is now in Quarantine).

Here is a log:
Logfile of HijackThis v1.99.1
Scan saved at 8:19:35 PM, on 8/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gunz.ijji.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: War Rock Toolbar Helper - {0914953A-B6C0-42C3-983E-5213C64AFA9B} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: War Rock Toolbar - {5D956A61-05E7-427B-A2B1-BF32FB18B1BE} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://www.cabalonline.net/Com/CabalWebLauncher.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: ezstor - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-mem1 - {C3719F83-7EF8-4BA0-89B0-3360C7AFB7CC} - C:\Program Files\Common Files\EzTools\wowctl2.dll (file missing)
O18 - Protocol: x-zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Post #2
Hi OmegaUltima,

Sorry for the delays in getting to your post. But as you can probably see there are more posts than qualified helpers.

With that said, I'm not seeing anything overly malicious in your HJT log. The one question I have is on the War Rock toolbar. I cannot find a whole lot of info. on it but may be questionable. Is it something you installed knowingly and if so do you use it?

We could have you run a full Kaspersky scan to see if anything else is lurking. Are there any other indications of malware, ie sysytem slow down, pop ups, ect…?

Using Internet Explorer, click on Kaspersky Online Scanner * You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

Let me know about the toolbar and how it's running.
Post #3
Hey
My computer gets frequent groans sometimes but the CPU Usage seems to be alright( usually below 10%)
But normal procceses tend to use up alot Mem usage more than they used to.
Svchosts appeared more then they used to.
No popups or malicious malware disturbances really..
As for the WarRock toolbar I don't use it at all, so what a a good and safe way to remove it?





So here is my Scan Log:

Wednesday, August 29, 2007 5:55:38 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 29/08/2007
Kaspersky Anti-Virus database records: 398194
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan Statistics
Total number of scanned objects 95605
Number of viruses found 3
Number of infected objects 10
Number of suspicious objects 0
Duration of the scan process 04:47:03

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cert8.db Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\history.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\key3.db Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\parent.lock Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Paul Chiu\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\Cdvd.exe/stream/data0013 Infected: not-a-virus:AdWare.Win32.MyWay.j skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\Cdvd.exe/stream/data0014 Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\Cdvd.exe/stream Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\Cdvd.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\mirc617.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\mirc617.exe mIRC: infected - 1 skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\AOL OCP\AIM\Storage\data\knightnuker88\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\AOL OCP\AIM\Storage\data\kyoxhyde\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
C:\Documents and Settings\Paul Chiu\ntuser.dat Object is locked skipped
C:\Documents and Settings\Paul Chiu\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL Infected: not-a-virus:AdWare.Win32.MyWay.j skipped
C:\Program Files\MySearch\bar\1.bin\S42NS.EXE Infected: not-a-virus:AdWare.Win32.MyWay.j skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{026412F9-F2D8-4E6D-A5C6-19C249907F8E}\RP646\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A95C41B7-D49D-46DA-BC88-9C6AED2943ED}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
















And my Hijack Log:
Logfile of HijackThis v1.99.1
Scan saved at 5:56:27 PM, on 8/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\aim6\anotify.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: War Rock Toolbar Helper - {0914953A-B6C0-42C3-983E-5213C64AFA9B} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: War Rock Toolbar - {5D956A61-05E7-427B-A2B1-BF32FB18B1BE} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://www.cabalonline.net/Com/CabalWebLauncher.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: ezstor - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-mem1 - {C3719F83-7EF8-4BA0-89B0-3360C7AFB7CC} - C:\Program Files\Common Files\EzTools\wowctl2.dll (file missing)
O18 - Protocol: x-zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Post #4
We can use HJT to safely remove the toolbar.

STEP 1:

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: War Rock Toolbar Helper - {0914953A-B6C0-42C3-983E-5213C64AFA9B} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll
O3 - Toolbar: War Rock Toolbar - {5D956A61-05E7-427B-A2B1-BF32FB18B1BE} - C:\Program Files\War Rock Toolbar\v3.2.0.0\War_Rock_Toolbar.dll

Then close all windows except this one and press Fix checked.

Kaspersky found some files/folders that we need to remove.

STEP 2:

We need to make sure all hidden files are showing so please:
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Please reverse this process once the fix is complete.

STEP 3:

Using Windows Explorer delete the following file and folder:

C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\Cdvd.exe<–File
C:\Program Files\MySearch<–Folder

STEP 4:

Use ATF Cleaner to remove temp files,
cookies, cache, ect…
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

STEP 5:

Download AVG Anti-Spyware from Here and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG Anti-Spyware and update the definition
    files.
  • On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Delete".
  • Under "Reports" Select "Do not automatically generate reports"

NOTE: If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file.
Make sure that AVG Anti-Spyware is closed before installing the update.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon,
    some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Once in Safe Mode:

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware, and run a full scan.
  • IMPORTANT: Do not open any other windows or
    programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • AVG will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it as a text file on your Desktop (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and Reboot in Normal Mode.

Reboot and post the AVG log and a new HJT log for review. Please also let me know how it's running now.
Post #5 last edited
Is it normal that my computer runs slower and groans a little more when I start it with the AVG Shield Activated(guard.exe)?
And I seem to be experiencing a few problems after the fix:
-When I try to watch Youtube videos sometimes the screen and the video window suddenly blanks out even when I have the newest version of Adobe FlashPlayer.
-The font and format of everything on Wikipedia has changed from when I visited it before.
Is there a way I can restore my original Firefox settings?



Here is my AVG log:


———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:50:47 PM 8/29/2007

+ Scan result:



HKU\S-1-5-21-1757981266-179605362-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929CD6E-2062-44A4-B2C5-2C7E78FBAB38} -> Adware.Generic : Cleaned.
:mozilla.22:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.24:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.25:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.26:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.27:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.28:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.29:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.30:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.31:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.794:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Addcontrol : Cleaned.
:mozilla.924:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.737:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.395:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.396:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.397:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.398:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.399:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.400:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.401:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.16:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.17:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.18:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.20:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.21:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.907:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.908:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.909:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.910:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.911:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.899:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.623:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.36:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.37:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.40:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.297:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.298:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.299:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.300:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.301:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.302:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.303:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.304:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.305:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.39:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.142:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.143:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.144:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.145:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.480:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.482:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.483:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.484:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.25:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.906:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.900:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.901:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.902:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.903:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.904:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.905:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.219:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.220:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.363:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Information : Cleaned.
:mozilla.912:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.913:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.10:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.561:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.562:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.33:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.528:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.35:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.36:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.37:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.38:C:\Documents and Settings\Paul Chiu\Application Data\Netscape\NSB\Profiles\crm5ba28.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.925:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.926:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.281:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.282:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.283:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.284:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.285:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.286:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.287:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.362:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.137:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.138:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.139:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.140:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.141:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.146:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.147:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.148:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.149:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.150:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.151:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.152:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.153:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.154:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.271:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.272:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.273:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.274:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.275:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.276:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.311:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.313:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.314:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.315:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.316:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.317:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.318:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.319:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.320:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.321:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.322:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.323:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.324:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.325:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.326:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.327:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.328:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.329:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.330:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.331:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.332:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.333:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.334:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.335:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.336:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.337:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.338:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.339:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.340:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.341:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.342:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.343:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.344:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.345:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.346:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.347:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.348:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.349:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.350:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.351:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.352:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.353:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.354:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.355:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.356:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.357:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.38:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.39:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.41:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.176:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.177:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.178:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.179:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.180:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.181:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.855:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.469:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.470:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.471:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.472:C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


::Report end















And here is my HiJack Log:


Logfile of HijackThis v1.99.1
Scan saved at 11:05:36 PM, on 8/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
c:\program files\aim6\anotify.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://www.cabalonline.net/Com/CabalWebLauncher.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: ezstor - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: x-mem1 - {C3719F83-7EF8-4BA0-89B0-3360C7AFB7CC} - C:\Program Files\Common Files\EzTools\wowctl2.dll (file missing)
O18 - Protocol: x-zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O18 - Protocol: zip - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Post #6

Is it normal that my computer runs slower and groans a little more when I start it with the AVG Shield Activated(guard.exe)?

Yes, any real time protection added will take some of your resources. You can certainly turn it off and after 30 days it will not run unless you purchase the product. Click on the Shield button and turn off the resident shield. It's up to you whether or not you want to keep AVG for one time scans. I use it about once a month or so myself.

And I seem to be experiencing a few problems after the fix:
-When I try to watch Youtube videos sometimes the screen and the video window suddenly blanks out even when I have the newest version of Adobe FlashPlayer.

Do you have the most recent version of Firefox, should be 2.0.0.6?

-The font and format of everything on Wikipedia has changed from when I visited it before.
Is there a way I can restore my original Firefox settings?

Interesting? I have never seen that before and I use Firefox pretty much exclusively. You can change that by going to Tools > Options… > Click on the Content Button. You can change the default font and size there. You can also change it as your working with View > Text Size > then either Increase/Decrease or Normal. Is it only the Wikipedia page that looks different?

Your HJT log appears clean. This does not appear to be Malware related at this time. You also said earlier there were no pop-ups or other indicators. Is this still the case?

The next thing to look at is what you have for hardware.

CPU
RAM
Free hard drive space
ECT..

There are also many issues that can contribute to reduced performance. Here are a couple of good links with some great suggestions on speeding up performance.

http://users.telenet.be/bluepatchy/miekiem…owcomputer.html

http://www.microsoft.com/windowsxp/using/s…estoreperf.mspx

http://tweakhound.com/xp/xptweaks/supertweaks1.htm

If you are still having performance issues after all the suggestions I gave you earlier then I would next head over to PC Pit Stop and look through the forums there.
They also have a test you can run and will provide some suggestions.
You can post there also to see if there's anything else you could try, that is one of their specialties.

Keep me updated on how you make out.
Post #7 last edited
Yes, I do have the latest version of FireFox but it still won't appear/play =/ And changing the font did revert the Wikipedia page format afterall. EDIT: Nevermind, I reinstalled it and it now works.
Post #8
Great, glad you got it working good.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which may be infected anyway).

Click Start>Help and Support>Undo changes to your computer with System Restore
Select Create A Restore Point then click Next. Give it a name it and then click Create

Click Start>Run and type Cleanmgr
Click the More Options Tab.
Click Clean Up in the System Restore section.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some free and evalutation versions that provide
better security than the Windows Firewall.Kerio Personal Firewall
Zone Alarm Free
Outpost Firewall
For a tutorial on Firewalls and a listing of some other available ones see the link below:
Understanding and Using Firewalls

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Spybot - Search and Destroy - Spybot: Search And Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

Install Ad-Aware - Ad-Aware SE You should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.
A tutorial on installing & using this product can be found here:
Using SpywareGuard to protect your computer from Spyware and Malware

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.
http://forums.tomcoyote.org/index.php?show…mp;#entry257163


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI